Re: [Idr] I-D Action: draft-ietf-idr-large-community-01.txt

["Jakob Heitz (jheitz)" <[e-mail]>]

Tom

I understand your issue and I believe every major router vendor
does too.

What to do about it?

The router cannot check if the first word is a valid ASN
or if the ASN is the intended one. Even if the ASN is correct,
The rest of the community could still be junk.

A router vendor can provide tools to make it easier
for operators to be safe with communities, large or regular.

For example, there is a knob 'send-community' that must be
configured before a router will send communities on an ebgp
session. Therefore, an operator who is unaware of the problem
will not spray junk. Another tool is the 'peeras' keyword
that allows you to match the peer's ASN in any field of
the community. This makes it easier to write generic filters
in RPL. Excuse me if I'm tooting my own horn, but I do not
believe that this funcionality is unique to Cisco.
You can match private ASN and your own ASN too.

If anyone can suggest more tools, please do.

Thanks,
Jakob.


> -----Original Message-----
> From: Idr [mailto:[e-mail]] On Behalf Of t.petch
> Sent: Thursday, October 13, 2016 1:55 AM
> Julian
> 
> I believe I understand the need that you express but the BGP protocol
> does not have the mechanics to express it!
> 
> You say
> 'configure with meaning only for me and parties I interact with'
> but BGP has no such mechanism. As Jeff has already explained, an
> optional attribute either gets dropped, which is unlikely to work with
> route reflectors, or it gets passed on and this I-D chooses the option
> that it gets passed on.  So a community that only you and your fellow
> parties understand is let loose on the whole Internet where it is open
> to misinterpretation by everyone else because, e.g., they are expecting
> an ASN and are getting something else that is private to you.
> 
> And the remit of the IETF is to make the Internet as a whole work better
> so in updating the specification of BGP, the IETF has to consider the
> trade off of something that benefits you and the parties you interact
> with versus the risk of causing some level of damage to the Internet.
> 
> Obviously, I hope, I am concerned about the damage; you gain, but
> somewhere else across the globe, someone else's connectivity may fail.
> 
> Of course it is possible to define a more sophisticated system that
> allows communities to go so far and no further but that is not the BGP
> we have.
> 
> Tom Petch