Subject: Control draft Security section.

From: Luca Martini <[email-masked]>
Date: Mon, 21 Jun 2004 18:10:06 -0600

Wg,

Below is my first attempt at the required security section for the 
control draft.
Please send me comments , as we need to get this last bit done before 
re-issuing the last call for this draft.

Thanks.
Luca

1. Security Considerations

   This document specifies the use of LDP for setting up and maintaining
   Pseudowires. The security considerations applicable to LDP itself in
   are discussed in [1]. However because pseudowires transport other
   protocols that in some cases make certain security assumptions, the
   following area should be considered:

     - MPLS PDU confidentiality issues.
     - MPLS PDU Spoofing.
     - MPLS PSN protocol security.
     - Access Circuit security.
     - Denial of service prevention on the PE routers.

1.1. Data-plane

   When a MPLS PSN is used to provide pseudowire service, there is a
   perception that security MUST be at least equal to the currently
   deployed layer2 native protocol networks that the MPLS/PW network
   combination is emulating. This means that the MPLS network SHOULD be
   isolated from outside packet insertion in such a way that it SHOULD
   not be possible to directly insert an MPLS packet into the network.
   To prevent unwanted packet insertion, it is also important to prevent
   unauthorized physical access to the PSN as well as unauthorized
   administrative access to individual network elements. In the instance
   where there is an MPLS connection with a separate MPLS administrative
   domain, the PE providing the MPLS access SHOULD only accept an MPLS
   packet with a label for which a mapping was advertised to the
   respective MPLS peer PE.

1.2. Control

   The LDP MD5 authentication key options MUST be used to protect the
   LDP targeted sessions, from being spoofed, and used for unauthorized
   redirection of the PW traffic. If unauthorized inspection of the
   control protocol is considered a significant threat, IP encryption
   technology, such as IPSEC may be employed to prevent it. However
   control protocol inspection should not be a significant issue for the
   protocol defined in the current document if the data-plane is
   properly secured.

   Incoming LDP sessions should only be accepted from a pre-configured
   list of neighbors. Furthermore especially when using the generalized
   PW FEC the PE SHOULD have the ability to filter incoming FECs to
   allow only the authorized FEC requesting a connection with the
   proper attachment circuits.

                                                                [Page 1]