IETF Logo Mail Archive

Re: [Idr] Securing BGP sessions (Issue#41)

Jeffrey Haas <jhaas@pfrc.org> Tue, 17 December 2019 21:18 UTC

Return-Path: <jhaas@slice.pfrc.org>
X-Original-To: idr@ietfa.amsl.com
Delivered-To: idr@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AAD47120077 for <idr@ietfa.amsl.com>; Tue, 17 Dec 2019 13:18:47 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f0KeLs6Tq1o8 for <idr@ietfa.amsl.com>; Tue, 17 Dec 2019 13:18:44 -0800 (PST)
Received: from slice.pfrc.org (slice.pfrc.org [67.207.130.108]) by ietfa.amsl.com (Postfix) with ESMTP id D8C23120639 for <idr@ietf.org>; Tue, 17 Dec 2019 13:18:43 -0800 (PST)
Received: by slice.pfrc.org (Postfix, from userid 1001) id C97021E2F6; Tue, 17 Dec 2019 16:23:12 -0500 (EST)
Date: Tue, 17 Dec 2019 16:23:12 -0500
From: Jeffrey Haas <jhaas@pfrc.org>
To: Mahesh Jethanandani <mjethanandani@gmail.com>
Cc: "Acee Lindem (acee)" <acee@cisco.com>, "idr@ietf.org" <idr@ietf.org>
Message-ID: <20191217212312.GC4858@pfrc.org>
References: <D9C310C0-89C6-4CB5-80A2-98C274581E7F@gmail.com> <68B00DBF-3590-4ECE-8028-301643B9E49E@cisco.com> <91B63CF9-B92B-4D14-98CA-EBC865999B08@gmail.com> <A8395DB8-6D10-46A1-99A1-DFFB9B2CBD9D@cisco.com> <E126FB83-AB0B-46C6-91F0-396C9C4FBE9E@gmail.com> <DE40EA38-504C-4D6F-B697-DD3325577C05@cisco.com> <D8A5A1E6-2978-4720-9441-C894608F6F35@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <D8A5A1E6-2978-4720-9441-C894608F6F35@gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Archived-At: <https://mailarchive.ietf.org/arch/msg/idr/MvygDMzinDg6AwOHGFgu3TvOxoQ>
Subject: Re: [Idr] Securing BGP sessions (Issue#41)
X-BeenThere: idr@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Inter-Domain Routing <idr.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/idr>, <mailto:idr-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/idr/>
List-Post: <mailto:idr@ietf.org>
List-Help: <mailto:idr-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/idr>, <mailto:idr-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 17 Dec 2019 21:18:48 -0000

On Fri, Dec 13, 2019 at 03:09:32PM -0800, Mahesh Jethanandani wrote:
> > On Dec 13, 2019, at 10:47 AM, Acee Lindem (acee) <acee@cisco.com> wrote:
> > It is only IPsec transport mode that isn't described. Also, I don't know of anyone who supports this so I'm wondering why it is in the discussion for this version of the BGP YANG model.
> 
> I will let Jeff comment on this.

In Junos,

Transport mode for ipsec for BGP:

https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/ipsec-sa-edit-protocols-bgp.html
https://www.juniper.net/documentation/en_US/junos/topics/topic-map/ip_security.html

While it's a valid observation that ISPs don't typically deploy IPsec at
ASBRs, this type of security is often used for BGP IPsec VPNs.

-- Jeff

v2.23.0 | Report a Bug | By Email