Subject: help

From: "Harish Kumtakar" <[email-masked]>
Date: 4 Mar 2003 05:33:31 -0000

hi,

      Why IPSEC can not be used in RSVP to care of security. 
Please throw some light on this aspect.

Regards
-harish

Harish Kumtakar
Samsung India Software Operations
Samsung Digital House
No. 67, Infantry Road
Bangalore - 560 001

Ph: 5550555 extn:2260

---

From: David Charlap <[email-masked]>
Date: Tue, 04 Mar 2003 11:58:25 -0500

Harish Kumtakar wrote:
> 
>      Why IPSEC can not be used in RSVP to care of security. Please throw 
> some light on this aspect.

The reason it isn't in classical RSVP is because IPSEC secures two 
endpoints.  But the nature of RSVP is such that packets are supposed to 
be intercepted and processed by transit routers.

An RSVP router does not send a Path message to his neighbor.  He sends 
it to the ultimate destination address, with the router-alert option, so 
that RSVP-aware routers along the way may intercept and process the 
packet.  This is fundamentally incompatible with IPSEC - where the 
packet is encrypted such that transit routers can not intercept anything.

If you want to use IPSEC with RSVP, then you must send packets directly 
to neighbors and abandon the use of router-alert.  This isn't a problem 
for RSVP-TE, since the presence of non-RSVP routers isn't permitted in 
an MPLS/RSVP-TE network.  But it eliminates the ability for classical 
RSVP to work over networks with non-RSVP nodes - something that is a key 
goal of the RSVP protocol.

IPSEC also makes multicast much more CPU intensive.  If every packet is 
encrypted, then you can't simply generate one Path message for 
transmission to all downstream nodes in a multicast group.  You have to 
generate multiple separate packets and encrypt them individually.

-- David

---

From: Steven Berson <[email-masked]>
Date: Tue, 4 Mar 2003 10:00:12 -0800 (PST)

Actually, RSVP can be used with IPSEC.  See RFC 2207, ``RSVP 
Extensions for IPSEC Data Flows''.

Regards,
Steve

On Tue, 4 Mar 2003, David Charlap wrote:

> _______________________________________________
> Rsvp mailing list
> [email-masked]
> http://mailman.isi.edu/mailman/listinfo/rsvp
>

---

From: Steven Berson <[email-masked]>
Date: Tue, 4 Mar 2003 10:33:19 -0800 (PST)

OK, I normally don't respond to my own messages, but I misunderstood 
the question.  I understood the question to be asking how to use RSVP 
to reserve resources for IPSEC data flows.  I don't recall seeing the 
original message, but as I read David's response carefully, it appears 
that the question really is about using IPSEC to protect the RSVP 
protocol messages themselves.  David gives a good answer to the latter
question.

Regards,
Steve

---

From: George Swallow <[email-masked]>
Date: Tue, 04 Mar 2003 14:34:00 -0500

Steven -

I believe that 2207 deals with getting reservations for IPSEC flows.
The subject of this thread is using IPSEC to secure RSVP protocol
exchanges.

...George

==================================================================
George Swallow       Cisco Systems                  (978) 497-8143
                     250 Apollo Drive
                     Chelmsford, Ma 01824