[Idr] Re: Deb Cooley's No Objection on draft-ietf-idr-bgp-ct-36: (with COMMENT)

[Deb Cooley <[e-mail]>]

Thanks for that.  Will you be clarifying that in the draft?

Deb

On Tue, Feb 18, 2025 at 3:26 PM Kaliraj Vairavakkalai <[e-mail]>
wrote:

> Hi Deb, thanks for the review. Please find responses inline KV>
>
>
>
> Thanks
>
> Kaliraj
>
>
>
> Juniper Business Use Only
>
> *From: *Deb Cooley via Datatracker <[e-mail]>
> *Date: *Tuesday, February 18, 2025 at 6:12 AM
> *To: *The IESG <[e-mail]>
> *Cc: *[e-mail] <[e-mail]>,
> [e-mail] <[e-mail]>, [e-mail] <[e-mail]>,
> [e-mail] <[e-mail]>, [e-mail] <[e-mail]>,
> [e-mail] <[e-mail]>, Balaji
> Rajagopalan <[e-mail]>, Reshma Das <[e-mail]>,
> Rajesh M <[e-mail]>, [e-mail] <[e-mail]>,
> [e-mail] <[e-mail]>,
> [e-mail] <[e-mail]>, [e-mail] <
> [e-mail]>, [e-mail] <
> [e-mail]>, [e-mail] <[e-mail]>,
> [e-mail] <[e-mail]>
> *Subject: *Deb Cooley's No Objection on draft-ietf-idr-bgp-ct-36: (with
> COMMENT)
>
> [External Email. Be cautious of content]
>
>
> Deb Cooley has entered the following ballot position for
> draft-ietf-idr-bgp-ct-36: No Objection
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to
> https://urldefense.com/v3/__https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/__;!!NEt6yMaO-gk!DgN8AvWntJClDUOVnJZLNgBrJ-CFph0kE1Wq57EnDz-GsXqJTesEE418ds2UWpvhCpAeYW_cpGYuyhs$
> <https://urldefense.com/v3/__https:/www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/__;!!NEt6yMaO-gk!DgN8AvWntJClDUOVnJZLNgBrJ-CFph0kE1Wq57EnDz-GsXqJTesEE418ds2UWpvhCpAeYW_cpGYuyhs$>
> for more information about how to handle DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
>
> https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-ietf-idr-bgp-ct/__;!!NEt6yMaO-gk!DgN8AvWntJClDUOVnJZLNgBrJ-CFph0kE1Wq57EnDz-GsXqJTesEE418ds2UWpvhCpAeYW_cyd7omV8$
> <https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-ietf-idr-bgp-ct/__;!!NEt6yMaO-gk!DgN8AvWntJClDUOVnJZLNgBrJ-CFph0kE1Wq57EnDz-GsXqJTesEE418ds2UWpvhCpAeYW_cyd7omV8$>
>
>
>
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
>
> Many thanks to Magnus Nyström for his three secdir reviews.
>
> Section 14, para 1:  The 'walled garden' approach is not mentioned anywhere
> else in the draft.  From the Yoav Nir's secdir review of the idr-bgp-car
> draft
> (where similar language was removed):
>
> KV> The walled garden is by virtue of using a new BGP Address-family (SAFI
> 76).
>
> KV> These routes stay in the part of network where the new address family
> is negotiated, and don’t leak out into the Internet, for e.g.
>
> KV> That is what we meant by walled garden.
>
>
>     " a) Does the security text provide an adequate description of the
> formation
>      of the "walled garden" via BGP TCP security, address considerations,
>      preventing DOS service attacks, and strong BGP security (BGP origin
> and
>      BGPsec).
>
> KV> It is by using a new address-family, and following RFC-8212 on EBGP
> boundaries.
>
>
>      b) does the security text provide an adequate description of how to
> detect
>      if traffic goes outside of the "walled garden"? "
>
> KV> By controlling the propagation of SAFI-76 routes, the traffic is kept
> confined to intended scope.
>
> KV> If routes are not accepted from a peer, traffic is not sent to the
> peer. So it is a control-plane level detection.
>
> KV> Thanks.
>