[Idr] Question about draft-hujun-idr-bgp-ipsec-02 ( was RE: 2 Week WG adoption call draft-hujun-idr-bgp-ipsec-02.txt and draft-hujun-idr-bgp-ipsec-transport-mode-00 (3/30 to 4/13/2020

[Linda Dunbar <[e-mail]>]

Jun,

Need a few clarify questions for your draft.


  1.  Does  draft-hujun-idr-bgp-ipsec-02 assume that IKEv2 still running between IPsec peers?


  1.  Does receiving the IPsec BGP UPDATE triggers a node to start the  IKEv2 with the speaker without any configuration from the administer? If Node B can only establish IPsec IKEv2 with another node C, does it matter if the Node B receives or not receives the BGP update from the C?
  2.  How does the BGP UPDATE ease the IPsec configuration? Does  it ease the configuration on the BGP UPDATE speaker? Or does it ease the configuration of the receiver?
  3.  How to differentiate  Public Routing Instances?
If the payload packet within the IPsec tunnel are simple IP forwarding, is there still "Private Routing Instances"?


  1.  On Page 3, the draft states that only "Local Tunnel Endpoint address, Public Routing Instance and CHILD SA traffic selector address range" are advertised by the BGP.
Is the Local Tunnel Endpoint address same as the LOOPBACK address of the node? Or can be a specific Ingress or egress port of the node sending out the BGP UPDATE?


Thank you very much.

Linda Dunbar

From: Idr <[e-mail]> On Behalf Of Susan Hares
Sent: Monday, March 30, 2020 7:07 AM
To: 'IDR List' <[e-mail]>
Subject: [Idr] 2 Week WG adoption call draft-hujun-idr-bgp-ipsec-02.txt and draft-hujun-idr-bgp-ipsec-transport-mode-00 (3/30 to 4/13/2020

This begins a 2 week WG adoption call for  two drafts BGP provisioned IPSEC infrastructure

1) draft-hujun-idr-bgp-ipsec-02.txt:
BGP Provisioned IPSEC Tunnel Configuration

https://datatracker.ietf.org/doc/draft-hujun-idr-bgp-ipsec/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-hujun-idr-bgp-ipsec%2F&data=02%7C01%7Clinda.dunbar%40futurewei.com%7Cdb1e68b21c294ff7e40f08d7d4a2e5e4%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C637211668440594288&sdata=HRHfVUUOy0a1ofnIzfTM4zsBqzZCGEhyMEopPdtEdyI%3D&reserved=0>

2) draft-hujun-idr-bgp-ipsec-transport-mode-00.txt:
BGP Provisioned IPsec Transport Mode Protected Tunnel Configuration

https://datatracker.ietf.org/doc/draft-hujun-idr-bgp-ipsec-transport-mode/<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-hujun-idr-bgp-ipsec-transport-mode%2F&data=02%7C01%7Clinda.dunbar%40futurewei.com%7Cdb1e68b21c294ff7e40f08d7d4a2e5e4%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C637211668440604245&sdata=XROXZN5YTy5GQEToYyAkFNHx71%2B%2FXnln1QJjMzeRQ6I%3D&reserved=0>

These drafts were presented at IETF 104 and IETF 105.
At IETF 105, there was a detailed discussion on the security issues.
After IETF 105, the author modified his draft to take care of the
Issues mentioned.

Discussion during the WG Adoption should examine:
1) Has this draft addressed the necessary security issues to
    be adopted as IDR WG draft?

2) Is this useful generic IPSEC functionality for networks?

   The EVPN related to IPSEC continues in BESS.
   This draft is considered here as a general feature.

3) Are there any deployments of this draft?


Stay safe and healthy... Sue