Re: [Idr] IETF LC for IDR-ish document <draft-ietf-grow-bgp-reject-05.txt> (Default EBGP Route Propagation Behavior Without Policies) to Proposed Standard

[Jared Mauch <[e-mail]>]

On Tue, Apr 25, 2017 at 12:15:34PM +0200, Mikael Abrahamsson wrote:
> On Tue, 25 Apr 2017, [e-mail] wrote:
> 
> > If the problem is route leak (which is indeed a problem to solve):
> > - draft-ietf-grow-bgp-reject is unfortunately not a solution to route leak.
> 
> Errr... It's a solution to ONE huge glaring reason for some route leaks.
> 
> > There is nothing to check/unsure that the route advertised/received are
> > the "right" ones.
> 
> The problem draft-ietf-grow-bgp-reject tries to solve is when lack of config
> means you're announcing ALL your routes. So yes, you're technically correct,
> but I don't see the relevance.
> 
> > So if the problem is route leak, draft-ymbk-idr-bgp-open-policy seems a better solution to me.
> 
> It's not even an WG document. When will it be done?
> draft-ietf-grow-bgp-reject is short, concise and to the point, and easily
> understandable and can be adopted quickly.
> 
> > Eventually, it could include some idea from draft-ietf-grow-bgp-reject.
> > .e.g.  by introducing a "semi-strict mode" or "safe mode": if set, and
> 
> The whole problem draft-ietf-grow-bgp-reject tries to solve is that people
> are leaking routes WITHOUT SETTING ANYTHING. They're just creating the
> neighbor and then *boom* entire BGP table is sent.

	In private at least one vendor has now conceded this is a bad thing
and is trying to fix it, that's progress.

	I'm looking forward to when BGP starts as secure out of the box
as many other protocols, such as SMTP, etc.

	- Jared

-- 
Jared Mauch  | pgp key available via finger from [e-mail]
clue++;      | http://puck.nether.net/~jared/  My statements are only mine.