Subject: Re: [RPSEC] BGP Requirements Draft

From: Sandy Murphy <[email-masked]>
Date: Mon, 26 Sep 2005 09:39:49 -0400 (EDT)

>Certainly, but you've moved into the realm of policy. It's B's policy
>...
>- -- Is it correct to say it's "more secure" without considering all the

The point is that the path adjacency check does not tell E that the
route it got from D passed through all the AS's in the AS path.

So E can not determine loop freedom by checking for its AS in the AS_PATH.

The point  we are arguing right now is whether the path adjacency
check means that checking for your own AS ensures loop-freedom.
I say it does not.  Witness: E got a route and  it passes the peering
adjacency test, but it did not progress through all  the AS's in the
AS_PATH.  So E needn't bother checking for its AS in the AS_PATH -
it would be meaningless.  The AS_PATH need not show a loop even if
a loop existed.

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Russ White <[email-masked]>
Date: Mon, 26 Sep 2005 09:54:08 -0400

> it would be meaningless.  The AS_PATH need not show a loop even if

????

I'm _really_ confused. The interconnection check states that you check 
the list of AS' in the AS Path against the actual conenctions in the 
internetwork. If the AS Path is a loop, then the route will be rejected 
through normal BGP operation--no-one is saying that we should override 
normal loop detection with the interconnection check (?). You're somehow 
implying that if the AS' are connected, even though one of the AS' 
doesn't appear in the AS Path, the route is acceptable. Read the actual 
wording--the AS's listed in the AS Path must be connected, not through 
some third party not appearing in the AS Path, but directly, as shown in 
the AS Path, in the order shown in the AS Path.

:-)

Russ

- -- 
[email-masked] CCIE <>< Grace Alone