Subject: Re: [RPSEC] another example of peering topology check not catching

From: Sandy Murphy <[email-masked]>
Date: Mon, 14 Mar 2005 12:24:56 -0500 (EST)

>It's B's policy not to accept traffic on that link unless it's link to A is 
>down. This is part of the problem with policy, it's hard to define what you 
>mean when you say "policy," and it's also hard to express every possible 
>meaning in routing itself.

But we should at least be able to ensure that policy that *IS* expressed
in the routing information is adhered to.  That, at least, would be
an assurance people would like to have, I would say.

>If we could express all the policies we wanted to in routing, then why do 
>we have communities, and MED, and other such things? Why don't people just 
>advertise what they mean, and not worry about all this other stuff? Because 
>the routing information carried in BGP updates, by themselves, don't carry 
>enough "policy" to sufficiently express what people mean.

Maybe, then, we are forced to decide on a set of the expressible meanings
that we want to be able to secure.

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Mon, 14 Mar 2005 15:35:12 -0500 (Eastern Standard Time)

>> It's B's policy not to accept traffic on that link unless it's link to A 
>> is down. This is part of the problem with policy, it's hard to define 
>> what you mean when you say "policy," and it's also hard to express every 
>> possible meaning in routing itself.
>
> in the routing information is adhered to.  That, at least, would be an 
> assurance people would like to have, I would say.

Which policy? Not to transit a specific AS? I've already provided wording I 
think would cover that case, if we want to include it. If you want to 
consider that a part of "path validation," that's fine.... More below....

> that we want to be able to secure.

Yes. Is transiting a specific AS a policy we want to say should be 
expressable in any given system proposed? If so, then let's put the wording 
in to the draft. I don't (and won't) agree that it changes what we already 
have, it just adds to it.

:-)

Russ

__________________________________
[email-masked] CCIE <>< Grace Alone