Re: [Idr] 答复: FW: New Version Notification for draft-wu-idr-flowspec-dip-community-filter-00.txt

Hi,

Community level filtering have nothing to do with data plane. Installing
such components in RIB, FIB, ACL just does not make any sense to me.

Community based filtering is done in BGP application after parsing the
UPDATE messages, I am yet to see BGP processing done in data plane.

So to me this should never go into Flowspec v1.

For Flowspec v2 is the goal is to broaden the scope to use v2 as
generalized routing protocols policy propagation vehicle so be it.

Kind regards,
Robert

On Wed, Mar 13, 2024 at 10:14 AM wutianhao <wutianhao10=
40huawei.com@dmarc.ietf.org> wrote:

> Hi, Robert
>
>
>
> Thank you for your comments.
>
>
>
> This draft is targeting both FlowSpec v1 and FlowSpec v2. We will add a
> section to describe FlowSpec v2 part.
>
>
>
> This component use control plane information need to be delivered to FIB
> as follows:
>
> BGP -> RIB -> FIB
>
> FlowSpec -> ACL
>
>
>
> In data plane, BGP communities and FlowSpec rules can be combined to
> redirect flow.
>
>
>
> It is indeed departure from the original definition of FlowSpec v1. But we
> think that control plane information can be used to reduce ACL usage
> significantly and do not need to change the FlowSpec v1.
>
>
>
> Best regards,
>
>
>
> Tianhao Wu
>
>
>
>
>
> *发件人**:* Robert Raszuk <robert@raszuk.net>
> *发送时间:* 2024年3月5日 4:11
> *收件人:* wutianhao <wutianhao10@huawei.com>
> *抄送:* idr@ietf.org
> *主题:* Re: [Idr] FW: New Version Notification for
> draft-wu-idr-flowspec-dip-community-filter-00.txt
>
>
>
> Hi,
>
>
>
> I am not sure if this is targeting FlowSpec v2 ... but I would like to
> observe that component types as defined in RFC8955 are about data plane.
>
>
>
> You are proposing an addition of a control plane entity - namely BGP
> Community Attribute.
>
>
>
> I understand that you want to recursively result local installation into
> the data plane all destinations which are advertised in BGP with such
> community, but this is a significant departure from the definition of
> FlowSpec v1.
>
>
>
> It is about signalling dynamically a BGP policy which FlowSpec v1 is not
> doing.  With that being said I recommend that if authors of FlowSpec v2 are
> still working on it allowing it to carry BGP policy - then this would be
> the right place to add the proposed encoding into.
>
>
>
> As currently defined - stand alone extension - it does not seems to even
> fit https://www.iana.org/assignments/flow-spec/flow-spec.xhtml.
>
>
>
> Kind regards,
>
> Robert
>
>
>
>
>
> On Mon, Mar 4, 2024 at 11:55 AM wutianhao <wutianhao10=
> 40huawei.com@dmarc.ietf.org> wrote:
>
> Dear all,
>
> We've submitted a new draft: draft-wu-idr-flowspec-dip-community-filter.
>
> This draft specifies a new BGP Flowspec component type to support
> community-level filtering. Flowspec rules can be reduced by using the
> method defining in this draft. It saves a lot of entry spaces on the
> control plane and forwarding plane, and it would greatly simplify the
> operation of the control plane, and the more destination prefixes with the
> same community has, the more obvious the benefit.
>
> Review and comments are welcome.
>
> Best regards,
> Tianhao
>
> -----Original Message-----
> From: internet-drafts@ietf.org <internet-drafts@ietf.org>
> Sent: 2024年2月29日 17:26
> To: Wanghaibo (Rainsword) <rainsword.wang@huawei.com>; Gejun (Jack, BGP) <
> jack.gejun@huawei.com>; wutianhao <wutianhao10@huawei.com>; Dingxiangfeng
> <dingxiangfeng@huawei.com>
> Subject: New Version Notification for
> draft-wu-idr-flowspec-dip-community-filter-00.txt
>
> A new version of Internet-Draft
> draft-wu-idr-flowspec-dip-community-filter-00.txt has been successfully
> submitted by Tianhao Wu and posted to the IETF repository.
>
> Name:     draft-wu-idr-flowspec-dip-community-filter
> Revision: 00
> Title:    Destination-IP-Community Filter for BGP Flow Specification
> Date:     2024-02-28
> Group:    Individual Submission
> Pages:    7
> URL:
> https://www.ietf.org/archive/id/draft-wu-idr-flowspec-dip-community-filter-00.txt
> Status:
> https://datatracker.ietf.org/doc/draft-wu-idr-flowspec-dip-community-filter/
> HTMLized:
> https://datatracker.ietf.org/doc/html/draft-wu-idr-flowspec-dip-community-filter
>
>
> Abstract:
>
>    BGP Flowspec mechanism (BGP-FS) propagates both traffic Flow
>    Specifications and Traffic Filtering Actions by making use of the BGP
>    NLRI and the BGP Extended Community encoding formats.  This document
>    specifies a new BGP-FS component type to support community-level
>    filtering.  The match field is the community of the destination IP
>    address that is encoded in the Flowspec NLRI.  This function is
>    applied in a single administrative domain.
>
>
>
> The IETF Secretariat
>
>
> _______________________________________________
> Idr mailing list
> Idr@ietf.org
> https://www.ietf.org/mailman/listinfo/idr
>
> _______________________________________________
> Idr mailing list
> Idr@ietf.org
> https://www.ietf.org/mailman/listinfo/idr
>