Re: [Idr] Possible to set up priority for Tunnels established by draft-ietf-idr-tunnel-encaps-09 ?

[Robert Raszuk <[e-mail]>]

Hey Jeff,

You know me saying lately that using BGP (aka KSP) is a bad idea if we use
it to distribute p2p information. However here the information is really
p2mp (provided common IPSec credentials are distributed to all CPEs) so it
actually may make sense.

Just started a side thread on this with a little idea how we could do that
safely :)

But if you have a suggestion to use some other protocol for it I am all
ears !

Cheers,
R


On Mon, Jul 9, 2018 at 11:03 PM, Jeff Tantsura <[e-mail]>
wrote:

> Yes Robert, exactly and such I would question the use of BGP
> (KitchenSinkProtocol) to do so in general
>
>
>
> Cheers,
>
> Jeff
>
>
>
> *From: *<[e-mail]> on behalf of Robert Raszuk <[e-mail]>
> *Date: *Monday, July 9, 2018 at 13:53
> *To: *Linda Dunbar <[e-mail]>
> *Cc: *Jeff Tantsura <[e-mail]>, Eric C Rosen <
> [e-mail]>, "[e-mail]" <[e-mail]>, "
> [e-mail]" <draft-ietf-idr-tunnel-encaps@
> ietf.org>
>
> *Subject: *Re: [Idr] Possible to set up priority for Tunnels established
> by draft-ietf-idr-tunnel-encaps-09 ?
>
>
>
> Hi Linda,
>
>
>
> I think Jeff is asking why not to use well known community to scope the
> blast radius of the advertisement.
>
>
>
> But personally I think this is pretty weak protection - if this would be
> the only protection against IPSec credential's hijack. IMO this needs to be
> protected a bit stronger such that even leak of the update will cause no
> harm or VPN compromise.
>
>
>
> Thx,
> R.
>
>
>
>
>
>
>
> On Mon, Jul 9, 2018 at 10:50 PM, Linda Dunbar <[e-mail]>
> wrote:
>
> Jeff,
>
>
>
> The answer to your question “Why would you want to build what you are
> trying to do into protocol?” is
>
> -        We want to use BGP to do more (i.e. use RR to distribute
> information injected from and by a controller). to eliminate dealing with
> the changes to NHRP/DSVPN.
>
>
>
> Can you elaborate the “the existing technology”?
>
>
>
> Linda
>
>