Subject: RE: [Idr] ORF

From: "Rajesh Potti" <[email-masked]>
Date: Thu, 27 Jan 2005 13:04:58 -0500

Hi Jefrrey,

 My comments inline.

-----Original Message-----
From: Jeffrey Haas [mailto:[email-masked] <mailto:[email-masked]> ] 
Sent: Thursday, January 27, 2005 11:45 AM
To: Potti, Rajesh [BL60:SF21:EXCH]
Cc: [email-masked]
Subject: Re: [Idr] ORF

Rajesh,

>From the draft:
:   The remote peer should consider only those routes whose Communities
:   attribute has at least one Community in common with the Communities
:   list specified in the ORF.

Thus, if the route has no communities, it can not have any communities in
common (at least one) with the ORF.

Put a different way, this is an set intersection operation.  If the
resulting set of the route's communities intersected with the community orf
is the empty set, it doesn't match.

If the intersection is not empty, it is either denied or permitted,
according to the Match component. If the resulting set is empty, is the
route filtered. If ORF capability for community ORF was not negotiated, the
route would not have been filtered. If the route is
Filtered on the intersection being empty, would it try to look at other ORFs
such as prefix list ORF or ASPATH ORF, which were negotiated. I mean, it
does not match any community ORF entry, but it matches a prefix-list ORF
entry from the neighbor.

Rajesh

On Mon, Jan 24, 2005 at 05:27:07PM -0500, Rajesh Potti wrote:
> 
> The draft "cooperative Route Filtering Capability for BGP-4"
> 
> (draft-ietf-idr-route-filter-11.txt) does not specify the action - 
> PERMIT or DENY, if the to be
> Advertised route  Does not have a community, or if the route has a
community
> which 
> does not match any Of the community ORF entries received. The prefix-list
> ORF filter draft 
> specifies a wildcard Match, which is not the case with the community orf.

> Rajesh

> _______________________________________________
> Idr mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/idr
<https://www1.ietf.org/mailman/listinfo/idr> 

-- 
Jeff Haas 
NextHop Technologies
_______________________________________________
Idr mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/idr

---

From: Jeffrey Haas <[email-masked]>
Date: Thu, 27 Jan 2005 13:16:04 -0500

Rajesh,

On Thu, Jan 27, 2005 at 01:04:58PM -0500, Rajesh Potti wrote:
> route filtered.

And therefore an implicit deny.

> If ORF capability for community ORF was not negotiated, the
> route would not have been filtered.

And therefore an implicit permit.

> If the route is
> such as prefix list ORF or ASPATH ORF, which were negotiated.

:    If a BGP speaker maintains multiple ORFs of different ORF-Types for a
:    particular peer, then the decision by the speaker to advertise a
:    route to the peer is determined by passing the route through each
:    such ORF, and and-ing the results (and-ing of PERMIT and DENY results
:    in DENY).

-- 
Jeff Haas 
NextHop Technologies

---

From: Rajesh Potti <[email-masked]>
Date: Thu, 27 Jan 2005 13:50:28 -0500

>And therefore an implicit deny.

 With community ORF,  if i need to deny just one community, say 1:1, and 
accept everything else, including those routes with no communities, is 
it possible? A wildcard is not specified in the  route-filter draft.

Rajesh

-- 
Rajesh Potti.

---

From: Jeffrey Haas <[email-masked]>
Date: Thu, 27 Jan 2005 14:08:22 -0500

Rajesh,

> it possible? A wildcard is not specified in the  route-filter draft.

Once upon a draft (specifically -07 and before), the mechanism was
"this set of communities" with a scope of "normal" or "exact".

The type of policy you desire (forbid this, allow everything else) is no
longer possible.

-- 
Jeff Haas 
NextHop Technologies