Subject: draft-behringer-mpls-vpn-auth-04.txt

From: "Michael H. Behringer" <[email-masked]>
Date: Mon, 07 Mar 2005 20:03:04 +0100

Apologies I missed the deadline to submit -05 of this draft. For the discussion in today's meeting, please see the attached version -04. 

Michael

---

From: David McDysan <[email-masked]>
Date: Mon, 07 Mar 2005 15:40:30 -0500

From section 2,

  Therefore, a mechanism is  
   required which prevents routes from being passed into a PE router's 
   Virtual Routing & Forwarding Instance (VRF), unless they have been 
   verified to belong to the associated VPN. Also, in the case of such 
   configuration errors, the Service Provider must be alerted so that 
   the mistake can be rectified.  

I think this is in line with the requirements I stated in my previous post
regarding CE authentication.

Could the UDP-based proposal for distributing an MD5 hashed authentication
value from CE authentication be used between CE and PE in the case that
there is no routing protocol present? 

Not sure if the approach of an MD5 shared secret will work well in a
multi-provider environment and would still suggest investigation of other
security approaches, such as certificates that would work across providers
and provide stronger authentication.

Dave
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Michael H. Behringer
> Sent: Monday, March 07, 2005 2:03 PM
> To: [email-masked]
> Subject: draft-behringer-mpls-vpn-auth-04.txt
> 
> 
> Apologies I missed the deadline to submit -05 of this draft. 
> For the discussion in today's meeting, please see the 
> attached version -04. 
> 
> Michael
>

---

From: "Michael H. Behringer" <[email-masked]>
Date: Mon, 07 Mar 2005 22:40:56 +0100

>there is no routing protocol present? 

Yes, in principle. The question I would ask though is whether it is actually easier enabling a new protocol, or to enable routing? Or, to be concrete, can you indicate why as a SP you prefer this over routing? Are you concerned about the number of routing peers on the PE?

>and provide stronger authentication.

Need to include inter-AS in the draft, this is a good point. 

Not sure we want to go the certificate way. Our initial idea was to keep this very simple. If higher levels of security are required, my feeling is you'd probably go for CE-CE IPsec. But this might be a point for discussion. 

Michael

---

From: David McDysan <[email-masked]>
Date: Mon, 07 Mar 2005 17:56:11 -0500

Responses in line below

> Sent: Monday, March 07, 2005 4:41 PM
> To: David McDysan; [email-masked]
> Subject: RE: draft-behringer-mpls-vpn-auth-04.txt
> 
> 
> >I think this is in line with the requirements I stated in my 
> previous 
> >post regarding CE authentication.
> >
> >Could the UDP-based proposal for distributing an MD5 hashed 
> >authentication value from CE authentication be used between 
> CE and PE 
> >in the case that there is no routing protocol present?
> 
> Yes, in principle. The question I would ask though is whether 
> it is actually easier enabling a new protocol, or to enable 
> routing? Or, to be concrete, can you indicate why as a SP you 
> prefer this over routing? Are you concerned about the number 
> of routing peers on the PE?
> 

I was proposing a way to handle the case where there is no routing between
the CE and PE. The CE-auth draft implies distribution of the authentication
token received on a specific UDP port to the other CE's configured to be in
the same VPN. Seemed like it could be used in CE-PE authentication.

> >multi-provider environment and would still suggest investigation of 
> >other security approaches, such as certificates that would 
> work across 
> >providers and provide stronger authentication.
> 
> Not sure we want to go the certificate way. Our initial idea 
> was to keep this very simple. If higher levels of security 
> are required, my feeling is you'd probably go for CE-CE 
> IPsec. But this might be a point for discussion. 
> 
> Michael
> 
> 
> >Dave