Subject: FW: draft-behringer-mpls-vpn-auth-04.txt

From: "DECRAENE Bruno RD-CORE-ISS" <[email-masked]>
Date: Tue, 8 Mar 2005 01:49:12 +0100

Comment in line.
Regards.
Bruno

 > At 21:40 07/03/2005, David McDysan wrote:
> > From section 2,
> >
> >  Therefore, a mechanism is  
> >   required which prevents routes from being passed into a
> PE router's
> >   Virtual Routing & Forwarding Instance (VRF), unless they
> have been
> >   verified to belong to the associated VPN. Also, in the
> case of such
> >   configuration errors, the Service Provider must be
> alerted so that
> >   the mistake can be rectified.  
> >
> >I think this is in line with the requirements I stated in my
> previous
> >post regarding CE authentication.
> >
> >Could the UDP-based proposal for distributing an MD5 hashed 
> >authentication value from CE authentication be used between
> CE and PE
> >in the case that there is no routing protocol present?
> 
> Yes, in principle. The question I would ask though is whether it is 
> actually easier enabling a new protocol, or to enable routing? Or, to 
> be concrete, can you indicate why as a SP you prefer this over 
> routing? Are you concerned about the number of routing peers on the 
> PE?

Reducing the number of PE-CE peerings improve PE scalability, routing
stability, and simplicity.
In that case, static routes are used. Eventually, BFD will be used to
check PE-CE connectivity for these static routes. 
Would you consider using BFD MD5 auth in that case?

> 
> >Not sure if the approach of an MD5 shared secret will work well in a 
> >multi-provider environment and would still suggest investigation of 
> >other security approaches, such as certificates that would
> work across
> >providers and provide stronger authentication.
> 
> Need to include inter-AS in the draft, this is a good point. 
> 
> Not sure we want to go the certificate way. Our initial idea was to 
> keep this very simple. If higher levels of security are required, my 
> feeling is you'd probably go for CE-CE IPsec. But this might be a 
> point for discussion.
> 
> Michael
> 
> 
> >Dave
> >> -----Original Message-----
> >> From: [email-masked] [mailto:[email-masked]] On 
> >> Behalf Of Michael H. Behringer
> >> Sent: Monday, March 07, 2005 2:03 PM
> >> To: [email-masked]
> >> Subject: draft-behringer-mpls-vpn-auth-04.txt
> >> 
> >> 
> >> Apologies I missed the deadline to submit -05 of this draft. 
> >> For the discussion in today's meeting, please see the attached 
> >> version -04.
> >> 
> >> Michael
> >> 
> 
>