Subject: Re: [sfc] Fwd: New Version Notification for draft-ietf-sfc-multi-layer-oam-05.txt

From: Gyan Mishra <[email-masked]>
Date: Mon, 7 Dec 2020 20:39:57 -0500

Dear Greg & Authors

Please consider adding an improved security mechanism to protect the
integrity of the SFC Echo Request/Reply function.

This feature would be highly valuable to operators.

Thank you

Gyan

On Wed, May 20, 2020 at 10:51 PM Greg Mirsky <[email-masked]> wrote:

> Dear All,
> this version includes a minor update to the Security Considerations
> section.
> We, the authors, believe that the draft is ready for the WG LC. It defines
> an essential function of SFC OAM - SFP Echo request/reply. Per our
> analysis, existing OAM mechanisms cannot support both SFP ping and SFP
> traceroute. Consider ICMP. When encapsulated in NSH, it supports the ping
> function but, per our analysis, cannot be used as an SFP tracing tool.
> We much appreciate your comments and questions.
>
> Dear Jim and Joel,
> please kindly consider the WG LC for this draft.
>
> Regards,
> Greg
>
> ---------- Forwarded message ---------
> From: <[email-masked]>
> Date: Wed, May 20, 2020 at 6:32 PM
> Subject: New Version Notification for draft-ietf-sfc-multi-layer-oam-05.txt
> To: Bhumip Khasnabish <[email-masked]>, Cui(Linda) Wang <
> [email-masked]>, Greg Mirsky <[email-masked]>, Wei Meng <
> [email-masked]>
>
>
>
> A new version of I-D, draft-ietf-sfc-multi-layer-oam-05.txt
> has been successfully submitted by Greg Mirsky and posted to the
> IETF repository.
>
> Name:           draft-ietf-sfc-multi-layer-oam
> Revision:       05
> Title:          Active OAM for Service Function Chains in Networks
> Document date:  2020-05-20
> Group:          sfc
> Pages:          18
> URL:
> https://www.ietf.org/internet-drafts/draft-ietf-sfc-multi-layer-oam-05.txt
> Status:
> https://datatracker.ietf.org/doc/draft-ietf-sfc-multi-layer-oam/
> Htmlized:
> https://tools.ietf.org/html/draft-ietf-sfc-multi-layer-oam-05
> Htmlized:
> https://datatracker.ietf.org/doc/html/draft-ietf-sfc-multi-layer-oam
> Diff:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-sfc-multi-layer-oam-05
>
> Abstract:
>    A set of requirements for active Operation, Administration and
>    Maintenance (OAM) of Service Function Chains (SFCs) in networks is
>    presented.  Based on these requirements an encapsulation of active
>    OAM message in SFC and a mechanism to detect and localize defects
>    described.  Also, this document updates RFC 8300 in the definition of
>    O (OAM) bit in the Network Service Header (NSH) and defines how the
>    active OAM message identified in SFC NSH.
>
>
>
>
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
>
> _______________________________________________
> sfc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sfc
>

-- 

<http://www.verizon.com/>

*Gyan Mishra*

*Network Solutions A**rchitect *

*M 301 502-134713101 Columbia Pike *Silver Spring, MD

---

From: Greg Mirsky <[email-masked]>
Date: Tue, 8 Dec 2020 22:57:57 -0800

Hi Gyan,
thank you for your interest in the SFC OAM work and your thoughtful
suggestion. Indeed, every moving part we introduce in a network must
include a robust security mechanism. We'll work on a solution and hope to
share our proposal with you and the group soon.

Regards,
Greg

On Mon, Dec 7, 2020 at 5:47 PM Gyan Mishra <[email-masked]> wrote:

>> We, the authors, believe that the draft is ready for the WG LC. It
>> defines an essential function of SFC OAM - SFP Echo request/reply. Per our

---

From: Greg Mirsky <[email-masked]>
Date: Thu, 10 Dec 2020 14:37:47 -0800

Hi Gyan,
thank you for a great suggestion. We've taken a fresh look at the draft and
two related documents, SFC Consistency OAM and SFC Echo Reply Return Path,
from the security point of view. We propose to add a new Authentication TLV
in the draft-ietf-sfc-multi-layer-oam (see attached diff and the new
working version). Also, the new TLV can be used to authenticate the SFC
Reply TLV and SFF Information Record TLV (we're preparing updates of these
drafts).
Authors welcome reviews of the proposed changes to the WG document. We
greatly appreciate your comments, questions, and suggestions.

Regards,
Greg

---

From: Gyan Mishra <[email-masked]>
Date: Fri, 11 Dec 2020 01:20:02 -0500

Hi Greg

That is good news that you are looking at related drafts SFC consistency
OAM and SFC Echo Reply Return path from security POV.

I reviewed the security update diff you attached for multi layer oam draft
and I don’t see any issues.

Thanks

Gyan

On Thu, Dec 10, 2020 at 5:38 PM Greg Mirsky <[email-masked]> wrote:

> Hi Gyan,
> thank you for a great suggestion. We've taken a fresh look at the draft
> and two related documents, SFC Consistency OAM and SFC Echo Reply Return
> Path, from the security point of view. We propose to add a new
> Authentication TLV in the draft-ietf-sfc-multi-layer-oam (see attached diff
> and the new working version). Also, the new TLV can be used to authenticate
> the SFC Reply TLV and SFF Information Record TLV (we're preparing updates
> of these drafts).
>> *M 301 502-134713101 Columbia Pike
>> <https://www.google.com/maps/search/13101+Columbia+Pike%C2%A0+Silver+Spring,+MD?entry=gmail&source=g>*Silver
>> Spring, MD
>> <https://www.google.com/maps/search/13101+Columbia+Pike%C2%A0+Silver+Spring,+MD?entry=gmail&source=g>
>>
>> --

*Gyan Mishra*