Re: [Idr] flowspec enhancements

[Wesley Eddy <[e-mail]>]

I agree that expressing ways to match tunneled flows is very useful.

I took a look at the draft-hao-idr-flowspec-nvo3 document and I
don't agree with the approach taken there, which identifies
specific encapsulations (e.g. VXLAN, NVGRE, and eventually others
such as GUE, as I understand the plans).

I don't think that's a reasonable approach in general for BGP/flowspec
to express tunneling, because we can't rely on the multitude of
encapsulations to be parse-able by routers in general.

That's why we proposed the "Offset-Value-Mask" approach for defining
components to be matched within a tunnel.  At the cost of being only
slightly more complex to express fields, it can be much more generally
implemented for the many current (and future) encapsulation types.




On 9/22/2015 9:05 PM, Haoweiguo wrote:
> Hi Wes, I have read through your draft, it's very useful and
> interesting. One comment about "add support for filtering of tunneled
> traffic" is as follows:
> 
> I also think flow-spec should support nesting representation for
> overlay encapsulations. In my draft of
> "draft-hao-idr-flowspec-nvo3-01", the nesting problem and solution
> are raised, a new component type of "Delimiter type" is proposed. In
> your draft, the name is called "tunnel separator". I think both of us
> think it's an important problem that should be resolved.
> 
> Thanks, weiguo


-- 
Wes Eddy
MTI Systems