Subject: [bess] Do you need IPsecme WG agreement to create a new IPsec Transport Mode header: ESP-in-UDP transport in SECURE-EVPN

From: Linda Dunbar <[email-masked]>
Date: Tue, 28 Jul 2020 23:17:23 +0000

Ali,

Thank you very much for the explanation.

IPsec ESP Transport mode header is :

Do you need IPsecme WG to agree to insert a new UDP header between IP header and the ESP header?

Thank you,

Linda Dunbar

From: Ali Sajassi (sajassi) <[email-masked]>
Sent: Tuesday, July 28, 2020 8:14 AM
To: Linda Dunbar <[email-masked]>; [email-masked]
Subject: Re: Questions about the ESP-Transport and ESP-in-UDP transport in SECURE-EVPN

Linda,

Please see my responses inline marked with AS> …

From: Linda Dunbar <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, July 28, 2020 at 5:49 AM
To: Cisco Employee <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Questions about the ESP-Transport and ESP-in-UDP transport in SECURE-EVPN

Ali,

Just follow up with my question in the BESS WG session.
Your draft introduced two Tunnel Types in 5.1: ESP-Transport and ESP-in-UDP Transport as below.

When standard IP Encapsulating Security Payload (ESP) is used
(without outer UDP header) for encryption of NVO packets, it is used
in transport mode as depicted below. When such encapsulation is used,
for BGP signaling, the Tunnel Type of Tunnel Encapsulation TLV is set
to ESP-Transport and the Tunnel Type of Encapsulation Extended
Community is set to NVO encapsulation type (e.g., VxLAN, GENEVE, GPE,
etc.). This implies that the customer packets are first encapsulated
using NVO encapsulation type and then it is further encapsulated &
encrypted using ESP-Transport mode.

Question 1:  Are you assuming that  using IPsec Transport mode? Instead of IPsec Tunnel mode?

AS> Not assuming but stating ☺ 1st line of section 5.1 says:

 “ … it is used in transport mode as depicted below”

Question 2: Your Figure 3 has two encodings, which one is “ESP-Transport”, which one is “ESP-in-UDP”?

AS> Figure 3 is for ESP-transport and Figure 4 is for ESP-in-UDP. Furthermore, section 5.1 is for ESP-transport and section 5.2 is for ESP-in-UDP.

Question 3: The NVO encapsulation (VxLAN, GENEVE, GRE) can also be inside the IPsec ESP tunnel. In that case, which type is used?

AS> The tunnel type of the attribute indicates what kind of underlay tunnel is used and the tunnel type of the extended community indicates what kind of overlay encap is used. Section 5.1 says:

       “the Tunnel Type of Tunnel Encapsulation TLV is set

   to ESP-Transport and the Tunnel Type of Encapsulation Extended

   Community is set to NVO encapsulation type (e.g., VxLAN, GENEVE, GPE,

   etc.).”

And section 5.2 says:

   “the Tunnel Type

   of Tunnel Encapsulation TLV is set to ESP-in-UDP-Transport and the

   Tunnel Type of Encapsulation Extended Community is set to NVO

   encapsulation type (e.g., VxLAN, GENEVE, GPE, etc.). “

Cheers,
Ali

Thanks, Linda

---

From: Anoop Ghanwani <[email-masked]>
Date: Tue, 28 Jul 2020 23:16:21 -0700

Linda,

The draft references RFC 3948 which already covers this.
https://tools.ietf.org/html/rfc3948#section-3.2

Anoop

On Tue, Jul 28, 2020 at 4:17 PM Linda Dunbar <[email-masked]>
wrote:

> *From:* Ali Sajassi (sajassi) <[email-masked]>
> *Sent:* Tuesday, July 28, 2020 8:14 AM
> *To:* Linda Dunbar <[email-masked]>; [email-masked]
> *Subject:* Re: Questions about the ESP-Transport and ESP-in-UDP transport
> in SECURE-EVPN
>
>
>
> Linda,
>
>
>
> *From: *Linda Dunbar <[email-masked]>
> *Date: *Tuesday, July 28, 2020 at 5:49 AM
> *To: *Cisco Employee <[email-masked]>, "[email-masked]" <[email-masked]>
> *Subject: *Questions about the ESP-Transport and ESP-in-UDP transport in
> SECURE-EVPN
>
>
>
> Ali,
>
>
>
> AS> Figure 3 is for ESP-transport and Figure 4 is for ESP-in-UDP.
> Furthermore, section 5.1 is for ESP-transport and section 5.2 is for
> ESP-in-UDP.
>
>
>
> Question 3: The NVO encapsulation (VxLAN, GENEVE, GRE) can also be inside
> the IPsec ESP tunnel. In that case, which type is used?
>
>
>
> AS> The tunnel type of the attribute indicates what kind of underlay
> tunnel is used and the tunnel type of the extended community indicates what
> kind of overlay encap is used. Section 5.1 says:
>
>
>
> _______________________________________________
> BESS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/bess
>

---

From: Linda Dunbar <[email-masked]>
Date: Wed, 29 Jul 2020 17:37:55 +0000

Anoop,

Thank you very much for the reference. It is very helpful.

Linda Dunbar

From: Anoop Ghanwani <[email-masked]>
Sent: Wednesday, July 29, 2020 1:16 AM
To: Linda Dunbar <[email-masked]>
Cc: Ali Sajassi (sajassi) <[email-masked]>; [email-masked]
Subject: Re: [bess] Do you need IPsecme WG agreement to create a new IPsec Transport Mode header: ESP-in-UDP transport in SECURE-EVPN

Linda,

The draft references RFC 3948 which already covers this.
https://tools.ietf.org/html/rfc3948#section-3.2<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Frfc3948%23section-3.2&data=02%7C01%7Clinda.dunbar%40futurewei.com%7Ccac56d832605450b90b708d83386f148%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C637316001965133290&sdata=Pnn4xUMKgBp7a7IdL7ihRPrRqAgpQrrZ9Fw%2BaIwbZbo%3D&reserved=0>

Anoop

On Tue, Jul 28, 2020 at 4:17 PM Linda Dunbar <[email-masked]<mailto:[email-masked]>> wrote:
Ali,

Thank you,

Linda Dunbar

From: Ali Sajassi (sajassi) <[email-masked]<mailto:[email-masked]>>
Sent: Tuesday, July 28, 2020 8:14 AM
To: Linda Dunbar <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Subject: Re: Questions about the ESP-Transport and ESP-in-UDP transport in SECURE-EVPN

Linda,

Ali,

   etc.).”

And section 5.2 says:

   “the Tunnel Type

Cheers,
Ali

Thanks, Linda

_______________________________________________
BESS mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/bess<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fbess&data=02%7C01%7Clinda.dunbar%40futurewei.com%7Ccac56d832605450b90b708d83386f148%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C637316001965133290&sdata=cZbDIKvVC2EjcQSmhekma8mBNyIGB0grrqN7QKMi5Qc%3D&reserved=0>

---

From: "Ali Sajassi (sajassi)" <[email-masked]>
Date: Fri, 31 Jul 2020 06:02:38 +0000

Linda,

You’re welcome!

Regarding your question below, ESP header encapsulation within UDP is already a standard – RFC 3948 as reference in section 5.2 of secure-evpn.

Cheers,
Ali

From: Linda Dunbar <[email-masked]>
Date: Tuesday, July 28, 2020 at 4:17 PM
To: Cisco Employee <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Do you need IPsecme WG agreement to create a new IPsec Transport Mode header: ESP-in-UDP transport in SECURE-EVPN

Ali,

Thank you,

Linda Dunbar

Linda,

Ali,

   etc.).”

And section 5.2 says:

   “the Tunnel Type

Cheers,
Ali

Thanks, Linda