Re: [IPsec] One comment to this draft//Fwd: I-D Action: draft-ietf-ipsecme-ad-vpn-problem-06.txt

Toby Mao <yumao9@gmail.com> Thu, 06 June 2013 15:31 UTC

Return-Path: <yumao9@gmail.com>
X-Original-To: ipsec@ietfa.amsl.com
Delivered-To: ipsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E70021F99AF for <ipsec@ietfa.amsl.com>; Thu, 6 Jun 2013 08:31:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, J_CHICKENPOX_13=0.6, NO_RELAYS=-0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JrfPqy2Kh85N for <ipsec@ietfa.amsl.com>; Thu, 6 Jun 2013 08:31:28 -0700 (PDT)
Received: from mail-ie0-x236.google.com (mail-ie0-x236.google.com [IPv6:2607:f8b0:4001:c03::236]) by ietfa.amsl.com (Postfix) with ESMTP id 7ED4221F999E for <ipsec@ietf.org>; Thu, 6 Jun 2013 08:31:28 -0700 (PDT)
Received: by mail-ie0-f182.google.com with SMTP id 9so7585571iec.27 for <ipsec@ietf.org>; Thu, 06 Jun 2013 08:31:27 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=65puN6F+D3lYWM9DxNzjrgN5savfmwamYyLwViixPDU=; b=tO8XpjNdBYgkK9F3f9tlXK8NgCRTQ8ULeIoUYCtx9qGfvObfquFw5HyQZNd7m6YyL1 W9GAGFszAS+cflGXiXA1P65XbI+55utCfC8oSLyw0DE5/LouI3dsqJKDAHieUkMC9XKj dB4UZhkIETAreCOqrXR9dMHzCufeFO41v/aYN4FKhhj2AX9OjwJdiVUHKr56NatIDlqg ozK8ie15kGHCtbyO1h0dPIDCvKfEFWCJ3Ai97PIxg56oM8OPvJgn+DcEpTkS/r+56qfM NPqLzo3SWjTl+BGyyFlfsY/ZgaBVsm92J/Uy5+qEiW3pBx1PQ48yVLqP7fOIGFEEvjvN 3S0A==
MIME-Version: 1.0
X-Received: by 10.50.61.141 with SMTP id p13mr6036000igr.9.1370532687757; Thu, 06 Jun 2013 08:31:27 -0700 (PDT)
Received: by 10.43.168.4 with HTTP; Thu, 6 Jun 2013 08:31:27 -0700 (PDT)
In-Reply-To: <CDD27E30.50B78%praveenys@juniper.net>
References: <CAOyVPHSfsSp=Hp4Kj=LhcY4eSkTQWu6j4h4r9OkTbha8ko5OZA@mail.gmail.com> <CDD27E30.50B78%praveenys@juniper.net>
Date: Thu, 06 Jun 2013 23:31:27 +0800
Message-ID: <CAPPa=kntsZnhf7gQQpJ7xisdRkua9rEmt=90bmyrHo94VUviYA@mail.gmail.com>
From: Toby Mao <yumao9@gmail.com>
To: Praveen Sathyanarayan <praveenys@juniper.net>
Content-Type: multipart/alternative; boundary="047d7bd6bfee01c8a704de7e0283"
Cc: IPsecme WG <ipsec@ietf.org>, Yoav Nir <ynir@checkpoint.com>, Paul Hoffman <paul.hoffman@vpnc.org>, "maoyu@h3c.com" <maoyu@h3c.com>
Subject: Re: [IPsec] One comment to this draft//Fwd: I-D Action: draft-ietf-ipsecme-ad-vpn-problem-06.txt
X-BeenThere: ipsec@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Discussion of IPsec protocols <ipsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipsec>, <mailto:ipsec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ipsec>
List-Post: <mailto:ipsec@ietf.org>
List-Help: <mailto:ipsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipsec>, <mailto:ipsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 06 Jun 2013 15:31:30 -0000

Hi Praveen:

      I agree the primary goal of ADVPN solution is to establish the direct
connectivity in the full mesh topology. However,  in the
 draft-ietf-ipsecme-ad-vpn-problem,  there are some requirements such as
multicast, L3VPN, etc. which seems to “not so important” in the ADVPN, but
also need to be defined . The use of QoS is this case.

    In the current IPsec VPN solution for Hub-Spoke topology and full-mesh
topology, we need to maintain QoS policy per peer. This QoS policy usually
defines the traffic policing, general traffic shaping or rate limit
control. In the Hub-Spoke topology, the QoS policy for the spoke can be
effective because all the traffic go through the hub.

In the ADVPN, if spoke A obtains the spoke B’s information, such as peer
address, route information etc. to establish the direct connectivity, the
QoS policy for this spoke should also  be included if needed. Thus, after
the connection is setup, the traffic from Spoke A to Spoke B can not be
overrun.

The new requirement 15 added in the updated draft is ok for me.

Regard,

Toby

On Tue, Jun 4, 2013 at 8:23 AM, Praveen Sathyanarayan <praveenys@juniper.net
> wrote:

>  HI Vishwas,
>
>  I understand the use of QOS and I do think it would be a nice feature.
> But I am trying to see how this is specific to AD-VPN. I feel this is
> applicable for regular VPN as well (in Hub and Spoke topology or any type
> of topology).  AD-VPN is about auto-discovering spokes/gateway/entity and
> establishing a direct connectivity. To me AD-VPN is, an extension to
> existing IPSec solution.  So, IMO, QoS requirement should be solved out
> side of AD-VPN.
>
>  What do you think?
>
>  -- Praveen
>
>   From: Vishwas Manral <vishwas.ietf@gmail.com>
> Date: Monday, June 3, 2013 8:45 AM
> To: Praveen Sathyanarayan <praveenys@juniper.net>
> Cc: Toby Mao <yumao9@gmail.com>, Yoav Nir <ynir@checkpoint.com>, IPsecme
> WG <ipsec@ietf.org>, "maoyu@h3c.com" <maoyu@h3c.com>, Paul Hoffman <
> paul.hoffman@vpnc.org>
>
> Subject: Re: [IPsec] One comment to this draft//Fwd: I-D Action:
> draft-ietf-ipsecme-ad-vpn-problem-06.txt
>
>   Hi Praveen,
>
> I think the idea is to be able to have QoS in a way that the traffic from
> one spoke cannot overwhelm the Hub and lead to issues there. We need to
> maintain QoS policies per spoke (or spoke type) on the Hub, as well as to
> be able to push some QoS policies to the spokes from the Hub.
>
> Do I make sense?
>
> Thanks,
> Vishwas
>
>
> On Mon, May 6, 2013 at 9:30 AM, Praveen Sathyanarayan <
> praveenys@juniper.net> wrote:
>
>>  Hi Toby,
>>
>>  When you say QoS policy, could you elaborate what it really means? I
>> mean what kind of information does it need to have or exchanged?
>>
>>  -- Praveen
>>
>>   From: Toby Mao <yumao9@gmail.com>
>> Date: Sunday, May 5, 2013 8:49 AM
>> To: Yoav Nir <ynir@checkpoint.com>
>> Cc: IPsecme WG <ipsec@ietf.org>, "maoyu@h3c.com" <maoyu@h3c.com>, Paul
>> Hoffman <paul.hoffman@vpnc.org>
>> Subject: Re: [IPsec] One comment to this draft//Fwd: I-D Action:
>> draft-ietf-ipsecme-ad-vpn-problem-06.txt
>>
>>   Hi Yoav.
>>
>>          The QoS implementations in ADVPN are :
>>
>> 1.        In the star topology,  the QoS policy is implemented
>> individually for each spoke in the hub, all the traffic through the Hub can
>> be regulated by QoS policy in the hub.
>>
>> 2.       In the full mesh topology,  when the two spokes establish the
>> direct connection, each spoke should also have the QoS policy for each
>> other. The QoS policy can be obtained from the Hub, or other control device
>> ,  which has the individual QoS policy for each spoke.
>>
>> I think your understanding is the same as the QoS implementation in the
>> full mesh topology.
>>
>> Toby
>>
>>
>> On Fri, May 3, 2013 at 4:11 AM, Yoav Nir <ynir@checkpoint.com> wrote:
>>
>>> Hi Toby.
>>>
>>>  Let's see if I understand the issue. I'll describe this with an
>>> example. Please let me know if I got it.
>>>
>>>  Suppose we have satellite gateways A, B, C, D, and E. A through D each
>>> have a bandwidth of 10 Mb/s, while E has 20 Mb/s.
>>>
>>>  The center gateway, Z, has plenty of bandwidth and the appropriate QoS
>>> policy. So if A, B, and C are simultaneously sending traffic to E through
>>> Z, Z will do the QoS magic (maybe by dropping packets or playing with TCP
>>> ACKs) to make sure the QoS goals are met.
>>>
>>>  Now add ADVPN to the mix. A and E discover each other, and are able to
>>> bypass Z. Initially A had no IPsec policy about E. There's no reason to
>>> think it had a QoS policy about E, and the same is true in the other
>>> direction. Unless the QoS policy from Z somehow gets transmitted to the
>>> satellites, they may reach congestion and have the QoS targets miss.
>>>
>>>  So whereas before ADVPN the center gateway could be counted on to
>>> handle the QoS (because everything goes through it), as soon as you add
>>> ADVPN, that policy has to be enforced on the spokes, or not at all.
>>>
>>>  I'm not sure whether we can or should solve this issue as part of
>>> AD-VPN, but I want to make sure that we understand the issue.
>>>
>>>  Yoav
>>>
>>>   On May 2, 2013, at 6:02 PM, Toby Mao <yumao9@gmail.com> wrote:
>>>
>>>
>>>  On Sat, Apr 27, 2013 at 10:57 PM, Paul Hoffman <paul.hoffman@vpnc.org>wrote:
>>>
>>>> These requirements might be useful to add in the next draft, but they
>>>> need to be refined.
>>>>
>>>> On Apr 26, 2013, at 8:10 PM, Toby Mao <yumao9@gmail.com> wrote:
>>>>
>>>> > The ADVPN solution SHOULD be able to implement Quality of Service
>>>> (QoS) to regulate the traffic in the ADVPN topology.
>>>>
>>>>  Why is this statement needed? Do you see situations where an ADVPN
>>>> solution would be *prevented* from implementing some sort of QoS because it
>>>> was an ADVPN?
>>>>
>>>
>>>   [Toby]: There is no situation that ADVPN solution could be prevented
>>> from implementing Qos. Actually, Qos is crucial on ADVPN, such as sharing
>>> network bandwidth, meeting the application latency requirement. Especially
>>> in the Hub, for each spoke, the Qos policy should be implemented
>>> individually , because different spoke has different link speed and data
>>> processing capability. Thus, in the ADVPN solution, the small spoke can not
>>> be overrun by hub by sending too much traffic, also the spoke which has
>>> large bandwidth cannot hog the hub's resources and starve other spokes. In
>>> addition, a unique Qos policy for each spoke in the hub could be cumbersome
>>> for administrator, some improvement could be implemented, such as the
>>> spokes with the same bandwidth can belong to the same group, the Qos policy
>>> can be implemented on a basis of group.
>>>
>>>>
>>>> > ADVPN peer SHOULD NOT send excessive traffic to the other members of
>>>> ADVPN.
>>>>
>>>>  How would you define "excessive"? Where would that measurement be done?
>>>
>>>
>>> [Toby]  The traffic to the ADVPN peer exceeding the actual peer
>>> bandwidth can be defined as "excessive". To solve this problem, the other
>>> ADVPN peer should apply Qos policy for this ADVPN peer.
>>>
>>>  > The traffic for each ADVPN peer CAN be measured individually for
>>>> shaping and policing.
>>>>
>>>>  Why is this statement needed? Do you see situations where an ADVPN
>>>> solution would be *prevented* from measuring individually?
>>>
>>>
>>> [Toby]  The reason is explained in the first answer.
>>>
>>>>
>>>> --Paul Hoffman
>>>
>>>
>>>
>>>
>>>  Email secured by Check Point
>>>
>>> _______________________________________________
>>> IPsec mailing list
>>> IPsec@ietf.org
>>> https://www.ietf.org/mailman/listinfo/ipsec
>>>
>>>
>>>
>>
>> _______________________________________________
>> IPsec mailing list
>> IPsec@ietf.org
>> https://www.ietf.org/mailman/listinfo/ipsec
>>
>>
>