Subject: [PWE3] Secure MPLS based TDM PW

From: "Bapat, Swapna (Swapna)" <[email-masked]>
Date: Mon, 2 Oct 2006 10:04:32 -0400

I would like to understand if there is a consensus on securing payload of MPLS based TDM PW.
One could argue that the PW is emulating a point to point circuit, so why do we need encryption? but since the data traverses a packet network, some providers have expressed a need for securing the PW traffic.

Alternate suggestions are to use IP/UDP encapsulation so that IPSec can be used. This approach makes us lose the benefits of MPLS traffic engineering. 

Thoughts or suggestions?

Regards,
Swapna

_______________________________________________
pwe3 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pwe3

---

From: Stewart Bryant <[email-masked]>
Date: Mon, 02 Oct 2006 15:14:45 +0100

>One could argue that the PW is emulating a point to point circuit, so why do we need encryption? but since the data traverses a packet network, some providers have expressed a need for securing the…
What do you mean by secure?

An MPLS network is intrinsicly more secure than an IP network, because
the labels have to be put there by the network rather than the user.

If you mean secure against evesdropping, or secure against a compromised
router, then we have no protection.

>Alternate suggestions are to use IP/UDP encapsulation so that IPSec can be used. This approach makes us lose the benefits of MPLS traffic engineering.
Well no, you can encap in UDP/IP, secure, then encap in MPLS, then
run TE, so you don't loose the benefits of TE, but it's not very ellegant.

>Thoughts or suggestions?

Yaakov did have some other ideas, which I am sure he will explain, and
yes this is an area that I think the WG needs to give greater attention to.

- Stewart

---

From: "Yaakov Stein" <[email-masked]>
Date: Wed, 4 Oct 2006 10:14:31 +0200

I would like to understand if there is a consensus on securing payload
of MPLS based TDM PW.
One could argue that the PW is emulating a point to point circuit, so
why do we need encryption? but since the data traverses a packet
network, some providers have expressed a need for securing the PW
traffic.

Alternate suggestions are to use IP/UDP encapsulation so that IPSec can
be used. This approach makes us lose the benefits of MPLS traffic
engineering. 

Thoughts or suggestions?

[YJS] I intend presenting in San Diego an approach for accomplishing
this 
(hint: based on MACsec idea).  Also - see draft-stein-pwe3-sec-req.