Subject: [Tsv-art] DCSP mapping

From: "Mirja Kuehlewind (IETF)" <[email-masked]>
Date: Thu, 20 Sep 2018 12:41:54 +0200

Hi all,

while reviewing lisp (rfc6830bis) I wasn’t really able to find guidance on what to do with DSCP for IP in IP tunnels. rfc6830bis say "SHOULD be copied from the inner-header DSCP field“ on encapsulation and decapsulation. Other docs even say MUST (e.g. rfc6333 section-7.1). rfc2474 section-7.2 say that for IPsec it MUST NOT be copied on decapsulation. So I guess, at least for decapsulation, it might not alway make sense to overwrite the inner DSCP with the changed outer DSCP and I would think that in most cases this is rather a local policy question. Do we have any more guidance on this in any RFC that I couldn’t find, or is further guidance needed here?

Mirja

P.S: For rfc6830bis I would like the author to add a sentence that this SHOULD may depend on local policy. („In absence of a different local policy for use of DCSP, the DCSP field SHOULD be copied..“ or something like this)

---

From: Magnus Westerlund <[email-masked]>
Date: Thu, 20 Sep 2018 12:40:38 +0000

Hi,

Yes, the coping is only relevant if the entity decapsulating the packet isn't sitting on an administrative boundary between two different domains with potentially different markings. For LISP it appears likely that the LISP decapsulator will need to perform DSCP remapping and policing functions. 

Cheers

Magnus Westerlund

-----Original Message-----
From: Tsv-art <[email-masked]> On Behalf Of Mirja Kuehlewind (IETF)
Sent: den 20 september 2018 12:42
To: TSV-ART <[email-masked]>
Subject: [Tsv-art] DCSP mapping

Hi all,

Mirja

_______________________________________________
Tsv-art mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tsv-art

---

From: "Black, David" <[email-masked]>
Date: Thu, 20 Sep 2018 14:35:01 +0000

There's no simple answer here.  The overall framework is in RFC 2983, but it probably doesn't have the specific guidance that's desired.

For IPsec, the simple discussion in RFC 2474 has been superseded by material in RFC 4301.

Thanks, --David

> From: Tsv-art [mailto:[email-masked]] On Behalf Of Magnus
> Westerlund
> Sent: Thursday, September 20, 2018 8:41 AM
> To: [email-masked]; [email-masked]
> Subject: Re: [Tsv-art] DCSP mapping
> 
> 
> [EXTERNAL EMAIL]
> Please report any suspicious attachments, links, or requests for sensitive
> information.
> 
> 
> Hi,
> 
> Yes, the coping is only relevant if the entity decapsulating the packet isn't
> sitting on an administrative boundary between two different domains with
> potentially different markings. For LISP it appears likely that the LISP
> decapsulator will need to perform DSCP remapping and policing functions.
> 
> Cheers
> 
> Magnus Westerlund
> 
> while reviewing lisp (rfc6830bis) I wasn’t really able to find guidance on what
> to do with DSCP for IP in IP tunnels. rfc6830bis say "SHOULD be copied from
> the inner-header DSCP field“ on encapsulation and decapsulation. Other
> docs even say MUST (e.g. rfc6333 section-7.1). rfc2474 section-7.2 say that
> for IPsec it MUST NOT be copied on decapsulation. So I guess, at least for
> decapsulation, it might not alway make sense to overwrite the inner DSCP
> with the changed outer DSCP and I would think that in most cases this is
> rather a local policy question. Do we have any more guidance on this in any
> RFC that I couldn’t find, or is further guidance needed here?
> 
> 
> Mirja
> 
> P.S: For rfc6830bis I would like the author to add a sentence that this SHOULD
> may depend on local policy. („In absence of a different local policy for use of
> DCSP, the DCSP field SHOULD be copied..“ or something like this)
> 
>

---

From: Bob Briscoe <[email-masked]>
Date: Fri, 21 Sep 2018 17:44:30 +0100

Mirja,

It might save some reading (at the risk of summarizing 2983 wrongly in 
front of the author) to say that 2983 offers two modes of Diffserv 
tunnel, with the choice between them based on policy:

 1. uniform (on encap copy to outer; on decap copy from outer)
 2. pipe (on decap, use inner for traffic conditioning)

Some of the confusion between different advice can be explained by the 
fact that, altho the decap node might also be on a policy boundary, the 
policy function can be considered to be applied before or after decap.

Then, whether the mode of the tunnel is uniform or pipe interacts with 
the policy function in ways that depend on exactly where the operator 
locates the policy boundary within the machine, relative to where decap 
is located within the machine.

So, as David said, there really is no simple answer. An operator can 
pretty much put it all together to achieve whatever outcome it wants. So 
I don't think it would be helpful for 6830bis to recommend or require 
any one approach.

Bob

-- 
________________________________________________________________
Bob Briscoe                               http://bobbriscoe.net/