Subject: Re: [karp] OSPFv3 Auth - Packet Prioritization

From: "Michael Barnes" <[email-masked]>
Date: Wed, 23 Jun 2010 21:31:39 -0700

Of course it can all be customized with policies. I have to admit I'm not a
QoS expert, but as I understand things we don't have any problems with any
OSPF packets competing with data packets.

Regards,
Michael

------ Original Message ------
Received: Wed, 23 Jun 2010 07:53:49 PM PDT
From: "Bhatia, Manav (Manav)" <[email-masked]>
To: Michael Barnes <[email-masked]>,        Vishwas Manral
<[email-masked]>Cc: "[email-masked]" <[email-masked]>
Subject: RE: [karp] OSPFv3 Auth - Packet Prioritization

> Wow. So you give different DSCP values to Hellos and other packets? This is
odd, because you have no control over what this would do to your other packets
that are reaching the other node with a lower DSCP value? I think the idea is
to always give the highest priority to the control packets so that they never
compete with the data traffic, but then I guess this is also an implementation
specific issue.
> 
> The way I understood it was that we always give the highest priority to
control packets, and then somehow prioritize certain packets over the other
within that forwarding class (FC). This to me meant that all OSPF packets
regardless of what they are would always go out with the highest DSCP value so
that there is no contention of resources with other data traffic. Then within
OSPF, prioritize the Hellos and the Acks.

---

From: "Michael Barnes" <[email-masked]>
Date: Thu, 24 Jun 2010 08:50:44 -0700

------ Original Message ------
Received: Thu, 24 Jun 2010 07:58:55 AM PDT
From: Tero Kivinen <[email-masked]>
To: Vishwas Manral <[email-masked]>Cc: "[email-masked]"
<[email-masked]>
Subject: Re: [karp] OSPFv3 Auth - Packet Prioritization

> Vishwas Manral writes:
> > >> Yup, this sounds like an acceptable solution. All HELLOs
> > >> and ACKs could use one IPSec SA while the rest of the packets
> > >> could go over the other.
> > Low priority and high priority can have different DSCP value. :)) Just
> > think over it.
> 
> In most cases the when the IPsec and OSPF are not tightly combined
> together the OSPF needs to somehow indicate to the IPsec that it
> should use different SAs for these two different classes of OSPF
> traffic. The easiest way to do that is to set them to have different
> DSCP values, as DSCP aware IPsec implementations should already be
> able to select SAs based on the DSCP values. 

This brings up a good point. There are devices where IPsec is running on a
different blade from routing. The packets are processed by IPsec and then
passed to the blade on which the routing protocols run. The software on that
blade does not have any specific knowledge of routing packets, nor should it
IMHO. However it can prioritize processing based on DSCP values.

Regards,
Michael

---

From: "Michael Barnes" <[email-masked]>
Date: Thu, 24 Jun 2010 13:48:28 -0700

------ Original Message ------
Received: Thu, 24 Jun 2010 12:50:43 PM PDT
From: Acee Lindem <[email-masked]>
To: mark Brown <[email-masked]>Cc: "[email-masked]" <[email-masked]>
Subject: Re: [karp] OSPFv3 Auth - Packet Prioritization

> Hey Mark,
> 
> I knew that - what I'm saying is that since OSPFv3 uses transport mode
IPsec, the originator could set the traffic class in the IPv6 header (not
protected by IPsec) to influence prioritization. 
> 
> My second comment is that perhaps we made a mistake in using IPsec for
OSPFv3 given the limitations. With RFC5709. we have stronger authentication in
OSPFv2 and we could use similar mechanisms with OSPFv3. LLs (RFC5613) could be
used to carry the authentication data. 

I think this is a great idea, my guess is that all implimentors would agree.

Regards,
Michael

> Thanks,
> Acee