Subject: Re: [RPSEC] BGP Requirements Draft

From: Sandy Murphy <[email-masked]>
Date: Mon, 26 Sep 2005 04:33:47 -0400 (EDT)

>However, we have many examples of wanting to send a specific bit of
>reachability to X, and not allowing them to send it further along. So,
>this example falls through.

No, Russ.  Routing operation has many cases where operators sure would
like to forbid their "reachability information" from propogating further
than their neighbor.  But, except for NO_EXPORT (not in the base spec
anyway), there is no way to represent this wish *IN BGP*.  There's certainly
no way at all to express *in BGP* that the update should not propagate more 
than 2 hops, 3 hops, etc.

This wish might be a feature that you could add to BGP.  But until
it becomes a feature of BGP, then you can't bring it up as a counter
example to a statement about BGP.

We do not have examples *IN BGP* of "not allowing them to send it
further along", except for the one  case of NO_EXPORT.  (And, by the
way, nothing in the security requirements currently discussed would
interfere with NO_EXPORT, just in case people were worried.)

The "not allowing them to send it on" is outside the protocol.

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Mon, 26 Sep 2005 08:02:03 -0400

> than 2 hops, 3 hops, etc.

No, Sandy. NO_EXPORT is a well known community. There are other examples 
of people using communities to provide this sort of capability, for 
instance, NO_PEER, and others.

If we're going to insist on simply using the BGP specification, and only 
the BGP specification, without any extensions as noted in other 
specifications, and without any reference to any sort of field 
experience, then we're going to have a requirements document that only 
expresses about a quarter of what BGP security should really be about.

:-)

Russ

- -- 
[email-masked] CCIE <>< Grace Alone