Re: [Idr] Vendor Defaults (was Re: Review of draft-ietf-large-community-06.txt)

"Jakob Heitz (jheitz)" <> Sun, 06 November 2016 23:25 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 19AD7129A68 for <>; Sun, 6 Nov 2016 15:25:55 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -16.018
X-Spam-Status: No, score=-16.018 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-1.497, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id C3OKiwR2-9Cq for <>; Sun, 6 Nov 2016 15:25:54 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id EC5F1129A6B for <>; Sun, 6 Nov 2016 15:25:53 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;;; l=1098; q=dns/txt; s=iport; t=1478474753; x=1479684353; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=mDn8Hui9Lb4AfYGqRX/gCsMahTtCJs4FoDuSlKYTcPA=; b=ZpTdy87rhA2oj/V+SCaYlBNjquqJ24sOu9LrzKqOEpRWRK0GhhhSS0pr curxE8FINLNh2SR7cQdgKcN8urcBn6Rugl+RlVd1e8So+dgPvRNykDOze BlJzvG+uQstQtyDMLyqt93J1nlKTEcTiB22ToJgZbDZOdPWRrJOfMUgfu 4=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DJAQCyux9Y/49dJa1dGwEBAQMBAQEJA?= =?us-ascii?q?QEBgy4BAQEBAR+PDKtSggiGJAKCCT8UAQIBAQEBAQEBYh0LhGIBAQQ6TwIBCDY?= =?us-ascii?q?QMiUCBCeIRLMMizsBAQEBAQEBAQEBAQEBAQEBAQEBHoY+gX0IglCER4Mxgi8Fm?= =?us-ascii?q?icBkEOQEJEvAR43eoUqiG8BAQE?=
X-IronPort-AV: E=Sophos;i="5.31,603,1473120000"; d="scan'208";a="166260628"
Received: from ([]) by with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Nov 2016 23:25:28 +0000
Received: from ( []) by (8.14.5/8.14.5) with ESMTP id uA6NPSBs031490 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL) for <>; Sun, 6 Nov 2016 23:25:28 GMT
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.1210.3; Sun, 6 Nov 2016 17:25:28 -0600
Received: from ([]) by ([]) with mapi id 15.00.1210.000; Sun, 6 Nov 2016 17:25:28 -0600
From: "Jakob Heitz (jheitz)" <>
To: "" <>
Thread-Topic: [Idr] Vendor Defaults (was Re: Review of draft-ietf-large-community-06.txt)
Thread-Index: AQHSN546iba0WaPSYk6woE67Sz8aq6DLBUg9gAHyDwD//6OKGg==
Date: Sun, 6 Nov 2016 23:25:27 +0000
Message-ID: <>
References: <> <>, <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-transport-fromentityheader: Hosted
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <>
Subject: Re: [Idr] Vendor Defaults (was Re: Review of draft-ietf-large-community-06.txt)
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Inter-Domain Routing <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 06 Nov 2016 23:25:55 -0000

The question:
Should Large Communities be transmitted across EBGP by default?

Note: there is a knob to change the default, so the discussion is how to act with the knob unconfigured.

Arguments to block:
1. Principle of least surprise: Do same as 1997.
2. Accidental leakage of internally used communities will cause unintended routing.

Arguments to pass:
1. Legacy code will pass it, because the attribute is transitive. Upgrade to LC aware code should do the same by default.
2. It is convenient to pass a community through your first level transit to fix a problem further upstream. A default block frustrates this effort.

The problem of accidental leakage is greater with 1997 communities, because many ISPs use private ASNs. This is as problem if a community intended for a distant ISP is interpreted by a near ISP when they use the same private ASN. This problem SHOULD disappear with Large Communities, because the need to use private ASNs no longer exists.

I would like to hear other arguments and gauge support for each case.