Re: [Idr] update proposal to draft-ietf-idr-rfc5575bis-14

[Robert Raszuk <[e-mail]>]

Hey Jakob,

I am assuming he is using MPLS fabric for a reason ... One most likely
reason could be L3VPN :) Otherwise what would be the point to use MPLS to
start with ? Basic hierarchical routing ? And even for L3VPN MPLS in
transport layer. It is also not needed for isolating underlay from overlay
tenants routes.

Regardless as you know RTs do apply for any SAFI not just 128.

The only point is sort of automation to router_id filtering ... I guess an
implementation can support it for any SAFI as well with an extra knob. That
would not be specific to flow-spec by just a vendor's local enhancement.

As you know FlowSpec's main role was to prevent DDoS. With that you never
know on which ASBR your distributed attacks arrive so pushing filters to
only subset of them is a questionable. If you have 10s or 100s of ASBRs you
would need now to apply long list of matching RTs.

The solution is not backwards compatible as current routers unless upgraded
with new knob would accept all filters anyway. I hope no one wants this to
be active by default as it would kill RFC5575 and turn FlowSpec to NetConf.

If you want to limit the filters only to ASBRs maybe some more generic RT
needs to be defined - say "apply only on EBGP speakers" ?

Overall abuse of FlowSpec seems to continue. P2MP distributed nature of BGP
propagation keeps being used as P2P config push protocol. I am just not
sure when such use cases will stop popping up left and right.

Best,
R.


On Thu, May 9, 2019 at 10:52 PM Jakob Heitz (jheitz) <[e-mail]>
wrote:

> Robert,
>
>
>
> Section 8 applies to VPNv4 flow spec.
>
>
>
> I see two differences in Ercin's proposal.
>
> First, it is for IP Flow Spec, rather than for VPN
>
> Second, the IPv4 address in the RT matches with the router-id.
>
> This avoids the requirement to allocate and manage another identifier to
> match the RT.
>
> that is an operational advantage.
>
>
>
> I support Ercin's proposal.
>
>
>
> Regards,
>
> Jakob.
>
>
>
> *From:* Idr <[e-mail]> *On Behalf Of * Robert Raszuk
> *Sent:* Thursday, May 9, 2019 9:38 AM
> *To:* ERCIN TORUN <[e-mail]>
> *Cc:* [e-mail]
> *Subject:* Re: [Idr] update proposal to draft-ietf-idr-rfc5575bis-14
>
>
>
> Hi Ercin,
>
>
>
> What you are asking/proposing has been standardized in the original
> RFC5575 already many years ago.
>
>
>
> Please see section 8 specifically this paragraph:
>
>
>
>    Propagation of this NLRI is controlled by matching Route Target
>
>    extended communities associated with the BGP path advertisement with
>
>    the VRF import policy, using the same mechanism as described in "BGP/
>
>    MPLS IP VPNs" [RFC4364 <https://tools.ietf.org/html/rfc4364>] ..
>
>
>
> Thx,
> Robert.
>
>
>
>
>
> On Thu, May 9, 2019 at 2:04 PM ERCIN TORUN <[e-mail]>
> wrote:
>
> Hello All,
>
>
>
> My name is Ercin TORUN <https://tr.linkedin.com/in/ercintorun> and I’m
> working in Turkcell Turkey (35M-mobile/2M-fixed customer, +digital
> services) as an IP/MPLS Network Planning Engineer.  I would like to propose
> an update to draft-ietf-idr-rfc5575bis-14
> <https://tools.ietf.org/html/draft-ietf-idr-rfc5575bis-14>.
>
>
>
> By default all flowspec entries (filters..) are applied to all routers,
> and unnecessary application of many filters can easily owerwhelm the
> capacity of routers resources (e.g. TCAM). We are pushing layer3 to the
> edges with solutions like seamless-mpls or leaf-spine next-generation DC
> topologies which widens the layer3 domain easily over thousands of devices.
> It is best to filter “dirty” traffic where it first enters a network. There
> are ways to accept BGP announcements only on the targeted router, like
> defining a community for each router and configuring policies, but an
> automated way would be much more easier and less error-prone. Our idea is
> using a route-taget to match with BGP Identifier so that only the targeted
> router might accept the announcement.
>
>
>
> All in all, I propose to add below text to draft-ietf-idr-rfc5575bis-14
> <https://tools.ietf.org/html/draft-ietf-idr-rfc5575bis-14>
>
>
>
> “   In a common use case, it is necessary to apply a filter to one or a
> few
>
>    routers and to apply many different filters to many different routers.
>
>    By default, all filters are applied to all routers. In this use case,
>
>    the unnecessary application of the many filters can easily overwhelm
>
>    the capacity of the routers. To simplify this use case,
>
>    route-targets may be used to apply the filters to only the needed
> routers:
>
>
>
>    If one or more IPv4-Address-Specific route-targets are present, then
>
>    the IPv4 address of at least one route-
>
>    target MUST match one of the BGP Identifiers of the receiver in order
>
>    for the update to be accepted.
>
> “
>
>
>
> Regards
>
> Erçin TORUN
>
>
>
> <http://turkcell.li/iyaani>
>
> Bu elektronik posta ve onunla iletilen butun dosyalar sadece gondericisi
> tarafindan almasi amaclanan yetkili gercek ya da tuzel kisinin kullanimi
> icindir. Eger soz konusu yetkili alici degilseniz bu elektronik postanin
> icerigini aciklamaniz, kopyalamaniz, yonlendirmeniz ve kullanmaniz
> kesinlikle yasaktir ve bu elektronik postayi derhal silmeniz gerekmektedir.
>
> TURKCELL bu mesajin icerdigi bilgilerin doğruluğu veya eksiksiz oldugu
> konusunda herhangi bir garanti vermemektedir. Bu nedenle bu bilgilerin ne
> sekilde olursa olsun iceriginden, iletilmesinden, alinmasindan ve
> saklanmasindan sorumlu degildir. Bu mesajdaki gorusler yalnizca gonderen
> kisiye aittir ve TURKCELLin goruslerini yansitmayabilir
>
> Bu e-posta bilinen butun bilgisayar viruslerine karsi taranmistir.
> ------------------------------
>
> This e-mail and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they are
> addressed. If you are not the intended recipient you are hereby notified
> that any dissemination, forwarding, copying or use of any of the
> information is strictly prohibited, and the e-mail should immediately be
> deleted.
>
> TURKCELL makes no warranty as to the accuracy or completeness of any
> information contained in this message and hereby excludes any liability of
> any kind for the information contained therein or for the information
> transmission, reception, storage or use of such in any way whatsoever. The
> opinions expressed in this message belong to sender alone and may not
> necessarily reflect the opinions of TURKCELL..
>
> This e-mail has been scanned for all known computer viruses.
>
> _______________________________________________
> Idr mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/idr
>
>