Subject: Question on draft-ietf-l3vpn-ipsec-2547-01.txt

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 10 Dec 2003 18:50:26 -0800

Hello,

In section 2.6, it says that one IPsec SA  between the PEs would be
sufficient for "N" VPNs.
If you have just one IP-IP transport mode SA, how would the VPN demuxing
work ?
Asssume i am having overlapping addresses in the VPNs. After decrypting the
packet,
how do i know which VPN routing instance to lookup the route ? I thought SPI
was
one of the demuxing fields which means you have to have at least one SA per
VPN.
 What am i missing ?

-thanks
mohan

---

From: [email-masked]
Date: Thu, 11 Dec 2003 10:31:32 +0100

Hi Mohan,

section 2.4 of the draft explains that packets are MPLS-in-IP/GRE
encapsulated before IPsec handling. The MPLS label is used as the VPN
demux field. So you'll have one SA per PE-PE pair in which you can mux
the different VPNs using MPLS labels (that are distributed via BGP just
like in 2547).

cheers,
Jeremy.

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 11 Dec 2003 10:11:06 -0800

> the different VPNs using MPLS labels (that are distributed via BGP just
I don't think this is explicitly mentioned in the draft and it might be good
to clarify it
thought it may be obvious for some.

thanks
mohan