Re: [Idr] I-D Action: draft-ietf-idr-next-hop-capability-03.txt

["UTTARO, JAMES" <[e-mail]>]

The notion of a group of AS domains that "trust" each other has been a discussion we have had over the last number of years.. For a hypothetical world-wide network which uses different AS numbers based on geography it is desirable to craft a trusted set, as a given tunneled service i.e 2547, EVPN, Kompella etc.. is deployed across all of these AS domains. One could imagine a migration to a single AS but this is not realistic..

Thanks,
	Jim Uttaro

-----Original Message-----
From: Idr [mailto:[e-mail]] On Behalf Of [e-mail]
Sent: Thursday, June 28, 2018 4:13 AM
To: Randy Bush <[e-mail]>
Cc: [e-mail]
Subject: Re: [Idr] I-D Action: draft-ietf-idr-next-hop-capability-03.txt

Hi Randy,

[Trimming the list to IDR]

 > -----Original Message-----
 > From: Idr [mailto:[e-mail]] On Behalf Of Randy Bush
 > Sent: Thursday, June 28, 2018 3:47 AM
 > To: [e-mail]
 > Cc: [e-mail]; [e-mail]
 > Subject: Re: [Idr] I-D Action: draft-ietf-idr-next-hop-capability-03.txt
 > 
 > from the sec cons
 > 
 >     an operator who is relying on the information carried in BGP must have a
 >     transitive trust relationship back to the source of the information.
 >     Specifying the mechanism(s) to provide such a relationship is beyond the
 >     scope of this document.
 > 
 > call the security police!
 
This is intended to be just stating a fact.
Would you mind elaborating on your comment?

Coming back to this document, the attribute is related to node indicated in the BGP NEXT_HOP which is usually not far away from you, including from a trust perspective. Also this attribute is explicitly removed when the NEXT_HOP is changed, and the attribute is non-transitive.
Finally, the first application is for labelled (MPLS) routes which typically imply a trust boundary.

Thanks,
Regards,
--Bruno
 
 > randy
 > 
 > _______________________________________________
 > Idr mailing list
 > [e-mail]
 > https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_idr&d=DwICAg&c=LFYZ-o9_HUMeMTSQicvjIg&r=s7ZzB4JbPv3nYuoSx5Gy8Q&m=_yVHR5jfVKriNt5TSyrS0fbO7NCbb_HNLvFDgBQmZOM&s=K4MrEL731u51vk6hDqYAC8trBc8vHYmM1TOcqnatGWc&e=

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

_______________________________________________
Idr mailing list
[e-mail]
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_idr&d=DwICAg&c=LFYZ-o9_HUMeMTSQicvjIg&r=s7ZzB4JbPv3nYuoSx5Gy8Q&m=_yVHR5jfVKriNt5TSyrS0fbO7NCbb_HNLvFDgBQmZOM&s=K4MrEL731u51vk6hDqYAC8trBc8vHYmM1TOcqnatGWc&e=