RE: [Diffserv] ToS, IPSec and Anti replay

> So, just so I am clear. If I have 2 classes of service and one tunnel
> for both, and packets are out of order, you are saying that it is the
> IPSec anti-replay windows problem? The solution is a tunnel per class of
> service.

That's one possibility.  Here's the complete story -- IF

(1) You have two classes of service AND
(2) You want to run them in IPSec tunnel mode AND
(3) You want them differentiated in a way that reorders packets within the
tunnel AND
(4) You want to use IPSec anti-replay protection AND
(5) You want to use a single tunnel.

THEN you have a problem, because the last three items cannot in general be
done at
the same time without having the IPSec anti-replay protection complain or
worse.

There are three possible solutions based on which item is left out:

(A) Leave out (3) by marking the same class of service on the outer
	IP headers even though there are multiple classes carried in the
tunnel.
	There will be no packet reordering within the tunnel.
(B) Leave out (4) by not configuring IPSec anti-replay protection.
(C) Leave out (5) by using a tunnel per class of service that you want
differentiated.
	This uses additional resources to support the additional tunnels.

Again, please check the text in draft-ietf-diffserv-tunnels-01.txt, which
is in informal last call at the moment.  The text in Sections 5.1 and 5.2
is supposed to address *exactly* this issue - if the text is not
sufficiently clear, I need to make it so, and would appreciate suggestions.

Thanks,
--David

---------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 42 South St., Hopkinton, MA  01748
+1 (508) 435-1000 x75140, FAX: +1 (508) 497-6909
black_david@emc.com  Cellular: +1 (978) 394-7754
---------------------------------------------------

_______________________________________________
diffserv mailing list
diffserv@ietf.org
http://www1.ietf.org/mailman/listinfo/diffserv
Archive: http://www-nrg.ee.lbl.gov/diff-serv-arch/