Subject: [Idr] clarification about RFC5575

From: "Thomas Mangin" <[email-masked]>
Date: Fri, 29 May 2015 21:01:03 +0100

Hello,

When comparing Flow NLRI (not for firewall ordering but to determine if a rule need to be sent or not), should all the components of the NLRI be compared or only the source/destination pair. i.e.: should a speaker send multiple rules for the same src/dst pair (or single destination or source).

Thank you very much,

Thomas

http://exa.net.uk/about/contact-us

---

From: Robert Raszuk <[email-masked]>
Date: Fri, 29 May 2015 22:07:42 +0200

Hi Thomas,

All  elements of the NLRI define it not only two selected and option ones
like src or dst. In fact NLRI may not contain those at all to still be a
valid one.

Quote:

The Flow specification NLRI-type consists of several optional
subcomponents. A specific packet is considered to match the flow
specification when it matches the intersection (AND) of all the
components present in the specification.

Cheers,

R.

On Fri, May 29, 2015 at 10:01 PM, Thomas Mangin <
[email-masked]> wrote:

> Hello,
>
> When comparing Flow NLRI (not for firewall ordering but to determine if a
> rule need to be sent or not), should all the components of the NLRI be
> compared or only the source/destination pair. i.e.: should a speaker send
> multiple rules for the same src/dst pair (or single destination or source).
>
> Thank you very much,
>
> Thomas
>
> _______________________________________________
> Idr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/idr
>
>

---

From: "Thomas Mangin" <[email-masked]>
Date: Fri, 29 May 2015 21:22:54 +0100

Hello Robert,

Thank you for this answer. This was also my understanding but this text 
applies to how the NLRI should be interpreted when matching traffic, not 
how it should be interpreted when sent as a BGP UPDATE.
I have been told that some implementations behaved differently (i.e.: 
would consider two Flows with similar SRC/DEST but different other 
components such as protocol as similar) and as I can not verify, I 
thought prudent to seek clarification as ExaBGP’s implementation is 
not behaving correctly and I need fixing ( I expected it to behave this 
way tho ).

Sincerely,

Thomas

---

From: Robert Raszuk <[email-masked]>
Date: Fri, 29 May 2015 22:55:25 +0200

> I have been told that some implementations behaved differently
> (i.e.: would consider two Flows with similar SRC/DEST but different
> other components such as protocol as similar

If those implementation would suppress such NLRIs actually important
filtering can be suppressed from being propagated resulting in lack of
functionality.

Moreover what such implementation do where NLRI does not contain SRC/DST
subtypes ?

The RFC also very clearly states the propagation rules in section 4:

However, for the purposes of BGP route  propagation, this prefix

should still be transmitted *since BGP route** distribution is
independent on NLRI semantics.*

Thx,
Robert.

On Fri, May 29, 2015 at 10:22 PM, Thomas Mangin <
[email-masked]> wrote:

> components such as protocol as similar) and as I can not verify, I thought
> prudent to seek clarification as ExaBGP’s implementation is not behaving
> correctly and I need fixing ( I expected it to behave this way tho ).
>
> Sincerely,
>
> Thomas
>