Packet format for services

Example 1: two services using the same EG

In this example, two PEs that have two VPRNs encrypted with the same EG over SR-MPLS.

This scenario occurs when a customer owns both services and wants to manage the CA and PSKs jointly for the two services. The following applies:

• The same EG can be used across multiple services if those services use the same BGP instance.

• If the same EG is configured for two services on the same two PEs, the following applies:

  • A single MKA session runs from the local address of the security termination policy to the EG peer IP address. That is, the MKA source IP address is the security termination policy local address assigned to that EG, and the destination IP address is the peer IP address of the same EG used by the two services.
  • Because there is a single MKA session between the two services, a single datapath encryption key (SAK) is used to encrypt traffic from both services. If the two services need to use different SAKs, each service must be assigned its own EG.
  • The ES is common between the two services because they are encrypted using the same SAK.
  • From packets traveling from PE1 to PE3, both services appear identical, as indicated by the format shown in the following figures.

Example 2: Services and SR tunnel with different EGs

The following figure shows an example of two PEs that have two VPRNs encrypted with two different EGs over the same SR MPLS tunnel.

This scenario occurs when the two services are owned by different customers, and they require additional security by having separate CAs, PSKs, and SAKs.

When two separate EGs are configured for two services on the same two PEs, the following applies:

• There are two MKAs from the local address of the security termination policy of each EG to each EG peer IP address. The MKA source IP address is the local address of the security termination policy assigned to that EG, and the destination IP address is the peer IP address on the assigned EG for the two services. If the same BGP instance is used for both services, even if the EGs are different, the local address of the security termination policy and the peer IP address of the EG can still be the same. For example, the same security termination policy is used for both EGs and the same peer IP address is configured on both EGs. In this case, the unique identifier for the MKA is the SCI because each EG requires a unique ES. As a result, the unique MKA1 identifier is <srcIP= 2.1.1.1, dstIP=4.1.1.1, ES-1>, and MKA2 is < srcIP= 2.1.1.1, dstIP=4.1.1.1, ES-2>.

• Because there is a unique MKA for each service, a unique SAK is used to encrypt service user traffic for each service.

• From online packets going from PE1 to PE3, there are two unique packet signatures, as shown in the following figures.