[Idr] Re: Flowspec redirect-ip update

[Robert Raszuk <[e-mail]>]

Hi Jeff,

- Since this feature has dire consequences for traffic interception if the
>   redirection address is not strongly controlled, there is new text
>   addressing validating the redirection address vs. the destination
> address in
>   a fashion similar to existing inter-AS/eBGP flowspec.  And very similar
> to
>   that mechanism in the flowspec RFCs, it may be disabled by configuratino.


+ text in the draft:





*More specifically, the router must consider a "redirect-to-IPv4" or
"redirect-to-IPv6" extended community to be invalid if the origin AS of the
flow-spec route does not match the origin AS of the best-match unicast
route for the "target-address".*

While I understand the intention I am struggling a bit with the
practicality of this extension.

Specifically I do not know of any deployment where the destination used for
redirection of flows (flow collectors) would be subject to cross local AS
boundary (except redirection to a cloud based collector(s)).

But in both of those cases AS-PATH check will fail.

If you/we agree with the above then it means we have few options/to-do edit
actions here:

* mandate that disabling validation for destinations be a separate knob
from disabling validation for redirect-to address(es)

* define validation of destination-ip to be handled differently then
validation of redirect-ip

* add ability to consider IGP sourced reachability for redirect to address
to be valid irrespective of validation of destination addresses

* add ability to manually configure list of valid redirect-ip addresses or
an IP prefix block redirect-ip addresses would be part of to be accepted
(perhaps do the same with origin ASNs to cover the redirect to cloud
cases).

Kind regards,
Robert