Subject: [pim] revision of draft-ietf-pim-lasthop-threats

From: Pekka Savola <[email-masked]>
Date: Mon, 25 Jun 2007 12:31:01 +0300 (EEST)

Hi,

As you've noticed, I've revised draft-ietf-pim-lasthop-threats based 
on Prague IETF input.  For diffs etc. go to:

http://tools.ietf.org/wg/pim/draft-ietf-pim-lasthop-threats/

Please read and comment.  Otherwise I believe this is getting ready 
for WGLC (unfortunately I won't be in Chicago).

In particular, in the following, the first two paragraphs are 
unchanged, the rest is new:

4.3.  IP Filtering PIM Messages

    To eliminate both the unicast and multicast PIM messages, in similar
    scenarios to those for which PIM passive mode is applicable, it might
    be possible to block IP protocol 103 (all PIM messages) in an input
    access-list.  This is more effective than PIM passive mode, as this
    also blocks Register messages.

    This is also acceptable when there is more than one PIM router on the
    link if IPsec is used (because the access-list processing sees the
    valid PIM messages as IPsec AH/ESP packets).  However, this presumes
    that the link is not used to transit unicast packets between the PIM
    routers, or that the Register messages are also being sent with
    IPsec.

    When multiple routers exist on a link, IPsec is not required if it is
    possible to prevent hosts from sending PIM messages at Ethernet
    switch (or equivalent) host ports.  This could be accomplished in at
    least two ways:

    1.  Use IP access lists on the stub routers to allow PIM messages
        from the valid neighbor IP addresses only, and implement IP
        spoofing prevention at Ethernet switch port level using
        proprietary mechanisms, or

    2.  Filter out all PIM messages at configured host ports on Ethernet
        switches instead of doing it on the routers.

    The main benefit of this approach is that multiple stub routers can
    still communicate through the LAN without IPsec but hosts are not
    able to disturb the PIM protocol.  The drawback is that Ethernet
    switches need to implement much finer-grained IP layer filtering and
    the operational requirements of carefully maintaining these filters
    could be significant.

.. the table in Section 4.4 was changed with:

    "Ysw" means Yes if IPsec is used in addition or IP filtering is done
    on Ethernet switches on all host ports; No otherwise.

Further down in Section 4.4, the sentence starting with 'However,' is 
new:

    To summarize, IP protocol filtering for all PIM messages appears to
    be the most complete solution when coupled with the use of IPsec
    between the real stub routers when there are more than one of them.
    However, IPsec is not required if PIM message filtering or certain
    kind of IP spoofing prevention is applied on all the host ports on
    Ethernet switches.  If hosts performing registering is not considered
    a serious problem, IP protocol filtering and passive-mode PIM seem to
    be equivalent approaches.

_______________________________________________
pim mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pim