Skip to main content

9.2.1 Negotiation between Tunnel Endpoints

9.2.1 Negotiation between Tunnel Endpoints​

This section specifies how IPsec tunnel endpoints negotiate the use of ECN in the outer header of IPsec tunnels. The negotiation mechanism allows tunnel endpoints to agree on whether to use the limited-functionality or full-functionality option for ECN.

The negotiation uses IPsec's Security Association (SA) establishment process to communicate ECN capabilities and preferences. During SA establishment, the tunnel endpoints can indicate:

  • Whether they support ECN at all
  • Whether they support only the limited-functionality option or both options
  • Their preference for which option to use

If both tunnel endpoints support and agree to use ECN, they can establish an SA that permits ECN functionality in the tunnel's outer header. If either endpoint does not support ECN or prefers not to use it for security reasons, the SA will be configured to use the limited-functionality option (with not-ECT in the outer header).

This negotiation mechanism provides flexibility for security administrators to make informed decisions about ECN use based on their security policies and risk assessments. It ensures that ECN is only used when both tunnel endpoints explicitly support and agree to it.

The following subsections describe the specific mechanisms for ECN negotiation in IPsec tunnels.

Last updated on