[Idr] 答复: New Version Notification for draft-liang-idr-bgp-flowspec-time-00.txt

Hi Gunter,

When BGP routes are disseminated across the domain, the delay may reach to the second-level or more. So by announcing and withdrawing a BGP NLRI, it cannot guarantee the second-level precision. Also we know the precision of ACL service can be second-level.

Thanks,
Jianjie

发件人: Gunter Van De Velde [mailto:guntervandeveldecc@icloud.com]
发送时间: 2015年10月23日 15:17
收件人: Youjianjie
抄送: idr@ietf.org
主题: Re: [Idr] New Version Notification for draft-liang-idr-bgp-flowspec-time-00.txt

Hi Jianjie,

I can understand the desire to have particular filter rules active on particular times of the day. I am not convinced that sending timing context along with a BGP NLRI is the way to achieve this.

A relevant difference between ACL and BGP is that ACL tends to be static and BGP is dynamic by nature.

By announcing and withdrawing a BGP NLRI you can make a rule dynamic, unless there is an absolute need to have activation/de-activation in msec sync’d.
Hence, we have a solution with BGP that is dynamic and provides relative network wide synchronised network behaviour (announce/withdraw), but it is indeed not synchronous to the msec.

Making network control sync on msec is not easy and a valid question is if BGP should be part in such a goal?
(There are also operational aspects to troubleshoot the network in case of unexpected behaviour … )

Brgds,
G/

On 23 Oct 2015, at 08:35, Youjianjie <youjianjie@huawei.com<mailto:youjianjie@huawei.com>> wrote:

Hi Gunter,

We collect the requirements from our customers. Actually traditional ACLs already support similar functions.
For the last sentence, could you please explain a little more? Why do you think it is complex?

Thanks,
Jianjie

发件人: Gunter Van De Velde [mailto:guntervandeveldecc@icloud.com]
发送时间: 2015年10月19日 15:32
收件人: Youjianjie
抄送: idr@ietf.org<mailto:idr@ietf.org>
主题: Re: [Idr] New Version Notification for draft-liang-idr-bgp-flowspec-time-00.txt

Hi Youjianjie,

I would expect a flow spec rule to be valid for consumption from the moment its originated from a flow spec controller until it is withdrawn by the controller. In the text proposed you relate to different forwarding delays for a router to receive the flow spec rule and hence justifies a need for new community to specify 'valid-time' for the flow spec route. This seems as a pretty light reason for such a complex proposed logical machine.

Be well,
G/

Sent from iCloud

On Oct 19, 2015, at 04:08 AM, Youjianjie <youjianjie@huawei.com<mailto:youjianjie@huawei.com>> wrote:
Dear all,

This document proposes a new BGP path attribute called "Flow Extended Attribute", which carries expected valid period information for a FlowSpec rule.
Could you please review? Your comments are welcome.

Thanks,
Jianjie

-----邮件原件-----
发件人: internet-drafts@ietf.org<mailto:internet-drafts@ietf.org> [mailto:internet-drafts@ietf.org]
发送时间: 2015年10月19日 9:58
收件人: Liangqiandeng; Zhuangshunwan; Youjianjie; Zhuangshunwan; Youjianjie; Liangqiandeng
主题: New Version Notification for draft-liang-idr-bgp-flowspec-time-00.txt

A new version of I-D, draft-liang-idr-bgp-flowspec-time-00.txt
has been successfully submitted by Jianjie You and posted to the IETF repository.

Name:                draft-liang-idr-bgp-flowspec-time
Revision:    00
Title:                BGP FlowSpec with Time Constraints
Document date:        2015-10-18
Group:                Individual Submission
Pages:      9
URL: https://www.ietf.org/internet-drafts/draft-liang-idr-bgp-flowspec-time-00.txt
Status: https://datatracker.ietf.org/doc/draft-liang-idr-bgp-flowspec-time/
Htmlized: https://tools.ietf.org/html/draft-liang-idr-bgp-flowspec-time-00

Abstract:
The BGP flow specification (FlowSpec) is an additional tool to
mitigate the effects of Distributed Denial of Service (DDoS) attacks.
Since DDoS attacks are dynamic, filtering of a flow may only be
necessary for some specified time, and be undesirable at other times.
This document proposes a new BGP path attribute called "Flow Extended
Attribute", which carries expected valid period information for a
FlowSpec rule. So network administrators can control certain types
of traffic in a specified period.

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org<http://tools.ietf.org>.

The IETF Secretariat

_______________________________________________
Idr mailing list
Idr@ietf.org<mailto:Idr@ietf.org>
https://www.ietf.org/mailman/listinfo/idr