Subject: RE: [Isis-wg] areaTransmitPassword/domainTransmitPassword

From: "Ramalingam, Swaminathan (Swaminathan)" <[email-masked]>
Date: Tue, 27 Sep 2005 18:59:11 +0530

Saravanak,

I guess, no administrator will configure password on just one peer. It
doesn't serve any purpose. Assuming on error scenario like this
(misconfiguration), for a source and destination, route will be available on
one path and the reverse path, there will not be path available. 

Though the routing protocol adjacencies' are perfect on all links including
misconfigured link, few routes are still unreachable. This sounds little
weird to me.

Any thoughts?

Thanks,
Swami

> -----Original Message-----
> From: saravanak 70193 [mailto:[email-masked]]
> Sent: Tuesday, September 27, 2005 6:30 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: [Isis-wg] areaTransmitPassword/domainTransmitPassword
> 
> 
> 
> The simple answer to your question is that the system should 
> accept and process the LSPs/CSNPs with passwords.
> 
> The security mechanism in ISIS (if used) ensures that only 
> the information from trusted sources are  processed. An 
> administrator setting up a network will configure all the 
> ISIS systems with the same authentication information, so 
> that they can accept and process only the LSPs from the 
> routers within the trusted group. A malicious system may try 
> to inject some wrong information into the network (flapping 
> links for e.g) but it wont be processed as it doesnt pass the 
> authentication checks. 
> 
> If a system is not configured with any password then it means 
> that its administrator is not concerned about the sources 
> from which the routing information is received (perhaps his 
> part of the network is in secure premisis, so he doesnt need 
> to use area authentication and can opt for domain 
> authentication in the backbone) and it is free to process all 
> the received LSPs.
> 
> Hope this explained your question, if you have any further 
> concerns about the behaviour plz let me know.
> 
> - Saravana
> 
> ----- Original Message -----
> From: [email-masked]
> Date: Tuesday, September 27, 2005 8:16 pm
> 
> > Hi-
> > 
> > If a system is configured with no password, and L1/L2 LSP/CSNPs are 
> > receivedwith some passwords, what should be the behaviour of 
> > processing those
> > LSPs/CSNPs. 
> > 
> > I believe it should be dropped as the system is configured with no 
> > passwordand receiving LSPs/CSNPs with passwords. Please comment on 
> > this.
> > But in the ISO 10589 & RFC 1195, there is no explicit mentioning of 
> > this. It
> > might mislead some implementators to accept L1/L2 LSP/CSNPs in this 
> > case.
> > 
> > 
> > Thanks,
> > Swami
> > 
> 
> 

_______________________________________________
Isis-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isis-wg