Re: [Idr] [[e-mail]: I-D Action: draft-haas-idr-extended-experimental-00.txt]

[Jeffrey Haas <[e-mail]>]

> On Nov 7, 2016, at 1:15 PM, John G. Scudder <[e-mail]> wrote:
> 
> 
>> On Nov 7, 2016, at 10:26 AM, Jeffrey Haas <[e-mail]> wrote:
>> 
>> Marco,
>> 
>> On Sun, Nov 06, 2016 at 08:23:36PM +0100, Marco Marzetti wrote:
>>> On Tue, Nov 1, 2016 at 7:58 PM, Jeffrey Haas <[e-mail]> wrote:
>>> 
>>>> 
>>>> A feature such as this one, perhaps extended with a per-attribute form of
>>>> draft-ietf-idr-bgp-attribute-announcement along with enough information to
>>>> figure out when filtering wasn't done could provide some safety.
>>>> 
>>>> The related changes to this proposal would be to simply add the 4-octets of
>>>> the attribute announcement scoping and potentially the attaching AS.
>>>> However, given even such vendor features are likely to need to work in an
>>>> inter-as fashion, generating scopes of containment become tricky.
>>>> 
>>>> 
>>> I have always wondered if we should add and N bit to
>>> draft-ietf-idr-bgp-attribute-announcement to limit the advertisements to
>>> neighbor ASes only.
>> 
>> Such a thing was discussed among the authors of the attribute-announcement
>> draft.  What this would mean is such a bit would need to be set and then
>> automatically reset into the M-bits (C+A) at the next boundary.
> 
> I'll also observe that we already have the NO_EXPORT community which has virtually the same semantics if you apply it as you're sending the route to your peer. And then there was AS_PATHLIMIT, which never achieved escape velocity. Regarding NO_EXPORT, you might remark that you have to apply it at your border router instead of at the origin, and that's true, but I'm not sure if it's a big deal. You might also remark that NO_EXPORT doesn't survive if your neighbor strips inbound communities (or explicitly blows away NO_EXPORT), and that's true too -- but if operators are deliberately dishonoring NO_EXPORT, is there any reason to think they wouldn't insist implementations have a way to dishonor the mooted N bit?

Agreed.  Also, arguably the issue is worse during initial deployment of the attribute-announce feature due to the number of boxes that simply don't understand it.

That said, this is one step beyond "no-export".  It's "set no-export at my asbr boundary".

-- Jeff

> 
> --John