Subject: Regarding BGP Router ID

From: PamSri <[email-masked]>
Date: Fri, 28 Feb 2003 10:59:56 -0800 (PST)

Hi ,
   The latest base draft of BGP talks about BGP
identifier as follows:

"If the BGP Identifier field of the OPEN message is
syntactically incorrect, then the Error Subcode is set
to Bad BGP Identifier. Syn-tactic correctness means
that the BGP Identifier field represents a valid IP
host address."

Does this mean that BGP Identifier has be a routable
address ?

sri

__________________________________________________
Do you Yahoo!?
Yahoo! Tax Center - forms, calculators, tips, more
http://taxes.yahoo.com/

---

From: PamSri <[email-masked]>
Date: Fri, 28 Feb 2003 11:03:38 -0800 (PST)

Actually by routable i mean reachable address.

sri

---

From: Jeffrey Haas <[email-masked]>
Date: Fri, 28 Feb 2003 14:06:44 -0500

> Actually by routable i mean reachable address.

Best current practice would say "yes" with this typically being
the host's "loopback" address.

However, as noted in the archives and in the v6-only router-id
ID for BGP, its just a number.   However, its one that may cause
interoperability problems if one party treats it as a number and
the other insists on syntactic correctness.

-- 
Jeff Haas 
NextHop Technologies

---

From: PamSri <[email-masked]>
Date: Fri, 28 Feb 2003 11:20:36 -0800 (PST)

Can you give me a reason why the configured IP of the
Router ID needs to be reachable ? So for example if i
were to configure x.x.x.x for my router ID (which is a
loopback address) why does someone need to be able to
ping it in order for my peering session to be UP ?

sri

---

From: Jeffrey Haas <[email-masked]>
Date: Fri, 28 Feb 2003 14:30:20 -0500

> ping it in order for my peering session to be UP ?

To attempt to summarize way too much list archives, it *doesn't*.
The BGP Identifier is just a number.

However, for purposes of operations, it is very handy to have the
number in your internal network for troubleshooting.  Outside of
your network (in the aggregator field), its handy to have it to figure
out what box may have done a bit of aggregation.  But even then,
all you really need is a number along with the AS to pass that back
to the aggregating network for troubleshooting purposes.

Its also notable that loopback addresses are often reachable within
a given AS, but access is administratively denied outside or
perhaps even denied from anything other than the management network.

-- 
Jeff Haas 
NextHop Technologies

---

From: Enke Chen <[email-masked]>
Date: Fri, 28 Feb 2003 11:38:50 -0800

Sri:
Please read the document <draft-ietf-idr-bgp-identifier-01.txt> that
clarifies and relaxes the requirements for BGP Identifier.

-- Enke

> Message-ID: <[email-masked]>
> Received: from [47.234.0.51] by web14108.mail.yahoo.com via HTTP; Fri, 28 Feb 2003 10:59:56 PST
> Date: Fri, 28 Feb 2003 10:59:56 -0800 (PST)
> From: PamSri <[email-masked]>
> Subject: Regarding BGP Router ID
> To: [email-masked]
> 
> Hi ,

---

From: PamSri <[email-masked]>
Date: Fri, 28 Feb 2003 11:41:43 -0800 (PST)

Not sure if you have covered all the scenarios but
mindful of the fact that this entity is something that
gets shared. It can cause potential security issues 
in VPN scenarios. Maybe your observation over
simplifies this case.

sri

---

From: Jeffrey Haas <[email-masked]>
Date: Fri, 28 Feb 2003 14:43:28 -0500

On Fri, Feb 28, 2003 at 11:41:43AM -0800, PamSri wrote:
> in VPN scenarios.

Could you clarify?

-- 
Jeff Haas 
NextHop Technologies

---

From: PamSri <[email-masked]>
Date: Fri, 28 Feb 2003 16:05:39 -0800 (PST)

The nexthop for the VPNIPv4 prefixes will be exposed in terms of Router ID. Following is the example:
                EBGP                               IBGP
x <------------------------------> y <--------------------------------------> z
y is attached to VRF red & green. y has the loop back address of Y and z Z respectively.
The IBGP peering is between Y & Z. For the VRFs y is attached to, all the prefixes get advertised to Z with nexthop of Y. Now the point that i am raising is in the OPEN messages to x and Z, y sends Y which turns out to be the next hop for the VPNIPv4 prefixes. Hence i said that there is a potential for security issues in the case of VPNs where we want the prefixes as well as the nexthops protected. 
sri

Could you clarify?

-- 
Jeff Haas 
NextHop Technologies

---------------------------------
Do you Yahoo!?
Yahoo! Tax Center - forms, calculators, tips, and more