Subject: [mpls] seamless MPLS

From: Yaakov Stein <[email-masked]>
Date: Tue, 29 Mar 2011 15:44:24 +0000

Before draft-leymann-mpls-seamless-mpls-03 is moved to become a WG draft,
I would like to clarify  the security implications.

The security section of this draft starts very well :

   In a typical MPLS deployment the use of MPLS is limited to relatively
   small network consisting of core and edge nodes.  Those nodes are
   under full control of the services provider and placed at locations
   where only authorized personal has access (this also includes
   physical access to the nodes).  With the extensions of MPLS towards
   access and aggregation nodes not all nodes will be "locked away" in
   secure locations.  Small access nodes like DSLAMs will be located in
   street cabinets, potentially offering access to the "interested
   researcher".

I couldn't have stated this any better myself.
However it then goes on to say :

                 Nevertheless the unauthorized access to such in device
   SHOULD NOT impose any security risks to the MPLS infrastructure
   itself.

I would love to hear the reasoning behind this statement.

Y(J)S

---

From: "Mallette, Edwin" <[email-masked]>
Date: Tue, 29 Mar 2011 11:53:17 -0400

This made me laugh, but I'm going to go out on a limb here and say the type of access meant was physical access.   For instance, if I take out my monster truck and physically access said DSLAM by running over the street cabinet that wouldn't have any real risk to the MPLS infrastructure – just to the DSLAM.  But a slightly modified wording might help.

Ed

From: Yaakov Stein <[email-masked]<mailto:[email-masked]>>
Date: Tue, 29 Mar 2011 11:44:24 -0400
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [mpls] seamless MPLS

Y(J)S

________________________________
CONFIDENTIALITY NOTICE: This e-mail may contain information that is privileged, confidential or otherwise protected from disclosure. If you are not the intended recipient of this e-mail, please notify the sender immediately by return e-mail, purge it and do not disseminate or copy it.

---

From: Yaakov Stein <[email-masked]>
Date: Tue, 29 Mar 2011 16:09:22 +0000

That is not quite the kind of attack I was worried about.

Someone able to inject packets into an MPLS network
can wreak more havoc than a monster truck.

Y(J)S

From: Mallette, Edwin [mailto:[email-masked]]
Sent: Tuesday, March 29, 2011 18:53
To: Yaakov Stein; [email-masked]
Subject: Re: [mpls] seamless MPLS

This made me laugh, but I'm going to go out on a limb here and say the type of access meant was physical access.   For instance, if I take out my monster truck and physically access said DSLAM by running over the street cabinet that wouldn't have any real risk to the MPLS infrastructure - just to the DSLAM.  But a slightly modified wording might help.

Ed

Y(J)S

---

From: Christopher LILJENSTOLPE <[email-masked]>
Date: Wed, 30 Mar 2011 07:45:00 +1100

Greetings,

Let me second this set of concerns.  In an SP network, I can elect not to extend my IGP into uncontrolled spaces, and, instead use control plane protocols that I can apply policy to (BGP comes to mind).  The document does talk about hierarchy, and using BGP to distribute labels (anyone care to think about the number of non-aggregateable labels in a large network that BGP would have to distribute, btw?).  However, there is no mention of the security implications of defining the correct (or incorrect) aggregation/protocol boundary.  

In the not too distant future, some lazy operator decides that statics are too hard, and extends the IGP down to the access nodes (which are not physically controlled - may even be on customer prem) - Customer does some "research" and injects routes into said IGP after circumventing default passwords - sit back and watch the fun and fireworks.   Anyone who says that the service provider won't be lazy and/or won't deploy with default or well-known passwords - I have MANY cases to prove otherwise....

If we think this work is valid, then we REALLY need to cover this in detail in the architecture and security sections.  I am not, however, indicating that I do think it is a good idea....

Chris

On 30Mar2011, at 03.09, Yaakov Stein wrote:

> _______________________________________________
> mpls mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mpls

---
李柯睿
Check my PGP key here:
https://www.asgaard.org/~cdl/cdl.asc