Subject: [savi] I-D Action: draft-ietf-savi-dhcp-21.txt

From: [email-masked]
Date: Sun, 30 Mar 2014 22:48:39 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Source Address Validation Improvements Working Group of the IETF.

        Title           : SAVI Solution for DHCP
        Authors         : Jun Bi
                          Jianping Wu
                          Guang Yao
                          Fred Baker
	Filename        : draft-ietf-savi-dhcp-21.txt
	Pages           : 43
	Date            : 2014-03-30

Abstract:
   This document specifies the procedure for creating a binding between
   a DHCPv4/DHCPv6 assigned IP address and a binding anchor on a SAVI
   (Source Address Validation Improvements) device.  The bindings set up
   by this procedure can be used to filter out packets with forged
   source IP address in DHCP scenario.  This mechanism is proposed as a
   complement to ingress filtering to provide finer-grained source IP
   address validation.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-savi-dhcp-21

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-savi-dhcp-21

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Leaf Yeh" <[email-masked]>
Date: Tue, 1 Apr 2014 09:50:39 +0800

Hi Guang,

Q19. I am not sure the reason why there is a new link between SAVI Device C
to SAVI Device B in Fig.1. The relation between the SAVI Device A and the
SAVI Device B looks more like the case described in the Fig.1 of SAVI arch.
(RFC7039).

Q20. As to DHCP-Trust Attribute, 
in section 4.2.2, <quote>
The "DHCP-Trust Attribute" indicates the DHCP Server-Client messages
   from the corresponding attachment is trustable.
...
</quote>
, in section 4.3.2 <quote>
   (5)  Configure DHCP-Trust attribute on the direct attachments of
        trusted DHCP relays/servers.
...
DHCP-Trust
   attribute is only configured on the inside links of the perimeter.
   Only DHCP server-client messages originated in the perimeter is
   trusted.
</quote>

When the port of SAVI-switch connected to the trusted DHCP relays/servers
(in the SAVI-perimeter) is configured DHCP-Trust attribute, how about the
data packet forwarding when it is received on this port? I guess the switch
will forward the packet as the normal without checking, right? May you need
a statement on this case in section 8.1?

Best Regards,
Leaf

-----Original Message-----
From: savi [mailto:[email-masked]] On Behalf Of
[email-masked]
Sent: Monday, March 31, 2014 1:49 PM
To: [email-masked]
Cc: [email-masked]
Subject: [savi] I-D Action: draft-ietf-savi-dhcp-21.txt

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
 This draft is a work item of the Source Address Validation Improvements
Working Group of the IETF.

Abstract:

_______________________________________________
savi mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/savi