Subject: Re: [RPSEC] BGP Requirements Draft

From: Sandy Murphy <[email-masked]>
Date: Mon, 26 Sep 2005 08:46:58 -0400 (EDT)

>No, Sandy. NO_EXPORT is a well known community. There are other examples
>of people using communities to provide this sort of capability, for
>instance, NO_PEER, and others.

The communities that express policy in this way *CAN* be included in the
protections.  You just have to know what you want to protect and design
your security system to protect them.

It is policies that aren't represented in the protocol that have to
be excluded.

But I thought we had decided that we were only going to talk about the
base spec for now, as opening up to all the BGP extras could result
in what one poster called "the perpetual employment act for routing
security geeks".  Did I miss remember that decision?  The draft doesn't 
refer to anything but the base spec - do we need to revise it to say
what it does cover?

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Mon, 26 Sep 2005 09:04:57 -0400

> refer to anything but the base spec - do we need to revise it to say

I thought we had decided to cover the base specification tempered by 
operational experience.... Just using the "base spec" is a bit like 
trying to secure a house with reference only to the blueprint.

:-)

Russ

- -- 
[email-masked] CCIE <>< Grace Alone