Re: [Detnet] Roman Danyliw's Discuss on draft-ietf-detnet-mpls-11: (with DISCUSS and COMMENT)

[Roman Danyliw <[e-mail]>]

Hi Stewart!

Thanks for clarifying, especially since I see the same language is in draft-ietf-detnet-ip-over-mpls.

Let me test my understanding using MPLS specific language.  Are you roughly saying:

OLD
To prevent DetNet packets
   from being delayed by an entity external to a DetNet domain, DetNet
   technology definition can allow for the mitigation of Man-In-The-
   Middle attacks, for example through use of authentication and
   authorization of devices within the DetNet domain.

NEW

To prevent the DetNet packets from being delayed by the volume of traffic from external entities using the same MPLS infrastructure, PEs implementing the DetNet architecture could only allow packets to enter the LSP from appropriately authenticated and authorized devices.

Roman

From: Stewart Bryant <[e-mail]>
Sent: Tuesday, September 8, 2020 2:26 PM
To: Roman Danyliw <[e-mail]>
Cc: Stewart Bryant <[e-mail]>; The IESG <[e-mail]>; [e-mail]; DetNet Chairs <[e-mail]>; DetNet WG <[e-mail]>; Ethan Grossman <[e-mail]>
Subject: Re: Roman Danyliw's Discuss on draft-ietf-detnet-mpls-11: (with DISCUSS and COMMENT)




On 8 Sep 2020, at 19:10, Roman Danyliw via Datatracker <[e-mail]<mailto:[e-mail]>> wrote:

** (Discuss-discuss) Section 6.  Per “To prevent DetNet packets from being
delayed by an entity external to a DetNet domain, DetNet technology definition
can allow for the mitigation of MiTM attacks, for example through the use of
authentication and authorization of devices within the DetNet domain”, can this
attack scenario or the appropriate mitigation be clarified.  If packets are
coming from or going across the DetNet boundary how can any assurances be made?
What is architecture element is the “MiTM” (relay? transit? per Figure 2)?

Remember no packet gets into an MPLS LSP unless specifically put there by a PE (this is fundamental MPLS).

So the requirement on the PE is that it only allows permitted packets to enter the LSP but this is always a requirement placed on a PE.

- Stewart