Return-Path: X-Original-To: bess@ietfa.amsl.com Delivered-To: bess@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5274B13144C; Fri, 18 Jan 2019 14:59:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bHVlzihnawKq; Fri, 18 Jan 2019 14:59:27 -0800 (PST) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EBE94131460; Fri, 18 Jan 2019 14:59:26 -0800 (PST) Received: from lhreml703-cah.china.huawei.com (unknown [172.18.7.108]) by Forcepoint Email with ESMTP id 3DD0AB543E2D7A02FD8A; Fri, 18 Jan 2019 22:59:25 +0000 (GMT) Received: from SJCEML702-CHM.china.huawei.com (10.208.112.38) by lhreml703-cah.china.huawei.com (10.201.108.44) with Microsoft SMTP Server (TLS) id 14.3.408.0; Fri, 18 Jan 2019 22:59:24 +0000 Received: from SJCEML521-MBS.china.huawei.com ([169.254.2.237]) by SJCEML702-CHM.china.huawei.com ([169.254.4.203]) with mapi id 14.03.0415.000; Fri, 18 Jan 2019 14:59:22 -0800 From: Linda Dunbar To: "draft-sajassi-bess-secure-evpn@ietf.org" , "bess@ietf.org" CC: "Ali Sajassi (sajassi)" Thread-Topic: Are the IPsec Policy-list and DH-group-list per IPsec tunnel ? draft-sajassi-bess-secure-evpn-00 Thread-Index: AdSvgQNs4rtWiV4ZRAqyVOoyj9g6KQ== Date: Fri, 18 Jan 2019 22:59:22 +0000 Message-ID: <4A95BA014132FF49AE685FAB4B9F17F66B24D4C3@sjceml521-mbs.china.huawei.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.192.11.80] Content-Type: multipart/alternative; boundary="_000_4A95BA014132FF49AE685FAB4B9F17F66B24D4C3sjceml521mbschi_" MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: [bess] Are the IPsec Policy-list and DH-group-list per IPsec tunnel ? draft-sajassi-bess-secure-evpn-00 X-BeenThere: bess@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: BGP-Enabled ServiceS working group discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Jan 2019 22:59:29 -0000 --_000_4A95BA014132FF49AE685FAB4B9F17F66B24D4C3sjceml521mbschi_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Dave, Ali, When a PE-A has multiple IPsec tunnels with another PE (PE-B), some are per= WAN port, some are per subnet or per tenant, are the policy-list & DH-gro= up-list specific to one IPsec tunnel or to all the IPsec tunnels terminated= at the PE-A? For example PE-A has PE based IPsec tunnel with PE-B, tenant= based IPsec tunnel with PE-C, WAN port based IPsec with PE-D, does PE-A ha= ve different DH-group-list for different IPsec tunnels? Thanks, Linda From: Linda Dunbar Sent: Friday, January 18, 2019 11:48 AM To: 'draft-sajassi-bess-secure-evpn@ietf.org' ; bess@ietf.org Cc: 'Ali Sajassi (sajassi)' Subject: Comments to draft-sajassi-bess-secure-evpn-00 Ali, et al, One of the requirement you stated in the document is (under the section 2.3= ) "1) Per pair of PEs: A single IPsec tunnel between a pair of PEs to be u= sed for all tenants' traffic supported by the pair of PEs." Assuming that the solution is intended for SD-WAN. The SD-WAN edge nodes u= sually have some ports connected to trusted domain (e.g. MPLS network) whic= h doesn't need IPsec tunnel, and some ports connected to untrusted domain (= e.g. Internet) which needs IPsec tunnel. Therefore, for PE based IPsec tunn= el, it is necessary to associate the WAN ports (facing untrusted domain) wi= th the IPsec tunnels. Actually, even for other granularity (such as Per tenant, Per Subnet, or pe= r IP) IPsec tunnels, it is necessary to associate with the WAN ports as wel= l because the trusted domain doesn't need IPsec SA. Linda Dunbar --_000_4A95BA014132FF49AE685FAB4B9F17F66B24D4C3sjceml521mbschi_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Dave, Ali, =

 

When a PE-A has multip= le IPsec tunnels with another PE (PE-B), some are per WAN port, some are pe= r subnet or per tenant,  are the policy-list & DH-group-list speci= fic to one IPsec tunnel or to all the IPsec tunnels terminated at the PE-A?  For example PE-A has PE based IPsec tunnel w= ith PE-B, tenant based IPsec tunnel with PE-C, WAN port based IPsec with PE= -D, does PE-A have different DH-group-list for different IPsec tunnels?

 

Thanks, Linda

 

From: Linda Dunbar
Sent: Friday, January 18, 2019 11:48 AM
To: 'draft-sajassi-bess-secure-evpn@ietf.org' <draft-sajassi-bess= -secure-evpn@ietf.org>; bess@ietf.org
Cc: 'Ali Sajassi (sajassi)' <sajassi@cisco.com>
Subject: Comments to draft-sajassi-bess-secure-evpn-00

 

Ali, et al,

 

One of the requirement you stated in the document is= (under the section 2.3)

   “1) Per pair of PEs: A single IPsec tunnel between a = pair of PEs to be used for all tenants' traffic supported by the pair of PE= s.”

 

 

Assuming that the solution is intended for SD-WA= N.  The SD-WAN edge nodes usually have some ports connected to trusted= domain (e.g. MPLS network) which doesn’t need IPsec tunnel, and some ports connected to untrusted domain (e.g. Internet) which= needs IPsec tunnel. Therefore, for PE based IPsec tunnel, it is necessary = to associate the WAN ports (facing untrusted domain) with the IPsec tunnels= .

 

Actually, even for other granularity (such as Per te= nant, Per Subnet, or per IP) IPsec tunnels, it is necessary to associate wi= th the WAN ports as well because the trusted domain doesn’t need IPse= c SA.

 

Linda Dunbar

 

--_000_4A95BA014132FF49AE685FAB4B9F17F66B24D4C3sjceml521mbschi_--