Re: [Idr] IETF LC for IDR-ish document <draft-ietf-grow-bgp-reject-05.txt> (Default EBGP Route Propagation Behavior Without Policies) to Proposed Standard

[Job Snijders <[e-mail]>]

On Wed, Apr 19, 2017 at 10:12:48PM +0000, [e-mail] wrote:
> Thanks John for bringing this in IDR.
> 
> I admit that I was not following this subject so my comments might be redundant or even stupid.
> 
> 1) Am I missing something or would this break all existing EBGP
> sessions deployed with no policy?

Yes, you are missing the fact that a wild variety of defaults has been
deployed in the wild:

    o some reject on ingress, promiscuous on egress
    o some reject on both ingress and egress
    o some accept and announce everything

This documents aims to align those on a singular safe default: on EBGP
you'll need to configure a policy for something to happen.

> If so this would definitely not be deployment friendly. Especially for
> BGP/MPLS VPN networks using EBGP for PE-CE routing and which have
> little use of filtering policies.

This is what release notes are for.

> 2) BTW, what is exactly eligible as an "import policy"? e.g.
> - is an explicit policy capping the number of received routes eligible as an "import policy"? 
> - is Route Target filtering (either automatic or manual) a routing policy?
> 
> Same question of "export policy". e.g.
> Is an expert policy tagging community eligible?

i do not understand what you mean. Can you elaborate or phrase
differently?

> 3) From the introduction
> "   There are BGP routing security issues that need to be addressed to
>    make the Internet more stable. [...]  This document provides guidance to BGP [RFC4271]
>    implementers to improve the default level of Internet routing
>    security."
> 
> Does this mean that this proposition should be restricted to Internet
> routing? (while BGP is used for many others applications)

It is restricted to EBGP.

> 4) Alternatively, there could be a (capability) signaling during the
> OPEN of the EBGP session. With one end requesting this behavior to its
> peer. (or alternatively it's peer advertising the presence of a policy
> and the receiver taking its own decision).
> 
> Possibly, some of the requirements may already be addressed by
> configuring a policy limiting the number of routes acceptable from a
> peer/customers, and closing the EBGP sessions when this limit is
> reached. This seems this would catch customers/peers advertising the
> full routing by mistake/misconfiguration.

no.

Kind regards,

Job