Subject: Re: Issue 19) Security Considerations

From: [email-masked]
Date: Fri, 21 Mar 2003 08:19:39 -0500 (EST)

>Since there is no standard specifying BGP over IPSEC,

I'm not sure I understand this comment.  Could you explain?

The spec for using TCP MD5 is entitled "Protection of BGP Sessions
via the TCP MD5 Signature (sic) Option" but the mechanism described really
has no relationship to BGP.  It's just a mechanism for doing authentication
at the TCP level.  You could use the same draft to protect any other
TCP application (but please don't - TLS or IPSEC would be better).

The BGP draft says "go do that".

The BGP draft could just as easily say "go do IPSEC" - I don't see that
there would be anything left to standardize that would require a BGP over
IPSEC document.

Am I missing something?

--Sandy

---

From: Curtis Villamizar <[email-masked]>
Date: Fri, 21 Mar 2003 11:09:18 -0500

> there would be anything left to standardize that would require a BGP over

You are missing that the BGP4 spec must reflect current practice and
may point out better than current practice if such a thing is
currently defined.  BGP over IPSEC is not currently defined, therefore
the BGP4 spec neither advocates it or prevents it.

Curtis