Subject: [IPsec] can IPSec tunnel support multi-tenancy?

From: Linda Dunbar <[email-masked]>
Date: Thu, 18 May 2017 20:33:06 +0000

IPSec experts,

When an IPSec tunnel is established between two sites (say, SD-WAN use case), is there any fields in the header that can be used to differentiate payload belonging to different tenants?

Thank you very much

---

From: Vishwas Manral <[email-masked]>
Date: Thu, 18 May 2017 13:59:10 -0700

Lina,

I think that is a function of the control plane - so a tunnel is
established for a tenant - we do not need to identify tenant after the
session is created.

Can a tunnel have traffic from different tenants? If so the payload
could have some identifiers (GRE with Tenant data).

-Vishwas

On Thu, May 18, 2017 at 1:33 PM, Linda Dunbar <[email-masked]> wrote:
>
>
> IPSec experts,
>
>
>
> When an IPSec tunnel is established between two sites (say, SD-WAN use
> case), is there any fields in the header that can be used to differentiate
> payload belonging to different tenants?
>
>
>
> Thank you very much
>
>
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

---

From: "Scott Fluhrer (sfluhrer)" <[email-masked]>
Date: Thu, 18 May 2017 21:08:06 +0000

You could assign different SPIs to different tenants.

From: IPsec [mailto:[email-masked]] On Behalf Of Linda Dunbar
Sent: Thursday, May 18, 2017 4:33 PM
To: [email-masked]
Subject: [IPsec] can IPSec tunnel support multi-tenancy?

IPSec experts,

Thank you very much

---

From: Paul Wouters <[email-masked]>
Date: Thu, 18 May 2017 17:12:01 -0400 (EDT)

On Thu, 18 May 2017, Linda Dunbar wrote:

> When an IPSec tunnel is established between two sites (say, SD-WAN use case), is there any fields in the header that can be used to
> differentiate payload belonging to different tenants?

libreswan supports Labeled IPsec that can be used with seperate different
IPsec SA's to uniquely label/compartmentalize streams. For instance, you
can put an SElinux label on it so only traffic with that label is
allowed over such a tunnel. This can be used with MLS based systems.

You can have multiple IPsec SA's with the same src/dst and different
labels, so that "secret" will go over the "secret" IPsec SA, and "top
secret" goes over the "top secret" IPsec SA.

Our implementation currently only supports IKEv1 using a private space
assignment for the label negotiation. For IKEv2, it would be good if we
got a proper IANA allocation and RFC, but I haven't started that process
yet.

Paul

---

From: Nico Williams <[email-masked]>
Date: Thu, 18 May 2017 17:13:23 -0500

On Thu, May 18, 2017 at 08:33:06PM +0000, Linda Dunbar wrote:
> case), is there any fields in the header that can be used to

"Yes", but.

As others have said, you could have and use different different SA pairs
for different users, with selection done via traffic selectors as usual.
The protocol suite (ESP, IKEv2) certainly allows for this.  And the
IPsec security architecture (RFC4301) certainly allows for this too.

For bump-in-the-wire (BITW) implementations, provided that each tenant
gets a different, static IP address assignment, this is easy enough.
Otherwise, for BITW it quickly becomes infeasible to get the semantics
you probably want.

For bump-in-the-stack (BITS), if it has no way to refer to user
processes (which is to be expected of BITS), then what you want is
infeasible in the general case.

For native IPsec implementations, you might as well use transport mode,
naturally, though the question is still relevant.  You may or may not
find support for multi-tenancy in the sense you gave.  You basically
want some sort of stateful IPsec machinery.  See RFC5660 (by yours
truly) for what that might entail.

Nico
--

---

From: Nico Williams <[email-masked]>
Date: Thu, 18 May 2017 17:30:41 -0500

> Otherwise, for BITW it quickly becomes infeasible to get the semantics

I would also add that for BITW, why would you want this?

Nico
--