Subject: Re: [GROW] I-D Action: draft-ietf-grow-bgp-reject-00.txt

From: Job Snijders <[email-masked]>
Date: Sat, 13 Aug 2016 18:34:12 +0200

On Tue, Feb 16, 2016 at 04:52:35PM -0500, Matthew Ringel wrote:
> The solution for BGP-sans-policy rejection shouldn't fail silently.
> 
> It would be useful to add a requirement indicating that the software must
> clearly show that the reason for the session being down is due to the lack
> of policy, and one of the places it should show that indicator is in
> whatever command is used for a summary of all configured BGP sessions.

We don't want the session down, we just want no exchange of routing
information.

The draft lists the following two:

    "Software MUST mark any routes from an eBGP peer as 'invalid' in the
    Adj-RIB-In, if no explicit policy was configured."

    "Software MUST NOT advertise any routes to an eBGP peer without the
    operator configuring a policy."

Requiring software to tear down the session is undesirable in my
opinion.

Kind regards,

Job

---

From: Gert Doering <[email-masked]>
Date: Sat, 13 Aug 2016 19:53:47 +0200

Hi,

> Requiring software to tear down the session is undesirable in my

Seconded.  Flapping sessions due to no policy configured is counterintuitive.

I could see "sessions will not be established until a policy is configured"
(so it would never come up, and when queried the router would tell 
something akin to "PfxCt" to clearly display why it's refusing to bring
up the session...) - but it shouldn't flap.  That will cause operational
people to go debug in all the wrong places.

"Neither send nor receive prefixes" or "not bring up the session at all"
are workable alternatives from an operational PoV.

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (0)89/32356-444           USt-IdNr.: DE813185279

---

From: Jared Mauch <[email-masked]>
Date: Sat, 13 Aug 2016 14:43:56 -0400

> On Aug 13, 2016, at 1:53 PM, Gert Doering <[email-masked]> wrote:
> 

I’m ok with implementors doing what XR does by default without "unsafe-ebgp-policy”
set.

There’s no reason in 2016 for any implementation to accept routes without a policy set.

I’d prefer it if implementors removed some of these crutches that permit the unsafe BGP
policies that permit things as seen in rfc7908 and otherwise.

- jared