Re: Traffic selectors, fragments, ICMP messages and security policy problems

[Tero Kivinen <kivinen@iki.fi>]

Michael Richardson writes:
>   The requirements:
>       1) port-selectors
>       2) support fragments
>       3) do gateway or BITW
> 
>   are conflicting. Pick two.

Actually no. Change the 3rd requirement to:

	3) do multipath gateway or BITW solution, where fragments of a
           packet can go out from different SGW.

You can do gateways and BITWs without problems, but you cannot do that
if you want to support cases where you have multiple SGWs and
fragments of the packet can be split between those SGWs.

How often have you seen that scenario?

There are ways to get even that working, either make sure the all
fragments end up to the same SGW (easy in the load-balancing case,
simply make sure the balancer uses algorithm that will put all
fragments to the same SGW every time, as there are other benefits for
that those boxes usually try to do that anyways (i.e. they try to keep
one TCP/IP stream to use the same path to get TCP/IP work better).

If you cannot have that, then you would need communication between the
boxes about the initial fragments. Again I think that we are now
talking about the 0.01% case thus we can safely ignore it, and say
that do whatever you like.

So to rephrase that statement:

If IPSEC policy decision (AH, ESP, bypass, drop) is applied to
fragments where policy has tunnel mode port selectors, then all
fragments must have exactly the same processing that would be applied
to the same packet when fully assembled. 
-- 
kivinen@safenet-inc.com