Subject: Re: Issue 19) Security Considerations

From: [email-masked]
Date: Fri, 21 Mar 2003 11:31:32 -0500 (EST)

>You are missing that the BGP4 spec must reflect current practice and
>may point out better than current practice if such a thing is
>currently defined.  BGP over IPSEC is not currently defined, therefore
>the BGP4 spec neither advocates it or prevents it.

Oh, yes.  I know the guidelines for including things in the current
spec.  I was just trying to understand Andrew's comment and why he
thought there would have to be a standard for running BGP over IPSEC
before it could be included in the base spec.  I thought there was an
implication that there would be issues to work out in doing that
(especially since he referred to an old work that defined how to do it).
Same implication in your comment "BGP over IPSEC is not currently defined"
- what's to define?

With the current focus on documenting current practice, if current
practice does not include running BGP over IPSEC, then we cannot put
it in the draft, whether it needed defining or standardization or not.
So my question is academic or for future reference.

--Sandy

---

From: Curtis Villamizar <[email-masked]>
Date: Fri, 21 Mar 2003 11:41:05 -0500

> So my question is academic or for future reference.

No technical issue, just can't refer to a spec that doesn't yet exist
when trying to go for FS (or PS for that matter).

Add to that the IDR WG is not supposed to work on anything new (or
more correctly take on WG items or try to advance anything new) until
the base BGP4 spec gets updated.

As soon as BGP4-(N->infinity) is at least out of WG last call advanced
to the IESG this is one of the internet-drafts that could (should IMO)
be considered by the WG.

Curtis

---

From: [email-masked]
Date: Fri, 21 Mar 2003 11:04:33 -0800

I think Curits has nailed it down nicely.  I used the "standardize" statement
a bit more loosely than I should have, perhaps.  As a practical matter, if
we want people to make IPSec a consistantly implemented and deployed option 
we, as a community, will need to bless it by publishing some sort of document.

Andrew

On Fri, Mar 21, 2003 at 11:41:05AM -0500, Curtis Villamizar wrote:
> Delivered-To: [email-masked]
> Delivered-To: [email-masked]
> Delivered-To: [email-masked]
> To: [email-masked]
> Cc: [email-masked], [email-masked], [email-masked],
>    [email-masked]
> Reply-To: [email-masked]
> Subject: Re: Issue 19) Security Considerations 
> In-reply-to: Your message of "Fri, 21 Mar 2003 11:31:32 EST."
>              <[email-masked]> 
> Date: Fri, 21 Mar 2003 11:41:05 -0500
> From: Curtis Villamizar <[email-masked]>
> Precedence: bulk
> X-Spam-Status: No, hits=-0.8 required=5
> X-Scanned-By: MIMEDefang 2.30 (www . roaringpenguin . com / mimedefang)
> X-OriginalArrivalTime: 21 Mar 2003 16:43:53.0710 (UTC) FILETIME=[0EE440E0:01C2EFC9]
> 
>

---

From: Curtis Villamizar <[email-masked]>
Date: Fri, 21 Mar 2003 14:16:06 -0500

Off topic a little, but worth mentioning.

The *real* problems that ISPs find themselves facing cannot be solved
by the better encryption of IPSEC.  IPSEC does nothing to improve the
DoS threat that is real, but does address what is considered by most
ISPs to be currently a complete non-problem due to filtering
techniques that have been in place for years.

Please see <http://www.nanog.org/mtg-0302/hack.html>,
<http://www.nanog.org/mtg-0302/gill.html>, and draft-gill-btsh-01.txt.

Its best to understand the problems before proposing the solutions.

Curtis