prioritize data traffic. The 8 bit diffserv field consists of two parts: a 6 bit Differentiated Services
Code Point (DSCP) and a 2 bit Explicit Congestion Notification (ECN). NetDefendOS IPsec treats
these as a whole and does not divide the 8 bit field.
For IPsec, the DiffServ values related to a tunnel can be split into three types:
• The DiffServ value of the packets involved in the IKE exchange for tunnel setup.
• The DiffServ value of the outer tunnel IPsec packets.
• The DiffServ value of the packets being transported inside the tunnel.
The administrator can alter the DiffServ value in the following ways:
• For tunnel setup, the DiffServ value of IKE packets can have a specified fixed value.
• The DiffServ of the outer tunnel packets can be set to a fixed value or they can have the value
copied from the DiffServ field of the packets inside the tunnel.
Setting up the above two options is described next.
Specifying the DiffServ Field for IKE Traffic
By default, all IKE packets sent by NetDefendOS during tunnel setup have their DiffServ value set
to zero. This can be changed to a fixed value for a tunnel by setting the IKEDSField property of the
IPsecTunnel object. For example:
gw-world:/> set Interface IPsecTunnel my_tunnel IKEDSField=1
Setting the DiffServ Field in the Outer Tunnel
By default, all IPsec outer tunnel packets sent by NetDefendOS have their DiffServ field value
copied from the packets inside the tunnel. The DiffServ field can be set to a fixed value by setting
the property IPsecDSField for the IPsecTunnel object. For example:
gw-world:/> set Interface IPsecTunnel my_tunnel IPsecDSField=1
Chapter 9: VPN
700
To Next Page
Loading...
