Re: [Idr] WGLC on draft-ietf-idr-as-private-reservation-00

[David Farmer <[e-mail]>]

I know the last call is over so ignore this if you wish;  However, I've 
been thinking about the issue of filtering private ASNs through out the 
discussion, but I hadn't identified what was bugging me until now.

Here are a couple quotes for some context;

On 11/29/12 13:10 , Jon Mitchell wrote:
> Any network can filter private ASNs as well as various other types of
> ASNs on ingress that they do not want to not accept/propogate.  This
> draft will have no impact on whether people tend to do that correctly or
> not in my opinion.  Folks who have no use for more than a thousand
> internal use ASNs today are not likely to use this new range.

On 11/30/12 14:15 , Brian Dickson wrote:>
 > If you see it on the Public Internet, it does not belong and can be
 > ignored safely, and should not be propagated to one's Internet
 > peers/customers.

But several others have made similar comments as well.

This is basically covered in Section 3 "Operational Considerations" in 
the draft.  Here is what it says now;

    If private use ASNs are used and prefixes are originated from these
    private use ASNs which are destined to the Internet, private use ASNs
    must be removed from the AS_PATH before being advertised to the
    global Internet.  Operators are cautioned to ensure any filters or
    implementation specific features that recognize private use ASNs have
    been updated to recognize both ranges prior to making use of the
    newer, numerically higher range of private use ASNs.

I like that this says "private use ASNs must be removed from the AS_PATH 
before being advertised to the global Internet."  However, it finally 
hit me that in the quotes above, and in others as well, we have said "if 
you see private use ASNs on the global Internet you can filter them." 
But, this is only implied by the text in section 3, not explicitly 
stated.  So, I suggest that section 3 also explicitly state that 
operators may filter private use ASNs they receive from the global 
Internet.

So here is some suggested text.

    Operators may drop or disregard any prefix received from the global
    Internet that is originated from or that contains a private use ASN
    in the AS_PATH.  This may result in unpredictable connectivity for
    any prefix originated from or containing a private use ASN in the
    AS_PATH.  Therefore, all operators using private use ASNs to
    originate prefixes or passing an AS_PATH that contains private use
    ASNs to the global Internet, must remove all private use ASNs from
    the AS_PATH before being advertised to the global Internet.
    Furthermore, operators are cautioned to ensure any filters or
    implementation specific features that recognize private use ASNs
    have been updated to recognize both ranges prior to making use of
    the newer, numerically higher range of private use ASNs.

Again the intent of the change is to explicitly state operators can 
filter any prefixes received from the global Internet that uses private 
use ASNs.  In addition to stating you must not send the to the global 
Internet in the first place.

Thanks

-- 
================================================
David Farmer               Email: [e-mail]
Office of Information Technology
University of Minnesota
2218 University Ave SE     Phone: [phone]
Minneapolis, MN 55414-3029  Cell: 1-612-812-9952
================================================