Subject: [OPSEC] widely adopted communities presentation at nanog 49

From: Joel Jaeggli <[email-masked]>
Date: Mon, 21 Jun 2010 21:49:47 -0700

While I have some personal ambivialence to the idea of specifiying
well-known communities, I noted this presentation with some interest at
nanog and since the subject has been discussed here before I would drop
a pointer to the presentation.

http://www.nanog.org/meetings/nanog49/presentations/Tuesday/Raszuk-Wide_BGP_Communities_00_2.pdf

---

From: Christopher Morrow <[email-masked]>
Date: Tue, 22 Jun 2010 01:33:19 -0400

> http://www.nanog.org/meetings/nanog49/presentations/Tuesday/Raszuk-Wide_BGP_Communities_00_2.pdf

i vote, again, no 'well known communities' ... the guarantee that they
exist and will be used as intended isn't currently working with
no-export (as you stated at the mic I think). Having a contractually
obligated set of communities (even if it's different per provider)
with proscribed behaviours should be the target (which each customer
should pursue).

just one guy's opinion (I think).
-chris

---

From: Warren Kumari <[email-masked]>
Date: Tue, 22 Jun 2010 10:10:52 +0200

> with proscribed behaviours should be the target (which each customer

Keep in mind that I did not see the presentation, but I think that  
having 'well-known' communities in the sense that the communities are  
well known would be very useful, but 'well-known' with its current  
meaning is not...

It would be really useful if:
A: providers published their communities somewhere easily findable  
(and didn't require NDAs and such for them...)
B: providers converged towards using the same communities -- If would  
be great if I could only have to store 3-5 different numbers in my  
head for what denotes a customer and not one per peer.

I think that this could / should be achieved by market pressure and  
not though the IETF.

Just my feelings on this,

W

> _______________________________________________
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec

---

From: Robert Raszuk <[email-masked]>
Date: Tue, 22 Jun 2010 09:17:21 +0200

Hi Joel/Chris,

Many thx for forwarding the pointer to opsec WG. I guess I need to 
subscribe now :) The up to date version can be found here:

ftp://ftpeng.cisco.com/raszuk/bgp_wide_comms/

Based on the input received after Nanog to avoid any misinterpretations 
I have changed the semantics of the pre-defined communities from 
"well-known" to simply "registered".

The point of defining them is not to enforce global support both by 
operators or by vendors, but simply to make it easier to apply commonly 
used policies intra and inter-domians.

It is just to serve as an informational collection of community 
templates which could be used if fits in the contractual agreements.

Another point is that subset of defined communities are AS specific - 
today communities are of common execution type. That means that AS 
specific communities would be executed only on the boundary to or by 
target AS specified in the community therefor passing those could be 
much less troublesome as compared with today's standard BGP communities.

Feedback is welcome !

Many thx,
R.

---

From: joel jaeggli <[email-masked]>
Date: Mon, 28 Jun 2010 22:04:11 -0700

On 2010-06-22 01:10, Warren Kumari wrote:
> A: providers published their communities somewhere easily findable (and
> didn't require NDAs and such for them...)
> B: providers converged towards using the same communities -- If would be
> great if I could only have to store 3-5 different numbers in my head for
> what denotes a customer and not one per peer.

I think there is a case to be made that what you end up with is a taxony 
of what communities are useful and which as a customer you expect to 
find without defining what actual community values are.

> I think that this could / should be achieved by market pressure and not
> though the IETF.
>