Subject: [Idr] I-D ACTION:draft-ietf-idr-bgp-identifier-09.txt

From: [email-masked]
Date: Tue, 13 May 2008 10:45:01 -0700 (PDT)

A New Internet-Draft is available from the on-line Internet-Drafts 
directories.
This draft is a work item of the Inter-Domain Routing Working Group of the IETF.

	Title		: AS-wide Unique BGP Identifier for BGP-4
	Author(s)	: E. Chen, J. Yuan
	Filename	: draft-ietf-idr-bgp-identifier-09.txt
	Pages		: 5
	Date		: 2008-5-13
	
To accommodate situations where the current requirements for the BGP
   Identifier are not met, this document relaxes the definition of the
   BGP Identifier to be a 4-octet unsigned, non-zero integer, and
   relaxes the "uniqueness" requirement so that only AS-wide uniqueness
   of the BGP Identifiers is required. These revisions to the base BGP
   specification do not introduce any backward compatibility issue.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-idr-bgp-identifier-09.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
_______________________________________________
Idr mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/idr

---

From: "Ilya Varlashkin" <[email-masked]>
Date: Wed, 14 May 2008 11:29:09 +0200

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of [email-masked]
> Sent: Tuesday, May 13, 2008 7:45 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [Idr] I-D ACTION:draft-ietf-idr-bgp-identifier-09.txt
> 
> A New Internet-Draft is available from the on-line 
> Internet-Drafts directories.

I've looked at the draft and in current state there are potentially
problems with sections 2.3 and 4 as follow:

Consider existing iBGP session within AS-A where identifier of the
remote side is X, and then new session connection comes from AS-B but
also having BGP identifier of X. If AS-B is numerically larger than
AS-A, then according to section 2.3 of the draft iBGP session towards
router with id X should be closed. This is security issue - an attacker
with high AS number could deliberately set router-id to be same as some
other router of a peering network (they may or may not be penalised for
this but perhaps they want to do it anyway), effectively causing
shutdown of iBGP session in remote AS. Nevertheless, section 4 of the
draft says that security issues are not changed by the draft - I believe
they're, and they make protocol weaker than original spec.

If it's necessary to relax BGP ID definition and have it unique only
locally within given AS, then in all collision detections BGP ID should
only be compared when ASN are equal. If two sessions have same BGP ID on
remote end but each with different ASN, then they should be considered
as different routers.

Kind regards,
iLya

---

From: Enke Chen <[email-masked]>
Date: Wed, 14 May 2008 12:52:53 -0700

Hi, Ilya:

Please note that the OPEN message processing (and the session 
establishment) is on a per-session basis. Thus the collision resolution 
of one session (either ibgp or ebgp) would not impact another session.

Regards,   -- Enke