Subject: [Isis-wg] Re: Comments on Extensions to IS-IS for Advertising Optional Router Capabilities

From: Naiming Shen <[email-masked]>
Date: Tue, 01 Jul 2003 18:55:29 -0700

Nagi,

thanks for the comments, some replies inline.

 ] Naiming & all,
 ] 
 ] I have a couple of questions on the draft.
 ] 
 ] 1) As you mentioned, this feature can be used in MPLS-TE environment (or) by
 ] the Network management (or) for some other informational purposes.
 ] 
 ] Having said that, Router-ID may not be available (if TE extensions are not
 ] implemented) in some implementations. How do we solve that? Shouldn't  we
 ] consider System-ID as the unique identity?
 ] 

I think Router-ID is something very simple to implement, does not need
to do it along with TE extensions. For this capability extension purpose,
it only needs to be an unique 32bits number in the IGP domain. For
example, it could use the "IP Interface Address" number in the LSP.
But since the router-id is such a useful thing, I would recommend
anyone implements this draft to use the "real" router id of the
router or the virtual router. This extension came up first with
the troubleshooting in mind, and if the router-id is a routable one,
it would be useful in operation with an IP address.

 ] 2) I think advertising the router capabilities do create security concerns.
 ] For example, if I advertise I don't have HMAC-MD5 capability, then an
 ] intruder can aim at that specific system.

Well, there is some truth to that. But If someone can read my LSPs,
then they also can see if my LSP uses HMAC-MD5 or not. If they are
sitting on the same LAN, then they can read the other packets and
figure that out.

 ] Infact, one can create a list of
 ] IS-IS nodes which has/hasn't what capability?
 ] 

We hope the operators will do that, and find out any misconfiguration
or software mismatch in the network using this capability besides
some functional applications.

 ] Do you consider address those issues in Security Considerations section?
 ] 
 ] 3) Also there are some widely implemented drafts that deserve mention in the
 ] Router Capability TLV. For example, three way handshake capability is
 ] missing and there are some other capabilities too. 

This draft didn't mention three way handshake as a capability. Also this
draft does not mean to be inclusively list all the capabilities, just
something we thought could be useful to list with the capability
extension.

thanks.

 ] 
 ] Thanks
 ] Nagi.

- Naiming

_______________________________________________
Isis-wg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isis-wg

---

From: "Jonnala, Nagi" <[email-masked]>
Date: Tue, 1 Jul 2003 05:08:12 -0400

Naiming & all,

I have a couple of questions on the draft.

1) As you mentioned, this feature can be used in MPLS-TE environment (or) by
the Network management (or) for some other informational purposes.

Having said that, Router-ID may not be available (if TE extensions are not
implemented) in some implementations. How do we solve that? Shouldn't  we
consider System-ID as the unique identity?

2) I think advertising the router capabilities do create security concerns.
For example, if I advertise I don't have HMAC-MD5 capability, then an
intruder can aim at that specific system. Infact, one can create a list of
IS-IS nodes which has/hasn't what capability?

Do you consider address those issues in Security Considerations section?

3) Also there are some widely implemented drafts that deserve mention in the
Router Capability TLV. For example, three way handshake capability is
missing and there are some other capabilities too. 

Thanks
Nagi.