Subject: Fwd: Question regarding InterAS and Carriers' Carrier VPNs

From: Jim T <[email-masked]>
Date: Fri, 16 Jan 2004 15:11:00 -0800 (PST)

I did a test regarding the point mentioned below on a Juniper Networks' router. I found that it accepted a labeled packet from a device to which it had not distributed the label. The ASBR forwarded the packet to the PE router in its AS (or to the neighboring ASBR) after label swapping. The result was that a packet (echo request) from an unintended source reached the destination in a VRF though the response was dropped by the PE router.
 
The draft seems to state that this should not be done. Is this just a recommendation that is left to the implementation or is it something that ought to be supported by a router implementing section 9 and 10 of the draft? Comments appreciated.
 
Thanks,
Jim

Jim T <[email-masked]> wrote:
Date: Fri, 9 Jan 2004 11:33:11 -0800 (PST)
From: Jim T 
Subject: Question regarding InterAS and Carriers' Carrier VPNs
To: [email-masked]

In section 10(b) of rfc2547bis, it is stated that when the ASBR receives a labeled packet from the adjacent ASBR, it has to ensure that the top label in the labeled packet was one that it distributed to the adjacent ASBR. I am not clear how this is enforced. Would the ASBR have a per-interface label-forwarding entry or would it have a label-forwarding entry per adjacent ASBR? If so, if the ASBR distributes a particular VPN-IPv4 route to many other ASBRs, it would have to create many label-forwarding entries, correct? Is this how vendors do it?
 
The same question applies to section 9 too. I don't know if this is an implementation issue but it would help me if someone can shed some light upon it.
 
Thanks,
Jim

---------------------------------
Do you Yahoo!?
Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes

---------------------------------
Do you Yahoo!?
Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes

---

From: "S.Matsushima" <[email-masked]>
Date: Sat, 17 Jan 2004 12:46:43 +0900

At 15:11 04/01/16 -0800, Jim T wrote:
>I did a test regarding the point mentioned below on a Juniper Networks' 
>router. I found that it accepted a labeled packet from a device to which 
>it had not distributed the label. The ASBR forwarded the packet to the PE 
>router in its AS (or to the neighboring ASBR) after label swapping. The 
>result was that a packet (echo request) from an unintended source reached 
>the destination in a VRF though the response was dropped by the PE router.
>
>The draft seems to state that this should not be done. Is this just a 
>recommendation that is left to the implementation or is it something that 
>ought to be supported by a router implementing section 9 and 10 of the 
>draft? Comments appreciated.

Carriers' Carrier SP must have that feature (I call it "label spoofing 
avoid" personally.)
There are some vendors which already have it.

--
Satoru Matsushima

---

From: Pedro Roque Marques <[email-masked]>
Date: Mon, 19 Jan 2004 22:57:43 -0800 (PST)

Jim T writes:

> The draft seems to state
> that this should not be done. Is this just a recommendation that is
> left to the implementation or is it something that ought to be
> supported by a router implementing section 9 and 10 of the draft?
> Comments appreciated.
 
In the context of carrier-of-carriers the implementation you refer to
can be configured such that labels are specific to a particular
carrier VPN... that is the behaviour you will get w/ the recomended CoC
config, AFAIK.

But that is probably a discussion for another mailing list.

  Pedro.