Subject: Re: [Pce] I-D Action: draft-wu-pce-discovery-pceps-support-01.txt

From: Qin Wu <[email-masked]>
Date: Wed, 27 Aug 2014 10:09:31 +0000

Hi,
Here is the update to draft-wu-pce-discovery-pceps-support-01. The most changes are editorial changes.
The diff is:
http://www.ietf.org/rfcdiff?url2=draft-wu-pce-discovery-pceps-support-01

This draft provides a mechanism for PCC to discover PCE with TLS support.
In addition, the draft also support discovery of PCE server with MD support, TCP-AO support respectively.
Authors feel it will be a good to have this draft separately rather than simply merging into draft-ietf-pce-pceps.
Any opinions or objection?

Regards!
-Qin
-----邮件原件-----
发件人: I-D-Announce [mailto:[email-masked]] 代表 [email-masked]
发送时间: 2014年8月14日 13:10
收件人: [email-masked]
主题: I-D Action: draft-wu-pce-discovery-pceps-support-01.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories.

        Title           : IGP extension for PCEP security capability support in the PCE discovery
        Authors         : Diego R. Lopez
                          Qin Wu
                          Dhruv Dhody
                          Daniel King
	Filename        : draft-wu-pce-discovery-pceps-support-01.txt
	Pages           : 6
	Date            : 2014-08-13

Abstract:
   When a Path Computation Element (PCE) is a Label Switching Router
   (LSR) participating in the Interior Gateway Protocol (IGP), or even a
   server participating in IGP, its presence and path computation
   capabilities can be advertised using IGP flooding.  The IGP
   extensions for PCE discovery (RFC 5088 and RFC 5089) define a method
   to advertise path computation capabilities using IGP flooding for
   OSPF and IS-IS respectively.  However these specifications lack a
   method to advertise PCEP security (e.g., Transport Layer
   Security(TLS)) support capability.

   This document proposes new capability flag bit for PCE-CAP-FLAGS sub-
   TLV that can be announced as attribute in the IGP advertisement to
   distribute PCEP security support information.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-wu-pce-discovery-pceps-support/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-wu-pce-discovery-pceps-support-01

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-wu-pce-discovery-pceps-support-01

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: Uma Chunduri <[email-masked]>
Date: Fri, 29 Aug 2014 12:09:32 +0000

>Any opinions or objection?

IMO, keeping separate is good as scope is different in both.

I and Diego had chat offline on this but how this discovery is beneficial as you still operator have to configure AUTH/Security credentials on the nodes.
I am asking this in particular as scope is MD, AO and TLS.

Also I see PCE has to be part of the IGP here, whereas I see draft-ietf-pce-pceps doesn't mandate this (does it??) 

More later.
--
Uma C.

-----Original Message-----
From: Pce [mailto:[email-masked]] On Behalf Of Qin Wu
Sent: Wednesday, August 27, 2014 3:10 AM
To: [email-masked]
Subject: Re: [Pce] I-D Action: draft-wu-pce-discovery-pceps-support-01.txt

Hi,

Regards!
-Qin
-----邮件原件-----
发件人: I-D-Announce [mailto:[email-masked]] 代表 [email-masked]
发送时间: 2014年8月14日 13:10
收件人: [email-masked]
主题: I-D Action: draft-wu-pce-discovery-pceps-support-01.txt

Abstract:

Pce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pce

---

From: Qin Wu <[email-masked]>
Date: Fri, 29 Aug 2014 12:59:22 +0000

Hi, Uma:
Thanks for your comments, see my rely inline below.
-----邮件原件-----
发件人: Uma Chunduri [mailto:[email-masked]] 
发送时间: 2014年8月29日 20:10
收件人: Qin Wu; [email-masked]
主题: RE: I-D Action: draft-wu-pce-discovery-pceps-support-01.txt

>I and Diego had chat offline on this but how this discovery is beneficial as you still operator have to configure AUTH/Security credentials on the nodes.

[Qin]: I think the importance of this discovery is in the deployments which allow multiple choices for security credentials.
without such discovery, it leads to unexpected failure or additional message exchange is needed to indicate error to PCC using PCErr message.

>Also I see PCE has to be part of the IGP here, whereas I see draft-ietf-pce-pceps doesn't mandate this (does it??) 

[Qin]: That is correct, draft-ietf-pce-pceps doesn't need to couple with IGP discovery, draft-ietf-pce-pceps may leverage other discovery mechanism, e.g.,
DNS based PCE discovery mechanism.

More later.
--
Uma C.

-----Original Message-----
From: Pce [mailto:[email-masked]] On Behalf Of Qin Wu
Sent: Wednesday, August 27, 2014 3:10 AM
To: [email-masked]
Subject: Re: [Pce] I-D Action: draft-wu-pce-discovery-pceps-support-01.txt

Hi,

Regards!
-Qin
-----邮件原件-----
发件人: I-D-Announce [mailto:[email-masked]] 代表 [email-masked]
发送时间: 2014年8月14日 13:10
收件人: [email-masked]
主题: I-D Action: draft-wu-pce-discovery-pceps-support-01.txt

Abstract:

---

From: Uma Chunduri <[email-masked]>
Date: Fri, 29 Aug 2014 14:48:07 +0000

Hi Qin,
In-line 

===

	>>I and Diego had chat offline on this but how this discovery is beneficial as you still operator
              >>have to configure AUTH/Security credentials on the nodes.

     >[Qin]: I think the importance of this discovery is in the deployments which allow multiple
     > choices for security credentials.   without such discovery, it leads to unexpected failure or 
     >additional message exchange is needed to indicate error to PCC using PCErr message.

I can't really imagine nodes will have multiple security credential provisioned by operator across all PCCs around for different protocols;  for e.g., TLS itself "can" be heavy in terms of auth-config.
However, I see one good possibility of  no credentials with both AO and TLS and then  the mechanisms described in draft-wu-pce-discovery-pceps-support-01.txt can be useful.
We have one unfinished work in KARP http://tools.ietf.org/html/draft-chunduri-karp-kmp-router-fingerprints-05 where we precisely address this with finger prints based authentication for
TCP-AO/KMP and these procedures can be extendable and applicable to TLS easily for PCEP (as MD is theoretically obsolete!), discussed offline few months ago.
Auto discovery mechanisms eventually will be really helpful only when we have these mechanisms in place  perhaps.

--
Uma C.

---

From: Qin Wu <[email-masked]>
Date: Sat, 30 Aug 2014 00:56:17 +0000

-----邮件原件-----
发件人: Uma Chunduri [mailto:[email-masked]] 
发送时间: 2014年8月29日 22:48
收件人: Qin Wu; [email-masked]
主题: RE: I-D Action: draft-wu-pce-discovery-pceps-support-01.txt

Hi Qin,
In-line 

===

[Qin]: what I am saying is in some cases PCE server may support multi security mechanisms, e.g., MD,AO, TLS, and PCC want to discover PCE with each security mechanism or combination of any two security mechanisms.

[Qin]: Exactly.

We have one unfinished work in KARP http://tools.ietf.org/html/draft-chunduri-karp-kmp-router-fingerprints-05 where we precisely address this with finger prints based authentication for TCP-AO/KMP and these procedures can be extendable and applicable to TLS easily for PCEP (as MD is theoretically obsolete!), discussed offline few months ago.
Auto discovery mechanisms eventually will be really helpful only when we have these mechanisms in place perhaps.

[Qin]: Interesting. Thanks for valuable information. 

--
Uma C.