IETF Logo Mail Archive

Re: [Idr] Securing BGP sessions (Issue#41)

"Acee Lindem (acee)" <acee@cisco.com> Wed, 11 December 2019 01:10 UTC

Return-Path: <acee@cisco.com>
X-Original-To: idr@ietfa.amsl.com
Delivered-To: idr@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 762801201AA for <idr@ietfa.amsl.com>; Tue, 10 Dec 2019 17:10:15 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.5
X-Spam-Level:
X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=lUTRYHxS; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=Navwv2b5
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hcDduiON227i for <idr@ietfa.amsl.com>; Tue, 10 Dec 2019 17:10:13 -0800 (PST)
Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3477F1207FC for <idr@ietf.org>; Tue, 10 Dec 2019 17:10:13 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2116; q=dns/txt; s=iport; t=1576026613; x=1577236213; h=from:to:subject:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version; bh=RA0qydIP7Y3X9eH+ZeWCL3VHBYVkP+VkB0Fnyc4BHi0=; b=lUTRYHxSz0+jUnbe4lfJzPssizITmmxYAhU3ZnDjmTVBc9nzn+UItjuA 20gapg/LfHLWGkMkHGnlAe03QqrBj36Boe7uJ+WRSPWmNYLst4z/vXBhp COnYgoVL3SYsDlTPNHuLYvqba0jEUkw7YRCuTYuGyaP1Z1zpX8XdFPaPw A=;
IronPort-PHdr: 9a23:t4Q3oBKcHtov2Gx7gNmcpTVXNCE6p7X5OBIU4ZM7irVIN76u5InmIFeCuKd2lFGcW4Ld5roEkOfQv636EU04qZea+DFKa5lQT1kAgMQSkRYnBZuMAkD2BPXrdCc9Ws9FUQwt8g==
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0AKAQBmQfBd/4QNJK1lHAEBAQEBBwEBEQEEBAEBgWwFAQELAYFKUAVsWCAECyqEA4NGA4sIToFsigCOK4EugSQDVAkBAQEMAQEYCwoCAQGEQAIXgWwkNgcOAgMNAQEEAQEBAgEFBG2FNwyFXwIBAwEBEBERDAEBLAwPAgEIDgwCJgICAh8GCxUQAgQBEiKDAAGCRgMuAQIMokYCgTiIYXWBMoJ+AQEFgkqCVw0LghcDBoEOKAGMFxqCAIE4DBSCTD6CG0kBAYFjgxAygiyNKIMAnX1DCoIvkVCEIBuaO45Kil+PVQIEAgQFAg4BAQWBWQ0lgVhwFTsqAYJBUBEUjGYNFoNQhRSFPgF0gSiOBgEB
X-IronPort-AV: E=Sophos;i="5.69,301,1571702400"; d="scan'208";a="681688957"
Received: from alln-core-10.cisco.com ([173.36.13.132]) by rcdn-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 11 Dec 2019 01:10:11 +0000
Received: from XCH-ALN-001.cisco.com (xch-aln-001.cisco.com [173.36.7.11]) by alln-core-10.cisco.com (8.15.2/8.15.2) with ESMTPS id xBB1AAxD008772 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 11 Dec 2019 01:10:10 GMT
Received: from xhs-aln-003.cisco.com (173.37.135.120) by XCH-ALN-001.cisco.com (173.36.7.11) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 10 Dec 2019 19:10:10 -0600
Received: from xhs-aln-001.cisco.com (173.37.135.118) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 10 Dec 2019 19:10:09 -0600
Received: from NAM02-BL2-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-001.cisco.com (173.37.135.118) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 10 Dec 2019 19:10:09 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=hYT+KQkBkhU4CfVaTkbCmCg8zcnELyuKimd2mr6l5NWzI1R3a6TMgyJhdTvutwAGZRpL2PSd5ot1xAXigUkh7CDASjMArkWFD/uAivUjHAV6eBP3MRbhCm1CWfvPn9Qx1l76iCqk+RAQ+CjZ8AflPrnDUGXIw+WdexmKviBmf6U1V8Tj5r8LO+0gdy1YrCMUhk+FpXJ45nfQMjsdgLsWK3lkxgTTo3xTWNVtGw6Cun4F8jgUmmQWBMbk9gbSc3HfovSLn/RwD42ghSxGJpfi1d9+P9JMDQNCbpgdv1+TO5lWUkc4g0jI33Nmxv1sd9EyA2CIwPYFYdsXOosqvWJ5cQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RA0qydIP7Y3X9eH+ZeWCL3VHBYVkP+VkB0Fnyc4BHi0=; b=H0u8u+Tt7bmOjQbYA+r64xed7cf4PuYKSRbPwkZ30nXLau40aPw/McW83k7b+Ad/fNbo6IodLzcDLRwiRwnlSPsVwySwXidscD/y4JT3+6ppDiMYliY4V1+3snF209YJejYBKnf+ztHn3+fia+HiGeeKttSJRd929sMjhvKrpsO0miJcUx/rxPPX3+tAwW4DAk6qCB7lmvMP4j6YtDuaDORxHhU4scj2CxyAGPKrp5KscS4n8bgiiFF5XdViyfTu+9r3aYwVjhwcpCkZfOoYBBvXdXpXgEkW5BrL39xk1x51uybPl82Eqy8KIiXj27qwC8eE4xI/YAbjyap3PAM+2A==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RA0qydIP7Y3X9eH+ZeWCL3VHBYVkP+VkB0Fnyc4BHi0=; b=Navwv2b5N8160gClrOWjR4n0EqGpstkM8dJ7xxGHfi8sUf2sa4dYY14wXGWjO5iB/FsV9lg40EmdnnnkDIfWNB0pSQLxMnc/Kugfy+f0HPS1rEuVBzRqehcIl1Re1AZAdoXyiiz9FpjwdSzLEC+rhWDJdkAilyeUzkohyrQ8RRE=
Received: from MN2PR11MB4221.namprd11.prod.outlook.com (52.135.38.14) by MN2PR11MB4301.namprd11.prod.outlook.com (52.135.36.222) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2516.16; Wed, 11 Dec 2019 01:10:09 +0000
Received: from MN2PR11MB4221.namprd11.prod.outlook.com ([fe80::218b:2d04:e653:105]) by MN2PR11MB4221.namprd11.prod.outlook.com ([fe80::218b:2d04:e653:105%7]) with mapi id 15.20.2516.018; Wed, 11 Dec 2019 01:10:08 +0000
From: "Acee Lindem (acee)" <acee@cisco.com>
To: Mahesh Jethanandani <mjethanandani@gmail.com>, "idr@ietf.org" <idr@ietf.org>
Thread-Topic: [Idr] Securing BGP sessions (Issue#41)
Thread-Index: AQHVr7rd/5qGVW58hUml+zqJVoppf6ezzC0A
Date: Wed, 11 Dec 2019 01:10:08 +0000
Message-ID: <68B00DBF-3590-4ECE-8028-301643B9E49E@cisco.com>
References: <D9C310C0-89C6-4CB5-80A2-98C274581E7F@gmail.com>
In-Reply-To: <D9C310C0-89C6-4CB5-80A2-98C274581E7F@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=acee@cisco.com;
x-originating-ip: [2001:420:c0c8:1001::3df]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: f94e2394-078d-4af3-5a36-08d77dd6dd91
x-ms-traffictypediagnostic: MN2PR11MB4301:
x-microsoft-antispam-prvs: <MN2PR11MB4301BE00D1315D3812BA5266C25A0@MN2PR11MB4301.namprd11.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-forefront-prvs: 024847EE92
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(396003)(39860400002)(366004)(376002)(346002)(199004)(189003)(966005)(5660300002)(6512007)(110136005)(316002)(81156014)(81166006)(2616005)(186003)(8676002)(86362001)(2906002)(33656002)(6506007)(6486002)(71200400001)(8936002)(478600001)(76116006)(66446008)(91956017)(64756008)(66556008)(66946007)(36756003)(66476007); DIR:OUT; SFP:1101; SCL:1; SRVR:MN2PR11MB4301; H:MN2PR11MB4221.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: Im8/X9MgUmy6aTIVDYVzZZJqsM79jXMcwgmW9j+loS4QHHdG1/V7OgU1DQunlikcaMM4JidenNf5zb7aDUbRZecNNxJlNyzqU8emLRoeJLuI5dOMNHKFMVFOQH2JRQl7T3QCpR+qXlDYk7BuEnPMcyW9r1EtC+LD06qZzhM3ZgKapQSL28Pl09o9kj4aZDG5UuhZqWVxGbx43WBYPI27+erSFzTbxAMuzAIKkCU7usqqvVC17lXgQZV6O0Pybc8EZ/fY9CdpJVJRuTGS65WHHaVBaxFc/G4kEfYPK3bHyOjNGlTbqQOYd/dpYUtTRjFYdrPsZEnUSk2BfzyxCP0en6wrMagQnBNSX+IpHi7y3tuhaJHeRKZCTa8oiG3D+oFSzpbsrx2RCktTVF0nTK4aP2KYIfgdP6ASdodqACWFsYOpRFyIG4F3hTy44X8qnfPgsA2dOEJt0GYI2eNKG7ZgnDGfSFogIjH8B2cMbz36aPQ=
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="utf-8"
Content-ID: <1472CFB97A18D94C9C6817F454853662@namprd11.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: f94e2394-078d-4af3-5a36-08d77dd6dd91
X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Dec 2019 01:10:08.8959 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 4CbbHoT8dHwquW8Q4UA72Qh0PTCYjgjIOAaevWlxa1QoI8StUbPtrvWwDqel7yTn
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4301
X-OriginatorOrg: cisco.com
X-Outbound-SMTP-Client: 173.36.7.11, xch-aln-001.cisco.com
X-Outbound-Node: alln-core-10.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/idr/6wAWPBiQoSgrpSweeWVfiHhq6Xc>
Subject: Re: [Idr] Securing BGP sessions (Issue#41)
X-BeenThere: idr@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Inter-Domain Routing <idr.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/idr>, <mailto:idr-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/idr/>
List-Post: <mailto:idr@ietf.org>
List-Help: <mailto:idr-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/idr>, <mailto:idr-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 11 Dec 2019 01:10:15 -0000

Hi Mahesh, 
I assume by IPsec, you mean transport mode IPsec. For IPsec protection of BGP, where are the details specified? 
Thanks,
Acee

On 12/10/19, 7:35 PM, "Idr on behalf of Mahesh Jethanandani" <idr-bounces@ietf.org on behalf of mjethanandani@gmail.com> wrote:

    This is the second thread in the list of issues that were discussed in IETF 106 w.r.t. to BGP YANG model. This particular thread is to discuss the issue of defining how BGP sessions are going to be secured.
    
    As stated in Singapore, the model is being defined to secure BGP sessions using 
    - TCP AO
    - TCP MD5
    - IPSec
    
    In case there was a question of why MD5, it is because there are existing implementations that are choosing to stay with MD5, regardless of the issues that have been raised about MD5. The model therefore has to support such implementations.
    
    The model will use the ietf-key-chain model’s (RFC 8177) key-chain-ref to refer to an instance of the key chain. By doing that it will make use of the key rollover capability defined in that model, and for static key configuration by setting the end time to infinite in the key chain. The BGP model will leave the case of IPSec as TBD for now, and fill it when/if the IPSec YANG model is defined.
    
    Questions/Concerns?
    
    Mahesh Jethanandani
    mjethanandani@gmail.com
    
    
    
    _______________________________________________
    Idr mailing list
    Idr@ietf.org
    https://www.ietf.org/mailman/listinfo/idr

v2.23.0 | Report a Bug | By Email