Subject: draft-behringer-mpls-vpn-auth-00

From: Ron Bonica <[email-masked]>
Date: Tue, 05 Nov 2002 21:23:25 -0500

Michael,

Can you address the following issues:

1) Many VPN sites don't use any PE-CE signaling protocol at all. The CE
points default at the PE. The PE points a few static routes at the CE.

2) Customers may object to being told that they need to use the same MD5
authentication key at every site.

3) Customers who MD5 authenticate BGP peering sessions may want to change
the MD5 key periodically. This isn't too painful if you don't have to change
all of the keys at once. It is impossible if the customer has many hundreds
of sites and you need to change all of the keys at once.

===========================================
Ronald P. Bonica       Ph: 703 886 1681
vBNS Engineering       page: 1 888 268 8021
Ashburn, Va.
===========================================
"We are not on Earth to guard a museum, but
to cultivate a flourishing garden of life."
                -- Angelo Giuseppe Roncalli

---

From: "Michael H. Behringer" <[email-masked]>
Date: Wed, 06 Nov 2002 23:10:17 +0000

Ron,

Thanks a lot for your feedback. Please see inline.

>points default at the PE. The PE points a few static routes at the CE.

True. Our scheme requires a routing protocol between CE and PE.

>authentication key at every site.

True. They might. We need to check with customers whether this would be 
acceptable. Of course this is only required on the PE-CE links.

>of sites and you need to change all of the keys at once.

One way of handling this is key-chains and soft roll-over, as it exists 
today for IS-IS and OSPF for example.

Thanks for your feedback!
Michael

---

From: "Ferit Yegenoglu" <[email-masked]>
Date: Thu, 7 Nov 2002 11:08:52 -0500

Michael,

I am also not convinced on the practicality of using the same key on all CEs
belonging to the same VPN and for PE-PE authentication when exchanging
routes for this VPN and updating these keys seamlessly.

However, I have a more specific question - how do you address the case where
a CE belongs to multiple VPNs? Can you still have the same keys used on all
CE-PE, PE-PE, and PE-CE segments? I am assuming that the PE that this CE
connects to has to use K1 when advertising this CE's routes to VPN1 and K2
when advertising them to VPN2. Does not this reintroduce the possibility of
misconfiguration that your approach was attempting to eliminate? Can you
comment?

Regards,
Ferit

-----Original Message-----
From: Michael H. Behringer [mailto:[email-masked]]
Sent: Wednesday, November 06, 2002 6:10 PM
To: Ron Bonica; [email-masked]
Subject: Re: draft-behringer-mpls-vpn-auth-00

Ron,

---

From: "Jim Guichard" <[email-masked]>
Date: Thu, 7 Nov 2002 11:19:37 -0500

Ferit,

the currently published draft was published in error and is the wrong
version - we will update with the correct version as soon as we are able (we
cannot publish the draft at this time). However, to answer your specific
question. The intention is to create a 'generator' value at the exporting PE
router and then run the key against the 'generator'. This will be
advertised, along with the hash, within the MP-BGP update and the importing
PE router can use its local key against the 'generator' and compare the
result with the hash. If the VPN is extranet then clearly their might be
multiple keys which would imply either a) trying each key against the
'generator' or b) selecting the key based on incoming RT value for the
update.

Jim

> >From: Ferit Yegenoglu [mailto:[email-masked]]
> >Sent: Thursday, November 07, 2002 11:09 AM
> >To: Michael H. Behringer; Ron Bonica; [email-masked]
> >Subject: RE: draft-behringer-mpls-vpn-auth-00
> >
> >
> >
> >Michael,
> >

---

From: Ron Bonica <[email-masked]>
Date: Thu, 07 Nov 2002 12:08:27 -0500

> today for IS-IS and OSPF for example.

How would this work?

              Ron

---

From: "Michael H. Behringer" <[email-masked]>
Date: Thu, 07 Nov 2002 18:16:23 +0000

Ron,

For using routing authentication on IGPs such as ISIS, OSPF, it would be 
impossible to change all keys at the same time. So one defines a key chain, 
which contains the old key, and the new key. The algorithm basically checks 
both keys. Once you have rolled over to the new keys, you remove the old 
ones from the key chain.

Michael

---

From: Ron Bonica <[email-masked]>
Date: Tue, 12 Nov 2002 11:29:36 -0500

Mike,

There are at least two ways that you could do this. One approach, which I
think that you are suggesting, is to put an old key and a new key on the key
chain. Another approach, which I think that Eric Gray is suggesting, is to
have many keys on the key chain, with each key destined for one or more
remote PEs. (Guys, did I get this much right? If not, the rest of this
posting won't make much sense.)

Within the first approach, there are at least two possible implementations:

1) Immediately, upon configuration of the new key, distribute all routes
into the iBGP mesh with both keys advertised
2) Don't advertise the new key into the iBGP mesh until all PE's have been
configured with the new key. When all PE's have been configured with the new
key, visit each PE, refreshing the PE-CE peering. This will cause all routes
to be readvertised into the iBGP mesh with the new key (only).

I am a little confused about how each approach would work if the provider
network used route reflectors. Could somebody fill in the blanks?

                                          Ron

> Sent: Thursday, November 07, 2002 1:16 PM