Subject: Re: [mpls] I-D Action:draft-chen-ldp-ttl-02.txt

From: "Adrian Farrel" <[email-masked]>
Date: Sun, 22 Mar 2009 20:45:40 -0000

Hi,

Questions about this draft...

Why do you propose a new Hello Parameters optional TLV rather than a new bit 
in the existing Common Hello Parameters TLV?

Why is this work needed? (May be a fundamental question :-)
Consider A and B adjacent LSRs.
Suppose A requires TTL security (for all LDP packets received from B) and B 
doesn't support it.
If the Hello states this, no session will be set up.
If Hello is not extended, B will not set the TTL correctly and A will reject 
it and no session will be set up.
So I would contend that for the process to work, the required security 
behvaior must be configured at both nodes, and no protocol exchange is 
needed.
Did I misunderstand something?

Thanks,
Adrian

----- Original Message ----- 
From: <[email-masked]>
To: <[email-masked]>
Sent: Monday, March 09, 2009 11:45 PM
Subject: I-D Action:draft-chen-ldp-ttl-02.txt

>A New Internet-Draft is available from the on-line Internet-Drafts 
>directories.
>
> Title           : TTL-Based Security Option for the LDP Hello Message
> Author(s)       : E. Chen, A. Tian
> Filename        : draft-chen-ldp-ttl-02.txt
> Pages           : 4
> Date            : 2009-03-09
>
> To facilitate the deployment of the TTL-based security mechanism for
> LDP, in this document we propose a new optional parameter for the LDP
> Hello Message that can be used by a LSR to indicate its support of
> the TTL-based mechanism.
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-chen-ldp-ttl-02.txt

---

From: "Albert Tian (altian)" <[email-masked]>
Date: Sun, 22 Mar 2009 17:44:02 -0700

Hi Adrian,

Thanks for your comments, please see my replies below. 

Albert

-----Original Message-----
From: Adrian Farrel [mailto:[email-masked]] 
Sent: Sunday, March 22, 2009 1:46 PM
To: Enke Chen (enkechen); Albert Tian (altian)
Cc: [email-masked]
Subject: Re: I-D Action:draft-chen-ldp-ttl-02.txt 

Hi,

Why do you propose a new Hello Parameters optional TLV rather than a new
bit in the existing Common Hello Parameters TLV?

<tian> I think we are open for suggestions on how to carry out this
particular option in the hello. A separate tlv would help isolate the
change in implementation, but I do see using a new bit in common hello
would result in a more compact protocol. </tian>

Why is this work needed? (May be a fundamental question :-) Consider A
and B adjacent LSRs.
Suppose A requires TTL security (for all LDP packets received from B)
and B doesn't support it.
If the Hello states this, no session will be set up.
If Hello is not extended, B will not set the TTL correctly and A will
reject it and no session will be set up.
So I would contend that for the process to work, the required security
behvaior must be configured at both nodes, and no protocol exchange is
needed.
Did I misunderstand something?

<tian> The main motivation for the work is to reduce configuration. In
general LDP is a perfect place to apply GTSM, and the existence of the
hello protocol give LDP the chance to automatically negotiate this
parameter. New implementations can always include this tlv (or this bit)
to signal its willingness to support GTSM, and if support exist on both
sides, GTSM can be turned on without requiring any configuration.
</tian>

Thanks,
Adrian