Subject: RSVP and IPSec

From: [email-masked]
Date: Tue, 14 Sep 1999 14:37:23 -0400

My question deals with RSVP data flows over an IPSec network.

Considering the following model:

     Host 1------------ Security Gateway 1 ------- Router -------- Security
Gateway 2 -----------------Host 2

Assume: Each network element is IPSec and RSVP capable.

An RSVP session is setup between Host 1 and 2.  Since IPSec is implemented in
the model, modifications specified in RFC2207 are used to incorporate the
vDstPort and Security Parameter Index (SPI) from the Security Association (SA)
between Host 1 and 2.  Consider the case when an SA is also established between
SG 1 and 2 in tunnel mode, in addition to the SA between the endpoints.  The
RSVP data packet for a particular session is received by SG1 from Host 1 and
encrypted using ESP.  An IP header is added with SG1 and 2 as the source and
destination addresses and the corresponding SPI.  When the encrypted packet
arrives at the center router, the SPI for this packet is for SG1 and 2, but the
SPI in the state block is the SPI from Host 1 and 2.  Therefore the router
cannot properly process this packet.

Is the above model realistic?  If so, how is any classification and scheduling
done at the center router?

There is a draft from IEFT about RSVP operation over IP tunnels
(draft-ieft-rsvp-tunnel-04.txt).  Can the above model operate without the
additional functionality outlined in that draft?

Thank you.

Patrick Foy

---

From: Andreas Terzis <[email-masked]>
Date: Tue, 14 Sep 1999 23:26:13 -0700

> additional functionality outlined in that draft?

Hi Patrick,

If you are encapsulating packets at SG1 to SG2 the problem is that RSVP
packets are not visible in the first place, to install the RSVP state you are
talking about in the routers inside the tunnel between SG1 and SG2.

In the draft that you mentioned, we describe how you can create an RSVP session
over the IPSec tunnel you mention as well as how to do classification. I attach
a Section from the draft, which is quite appropriate:

8.  IPSEC Tunnels

   In the case where the IP-in-IP tunnel supports IPSEC (especially ESP
   in Tunnel-Mode with or without AH) then the Tunnel Session uses the
   GPI SESSION and GPI SENDER_TEMPLATE/FILTER_SPEC as defined in
   [RSVPESP] for the PATH and RESV messages.

   Data packets are not encapsulated with a UDP header since the SPI can
   be used by the intermediate nodes for classification purposes.
   Notice that user oriented keying must be used between Rentry and
   Rexit, so that different SPIs are assigned to data packets that have
   reservation and "best effort" packets, as well as packets that belong
   to different Tunnel Sessions if those are supported.

regards,

Andreas Terzis