Re: [Idr] Returning draft-ietf-idr-rfc5575bis to WG, new 2 week discussion period

[Robert Raszuk <[e-mail]>]

> Juniper's implementation doesn't do useful things when the dest-prefix is
absence and validation is on.

I would classify this as deployment misconfiguration.

If you are using flow spec for other then DDoS use cases you should disable
validation.

Thx,
R.


On Fri, Jun 14, 2019 at 5:46 PM Jeffrey Haas <[e-mail]> wrote:

> On Thu, Jun 13, 2019 at 11:54:22PM +0200, Christoph Loibl wrote:
> > I have no lab at hand (now) - but I am really curios how ie. Juniper
> (also
> > other vendors) actually validate FS without a destination-prefix
> component
> > (to be honest, I never tried this - but it is supposed to be easily
> > verified).
>
> I will somewhat coyly note that John's text does not come out of pure
> protocol pedantry. :-)
>
> Juniper's implementation doesn't do useful things when the dest-prefix is
> absence and validation is on.  This was noted during some internal testing.
> When we were approached for "what should we do, it's not in the spec", the
> proposed text arose out of internal discussion. (Including "well, it's
> effectively 0/0.)
>
> The pedantic behavior would be to say "it's 0/0", but it leads to the
> "originate default" as an answer.  This is not behavior we'd operationally
> encourage and thus we are having this discussion.
>
> -- Jeff
>