Subject: CE to CE Member Verification Drafts

From: Shane Amante <[email-masked]>
Date: Tue, 08 Mar 2005 10:38:32 -0700

Yesterday in the l3vpn WG it was mentioned that the authors of 
draft-behringer-mpls-vpn-auth-03.txt and 
draft-ietf-l3vpn-l3vpn-auth-01.txt attempted to merge their two drafts, 
but were ultimately unsuccessful.

My question for both sets of authors is: why not use a BGP capability to 
signal between the PE and CE so they may both determine if the 
draft-ietf-l3vpn-l3vpn-auth method is supported, (and either/both side 
would/must use it)?

While I would ideally prefer only one method for CE-to-CE Member 
Verification, from a pragmatic standpoint I see draft-behringer as being 
able to provide immediate protection (as soon as code is available for 
PE's) to my IPVPN customers running BGP PE-CE, but Ron's draft as taking 
longer get deployed in the market because vendors will need to produce 
code[1] for the variety of CPE already deployed and customers to, of 
course, upgrade them.  This is not to say Ron's proposal in inferior, 
rather quite the opposite.  For a subset of "security conscious" IPVPN 
customers they would prefer to be automatically notified that their VPN 
has been breached, (in addition to the SP also knowing the same). 
However, other less paranoid IPVPN customers would be OK with say, the 
"default", method defined by draft-behringer.

-shane

[1] The CPE routers would need new code to support the new BGP extended 
community "token" and/or VPN Token Propagation Protocol for statically 
routed connections.