Re: [Gen-art] Gen-ART telechat review of draft-ietf-sidr-roa-validation-10.txt

[Geoff Huston <[e-mail]>]

On 23/04/2011, at 11:51 AM, Brian E Carpenter wrote:

>>   It is a matter of local routing policy as to the actions to be
>>   undertaken by a routing entity in processing those routes with
>>   "unknown" validity states.
>
> That leaves open the possibility that an AS_SET aggregated route (which
> is by definition "unknown") would be rejected as part of a general policy
> choice. At the least, it seems that this should be mentioned to ensure that
> operators are aware of it. This is orthogonal to the fact that AS_SET
> is intrinsically a security problem.
> 
> Suggested sentence to add:
> 
> Operators should be aware that a policy that rejects all "unknown" routes
> will thereby reject any aggregated (AS_SET) route.

Thanks for your review Brian.

The draft already states "you really should not reject "unknown" routes":

   "Due to considerations of partial use of
   ROAs in heterogeneous environments, such as in the public Internet,
   it is advised that local policy settings should not result in
   "unknown" validity state outcomes being considered as sufficient
   grounds to reject a route outright from further consideration as a
   local "best" route."

I believe that this is sufficient in terms of guidance for an informational 
document to say "please don't shoot your foot off!" :-)

regards,

   Geoff