Subject: [rbridge] TTL only - was RE: New fields in shim header?

From: sgai at nuovasystems.com (Silvano Gai)
Date: Thu, 12 Oct 2006 14:32:04 -0700

Catlin,

Can you clarify what you mean by "do NOT require dynamic learning of MAC
addresses".

If you mean that you don't want to implement backward learning and you
want to learn through ISIS, I am OK, but I don't see a difference from a
security perspective.

Let's suppose the host A is connected to RBridge R1.

Let's also suppose that an intruder connects to R2 and spoofs the MAC
address of A. The ISIS of R2 will start to announce A and the RBridges
will learn that A is connected to either R1 or R2, in a non
deterministic way.

If RBridge R3 connects server that need a high level of protection, it
may have an ACL that admits traffic from R1, but drop traffic from R2.

This is not achievable simply testing the MAC address A, since its
position is not deterministic during an attack even if backward learning
is disabled.

Am I missing something?

-- Silvano

> -----Original Message-----
> From: Caitlin Bestler [mailto:caitlinb at broadcom.com]
> Sent: Thursday, October 12, 2006 2:05 PM
> To: Silvano Gai; Joe Touch
> Cc: rbridge at postel.org; Radia Perlman
> Subject: RE: [rbridge] TTL only - was RE: New fields in shim header?
> 
> Silvano Gai wrote:
> > Joe,
> >
> > IMHO TRILL will be valuable in HPC and Datacenters, where
> > high bisectional bandwidth is a must, and in Enterprise Backbone. In
> > the last 3 to 5 years, in this kind of applications:
> > 1) I haven't seen a hub
> > 2) All links are full-duplex
> > 3) I haven't seen wireless
> > 4) The existing switches support large jumbo frames 5) Almost all
> > links are fiber 6) The attacks are originated by the host, not by
the
> > switches 7) Backbones are shared by different applications
> >
> > IMHO, if we want to design something that addresses user
> > needs, we need to keep this in mind.
> >
> 
> The environment you describe is indeed an important one.
> It is also the environment that has the *least* need for
> wire-mechanisms to detect intruders. The main support
> for security in data center environments that the RBridge
> drafts should have is to make certain that we do NOT require
> dynamic learning of MAC addresses, and be very clear that
> MAC locations MAY be administratively configured.
>

---

From: caitlinb at broadcom.com (Caitlin Bestler)
Date: Thu, 12 Oct 2006 14:42:07 -0700

Silvano Gai wrote:
> Catlin,
> 
> Can you clarify what you mean by "do NOT require dynamic learning of
> MAC addresses". 
> 

My point is that a specific RBridge implementation MAY be
configured to "learn" that MAC Addrress X is on Port Y
solely through administrative configuration, and that
if anything else shows up on Port Y it is not to be
trusted.

Or more broadly, the specification does not limit
the methods by which an RBRidge can learn what MAC
Addresses are directly attached to it.