Re: [Idr] New draft submitted: draft-loibl-bacher-idr-flowspec-clarification

Robert,

                Makes sense..

Thanks,
                Jim Uttaro

From: rraszuk@gmail.com [mailto:rraszuk@gmail.com] On Behalf Of Robert Raszuk
Sent: Tuesday, August 23, 2016 10:28 AM
To: UTTARO, JAMES <ju1738@att.com>
Cc: Christoph Loibl <c@tix.at>; idr@ietf.org
Subject: Re: [Idr] New draft submitted: draft-loibl-bacher-idr-flowspec-clarification

Hey Jim,

Indeed I alluded to your and others contributions to generalize flowspec when I mentioned the intra-domain case. Even putting aside SDN use cases there still can be valid DDoS filters injected centrally - hence my comment.

For your point however I (*still*) think it would be much easier and simpler to put all SDN and related work into Flowspec_v2 and run in in different SAFI. Yourself, Sue and bunch of other people are actively helping with. That v2 spec may have completely different validation rules or not have them at all assuming validation happens on controller only.

IMHO mixing both quite separate use cases will not help each other at all deployment wise - even if both deployment models are very valid. The reason being that what knobs work for one flowspec NLRIs for the other could turn to be harmful. So if we do not separate them and someone would like to use both it will get pretty ugly soon.

Cheers,
R.

On Tue, Aug 23, 2016 at 4:13 PM, UTTARO, JAMES <ju1738@att.com<mailto:ju1738@att.com>> wrote:
Christoph,

        One could also us flow-spec as a mechanism to disseminate flow-spec "filters" via an SDN controller. I am my co-authors specified changes to the validation procedure such that the unicast route is not required for a router to accept and program the slow-spec path/filter.  When reading through the draft it seems to assume that flow-spec is only used as originally intended this is not the case. IMO this is a good piece of work and it should broaden the scope to include how flow-spec can be used from an SDN Controller.. There are other challenges with the draft as originally written

- Order of Traffic Filtering Rules
- More specific unicast routes
- AS value position in the AS-Path

Here is the draft..

https://tools.ietf.org/html/draft-ietf-idr-bgp-flowspec-oid-03

Jim Uttaro

-----Original Message-----
From: Idr [mailto:idr-bounces@ietf.org<mailto:idr-bounces@ietf.org>] On Behalf Of Christoph Loibl
Sent: Tuesday, August 23, 2016 8:09 AM
To: idr@ietf.org<mailto:idr@ietf.org>
Subject: [Idr] New draft submitted: draft-loibl-bacher-idr-flowspec-clarification

Hi,

We submitted a new draft and are happy to receive feedback:

Since interoperability is key to an flowspec Internet deployment we tried to clarify the ambiguous parts of the flowspec RFC 5575 in order to allow a consistent implementation by equipment vendors.

Title: draft-loibl-bacher-idr-flowspec-clarification

https://datatracker.ietf.org/doc/draft-loibl-bacher-idr-flowspec-clarification/

The reason for this draft submission is, that we recently performed a rather large flowspec interop test (the main goal was to evaluate possible inter-AS flowspec scenarios in a multi vendor environment) and discovered many bugs and vendor interop problems that we want to solve.

Unfortunately we currently cannot share all our findings in a test report, because we hit some serious bugs that have (under circumstances) potential to remotely melt down entire networks and are working with the vendors to get bugs fixed.

Christoph

--
Christoph Loibl
c@tix.at<mailto:c@tix.at> | CL8-RIPE | PGP-Key-ID: 0x4B2C0055 | http://www.nextlayer.at
_______________________________________________
Idr mailing list
Idr@ietf.org<mailto:Idr@ietf.org>
https://www.ietf.org/mailman/listinfo/idr