Subject: Need your opinion of this.

From: "Turk, Doughan A." <[email-masked]>
Date: Fri, 26 Jul 2002 16:09:19 -0400

Folks, 
 
I would like to get some discussion started on a draft I wrote. It was
suggested to me to have the draft worked on under this group. I appreciate
any constructive comments and pointers. In summary, the draft could be
classified as an operational one. It is an enhancement of a technique that
already exists but relying more on BGP as a protocol to help in network
security issues.
 
A copy of the draft could be found at
http://www.ietf.org/internet-drafts/draft-turk-ertb-00.txt
<http://www.ietf.org/internet-drafts/draft-turk-ertb-00.txt> 
 
Regards
Doughan Turk
 
  _____  

 <http://www.bell.ca/> Bell Canada Logo

Doughan Turk, M.Eng., CCIE#7274
Bell Canada, IP Engineering
Flr 3, 100 Wynford Dr. 
Toronto M3C 1K4

Voice: (416) 353-0368
Fax: (416) 445-9893
Pager: (416) 685-0590
 <http://www.bell.ca/> Bell Canada

 Cisco Certified Internetwork Expert
<http://www3.sympatico.ca/doughan/ccie_large.gif> 

         "To Engineer and Integrate world class
                              IP Services and Technologies for BCE"

---

From: Jeffrey Haas <[email-masked]>
Date: Tue, 30 Jul 2002 11:27:01 -0400

On Fri, Jul 26, 2002 at 04:09:19PM -0400, Turk, Doughan A. wrote:
> suggested to me to have the draft worked on under this group.

Although this is BGP, this seems more of something along the
lines of operations.  But I'm not going to debate that strongly.

> I appreciate

Did I see this as a presentation at a NANOG, or was that a UU-Net/Worldcom
presentation?  This sounds very familiar.

In any case, the technique seems to be pretty solid.  My biggest
observations about the draft:

1. Your sink addresses are always mentioned as RFC 1918.  Sure, you
can do this, but why not some prefix within your own network?
2. A little more talk about filtering the internal control communities
at the edges may be warranted in the security considerations section.

-- 
Jeff Haas 
NextHop Technologies

---

From: [email-masked]
Date: Tue, 30 Jul 2002 10:19:53 -0700

Hi Doughan,

Going through the draft, a couple of thoughts came up:

1) Why use BGP communities?  It seems like that just exposes the network
to the possibility of abuse of those communities.  The NOC or Security
group can just log into the router in question, and apply the NH statement.

2) Why use RFC 1918?  One could also use public space.

3) This probably belongs in ops, not routing, but that is an admin detail.

Andrew

On Fri, Jul 26, 2002 at 04:09:19PM -0400, Turk, Doughan A. wrote:
> Delivered-To: [email-masked]
> Delivered-To: [email-masked]
> Delivered-To: [email-masked]
> X-Server-Uuid: b85f21a3-cfd1-11d3-8401-00104bf46ab7
> From: "Turk, Doughan A." <[email-masked]>
> To: [email-masked]
> Cc: "Turk, Doughan A." <[email-masked]>
> Subject: Need your opinion of this.
> Date: Fri, 26 Jul 2002 16:09:19 -0400
> X-Mailer: Internet Mail Service (5.5.2653.19)
> X-WSS-ID: 115F73FE134713-01-01
> Precedence: bulk
> X-OriginalArrivalTime: 26 Jul 2002 20:10:58.0281 (UTC) FILETIME=[8E32D590:01C234E0]
> 
> Folks, 
>

---

From: Jeffrey Haas <[email-masked]>
Date: Tue, 30 Jul 2002 16:37:12 -0400

> group can just log into the router in question, and apply the NH statement.

The trick is to distribute it across your network.
Dropping something like this as a host route into your IGP could do
the trick - you could even tag the routes to let you know they're
"special".
However, what if you need to cross igp domains?

-- 
Jeff Haas 
NextHop Technologies