Subject: Re: [pim] draft-wijnands-pim-proxy

From: "Spessard, Kirk" <[email-masked]>
Date: Mon, 11 Oct 2004 09:05:11 -0600

Due to IPVPN customer requirements, Level 3 is actively pursuing an MPLS
BGP free core by end of 2005.  (Note: Some of our large customers
perceive BGP and mBGP on our MPLS core as a security concern.)  For this
reason, Level 3 is very interested in this draft.
 
Kirk
 
> On Tue, 31 Aug 2004, Mike McBride wrote:
> > In San Diego, Ice presented draft-wijnands-pim-proxy-00 and
requested that
> > the PIM WG adopt it as a working group document. At the time, we
felt that
> > we needed to modify our WG charter before considering such
documents. Upon
> > further review we will proceed and let your voice (hands) be heard.
Please
> > review the following document and provide opinions on whether we
should
> > adopt it:
> > 
> > http://www.ietf.org/internet-drafts/draft-wijnands-pim-proxy-00.txt
> 
> Because there is IPR on it, my default answer would be "no, unless 
> proven otherwise".
> 
> In this case the proof would probably consist one or more of the
> following:
> 
> 1. multiple other vendors indicating that they'd intend to implement 
> the the option, and would desire it to be put on Standards Track.
> 
> 2. there being strong usage case for it.  I don't see it.  BGP-free
> cores or L3VPN's were given as examples, but that doesn't give any
> hint why anyone would like to do a BGP-free core in the first place.  
> If they want to do it, that's fine, but that doesn't necessarily mean
> we'll have to support it.  And the L3VPN case being still open was
> already mentioned.
> 
> -- 
> Pekka Savola                 "You each name yourselves king, yet the
> Netcore Oy                    kingdom bleeds."
> Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

_______________________________________________
pim mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pim

---

From: Pekka Savola <[email-masked]>
Date: Tue, 12 Oct 2004 08:36:15 +0300 (EEST)

> reason, Level 3 is very interested in this draft.

I'd be very interested if you could elaborate on these customers' 
perceived "BGP and MBGP in MPLS core .. security concerns".

Seems rather like that there needs to happen either protocol
development, different kind of deployment, or customer education.

---

From: Robert Raszuk <[email-masked]>
Date: Tue, 12 Oct 2004 01:55:03 -0700

Hi Pekka,

Putting my own personal opinion aside you have to realize that majority 
of 2547/MPLS customers today are those who migrated from L2 world 
essentially ATM & FR PVCs. Some of them have migrated from dedicated 
leased lines as well. Those were for number of years preferred methods 
of choice for WAN connectivity.

Now no matter how much education you do, how many reports you show 
indicating MPLS security to be the same as of frame relay circuits you 
can't beat the fact that once you have full IP routing table in the core 
DDoS can target your P/PE routers. On the other hand I am yet to see 
DDoS attack successfully targeting and bringing down a frame relay or 
ATM switch. DDoS attack is just not the only example. Today AFAIK 
between all L3VPN vendors once you get even level1 access to the PE you 
can telnet/ping/traceroute/ssh at will to any private VPN network. From 
frame relay or ATM switch that would not be that easy :).

While I know that there could be multiple ways to protect more core/edge 
boxes, react to attacks much faster I suspect that for the number of 
years to come providers who will claim IP route free core will gain more 
trust in the VPN services among their customers then those who don't.

Cheers,
R.

PS. My personal opinion is that what we are going via currently of a 
mixed IP/MPLS core is just a transition phase. The network of tomorrow 
clearly seems to be migrating into intelligent edge, out of band 
signaling and WDM based optical core. Therefor any protocol enhancement 
which will allow to move in this direction - just like pim-proxy draft 
does - is IMHO a very positive thing. Therefor I strongly vote that we 
should accept it as a WG document here.

 > Pekka Savola wrote:

---

From: Pekka Savola <[email-masked]>
Date: Tue, 12 Oct 2004 22:01:32 +0300 (EEST)

This is getting off-topic so maybe we should drop the discussion..

On Tue, 12 Oct 2004, Robert Raszuk wrote:
> DDoS can target your P/PE routers. 

I must be missing something.  You don't need full BGP table in the 
core to be able to attack the core.  It just requires that there is a 
route to the edge network, and from the edge network to the BGP-free 
core network.  Granted, the BGP-free core (if they didn't have a 
default route) couldn't send return packets, but the boxes would be 
just as dead.

The above can be easily achieved as well with just putting in access
lists blocking any access to the infrastructure boxes except from
specific IP address ranges at the edges.

> ATM switch. 

[well, we've had some issues when the management ethernet of the ATM 
switch was attacked when it wasn't properly protected using access 
lists..]

If we were talking about 'IP-free core', then the analogy would be
more to the point.. but AFAICS we aren't, so omitting BGP brings very
little, unless you believe there is an inherent problem with BGP as
such.

> DDoS attack is just not the only example. Today AFAIK 

Do you really think that's preventable?  If one can compromise a
router, you naturally can do all kinds of Man-in-the-middle fun.  And
because one can set up MPLS LSP's in any manner one wants in inside
the provider core, there's little one can do here.

The only alternatives are 1) protecting the PE box from the attackers, 
and 2) using CE-CE (-like IPsec).  BGP-free core does not help with 1) 
-- IP-free core would though -- but this can be achieved with access 
lists etc.
 
> trust in the VPN services among their customers then those who don't.

You mention IP free core.  But the argument was about BGP-free core, 
not about IP-free core, unless I'm missing something ?

---

From: Robert Raszuk <[email-masked]>
Date: Tue, 12 Oct 2004 12:17:40 -0700

Pekka,

> This is getting off-topic so maybe we should drop the discussion..

As you wish. I just hope that in the same time we can drop the equally 
off-topic arguments against pim-proxy draft ;).

> specific IP address ranges at the edges.

Ever heard about spoofing ?

> not about IP-free core, unless I'm missing something ?

In particular the argument is not about BGP free core, it is not about 
IP free core ... it is in almost in all SP customers I interact with 
about Internet routes free core.

Cheers,
R.

---

From: Pekka Savola <[email-masked]>
Date: Wed, 13 Oct 2004 08:40:52 +0300 (EEST)

> Ever heard about spoofing ?

Yes.  We disallow our internal prefixes (especially the management
ones, but actually all of them) to be used as source addresses in
packets coming at us from peers and upstreams.  Customers are also
prevented from spoofing by the use of strict uRPF. That disallows
anyone spoofing the management access from the outside.

If we wanted to block DoS attacks, we could just additionally put in
an ACL which would block access to specific destinations (the routing
infrastructure) except from a few specific IP addresses.

I guess your assumptions stem from the fact that many SP's don't
bother to do ingress filtering on their edges, or protect their
infrastructure addresses from being spoofed properly.  That brings a
LOT of pain, and I don't think removing 'IP' from the core is
necessarily the right way to fix these problems.