Subject: [rbridge] seeking input on abstract for problem and applicabi lity statement

From: Eric.Gray at marconi.com (Gray, Eric)
Date: Wed, 12 Oct 2005 13:09:17 -0300

Joe,

	The way I interpret Loa's question is "do we expect that
we will have to apply concerns about security similar to those
we have to apply to routing?"  I don't think the question has
to do with any expectation that RBridges _generally_ act like
routers.

	The answer to this question is that we cannot leave the
security issues unanswered.  We can say that we will introduce
no new security issues, but that's not automatic.  We plan to
use IS-IS to propagate reachability information and security 
concerns that apply generally to IS-IS, will apply also to
RBridges.  In addition, we plan to change the way L2 networks
work in a way that allows for larger L2 broadcast domains and
may introduce new security exposures from this as well.

--> -----Original Message-----
--> From: rbridge-bounces at postel.org 
--> [mailto:rbridge-bounces at postel.org]On
--> Behalf Of Joe Touch
--> Sent: Wednesday, October 12, 2005 11:34 AM
--> To: Developing a hybrid router/bridge.
--> Subject: Re: [rbridge] seeking input on abstract for problem and
--> applicability statement
--> 
--> 
--> -----BEGIN PGP SIGNED MESSAGE-----
--> Hash: SHA1
--> 
--> 
--> 
--> Loa Andersson wrote:
--> > 
--> > Joe Touch wrote:
--> > 
--> > <snip>
--> > 
--> > do we have any idea on to what level security enters into the
--> > trill work? not at all, or do the rbridges also in this respect
--> > behave as routers?
--> 
--> IMO, they behave as bridges - except perhaps in participation in the
--> spanning trees with bridges at their edge.
--> 
--> They do NOT behave as routers - they can't. Routers would kill
--> broadcasts, for one. Routers don't exist at L2 anyway - as 
--> far as the L2
--> is concerned, they're just nodes.
--> 
--> RBridge MAC addresses should only ever be known or used by other
--> rbridges, never by other nodes on the L2.
--> 
--> Joe
--> 
--> > /Loa
--> > 
--> > 
--> >>My understanding is that rbridges are not intended to fix 
--> any security
--> >>problems that persist with an equivalent deployment of bridges.
--> >>
--> > 
--> > 
--> -----BEGIN PGP SIGNATURE-----
--> Version: GnuPG v1.2.4 (MingW32)
--> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
--> 
--> iD8DBQFDTSz0E5f5cImnZrsRAuUmAJ9jcqFQjstl/E4Ua9r89LAsI0gmfgCgr4Aq
--> mDfONYAdHIoTZOD8swx2HPk=
--> =eG4G
--> -----END PGP SIGNATURE-----
--> _______________________________________________
--> rbridge mailing list
--> rbridge at postel.org
--> http://www.postel.org/mailman/listinfo/rbridge
-->

---

From: touch at ISI.EDU (Joe Touch)
Date: Wed, 12 Oct 2005 10:07:13 -0700

> to do with any expectation that RBridges _generally_ act like

Agreed; sorry to pick that nit ;-)

> may introduce new security exposures from this as well.

IS-IS acts similarly to the existing spanning tree; we need to address
its stability to attacks vs. that to a spanning tree. So that looks like
a security issue, but not one where the rbridge is intended to be more
secure.

I.e., all security issues I'm thinking of reduce to 'is this as secure
as a bridged L2'.

As to larger domains, that's been out of scope for a while. The point of
the work is increased functionality - not scale. We probably will need
to address the fact that increased functionality may lead to larger
deployments, but these aren't larger than a conventional L2 _could_ support.

Joe