Subject: [SAVA] Thinking simpler...

From: fergdawg at netzero.net (Fergie)
Date: Tue Mar 20 22:58:23 2007

-- Pekka Savola <[email-masked]> wrote:

>On Mon, 19 Mar 2007, Fred Baker wrote:
>> Any comments?
>>
>>    ftp: //ftpeng.cisco.com/fred/sava/Sava-Simple.txt
>>    ftp: //ftpeng.cisco.com/fred/sava/Sava-Simple.xml
>
>This seems to be geared at the 'LAN spoofing prevention', and could be 
used as a more automatic tool for populating link-layer <-> IP 
spoofing prevention inside a subnet.
>
>However, if the router(s) of such a subnet were to apply uRPF on the 
link, the impact (to those outside the subnet) would already be 
eliminated.
>
>As such as this seems to be a more fine-grained solution compared to 
strict uRPF, it doesn't seem to be any easier to deploy than strict 
uRPF.  It also doesn't solve the more difficult inter-ISP problems 
quoted at the BOF.

I agree with the point re: Local subnet source address validation
is pretty much what Fred's 'draft' covers, and for me it's a
no-brainer.

I particularly agree with the point(s) about Fred's 'draft' not
addressing the the inter-AS issue(s), but as I mentioned in the
BoF, it would be oh-so-nice to piggyback on the SIDR work and some
sort of "vouch by" policy. Hopefully this will be something we can
work out going forward in the framework.

- ferg

--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawg(at)netzero.net
 ferg's tech blog: http://fergdawg.blogspot.com/