Re: [Idr] Securing BGP sessions (Issue#41)

"Acee Lindem (acee)" <acee@cisco.com> Fri, 13 December 2019 18:48 UTC

Return-Path: <acee@cisco.com>
X-Original-To: idr@ietfa.amsl.com
Delivered-To: idr@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D78A1200A1 for <idr@ietfa.amsl.com>; Fri, 13 Dec 2019 10:48:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.498
X-Spam-Level:
X-Spam-Status: No, score=-14.498 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=hYH/FYUh; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=YwCXuTGb
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NdHcwGKOb8w3 for <idr@ietfa.amsl.com>; Fri, 13 Dec 2019 10:48:12 -0800 (PST)
Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 75E16120013 for <idr@ietf.org>; Fri, 13 Dec 2019 10:48:12 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5222; q=dns/txt; s=iport; t=1576262892; x=1577472492; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=ILarogfPLsGIzUbsO1lXB+9dpNij3Vk43dkElnJ5ZoI=; b=hYH/FYUhx93zM+lUeTWhFSIcTGatcWrBD71GR9817uXHECpASnoHVCMH qPR0T4QIxXVVQXAHE8LY96/BWDQCmDU/SyG6b16wZvxXtDFPzDHAJcvnl icXeRX47FLOAVUpRbIdhgROn4Vefcrz+RVXky0nJxrQOpt/WLU5TyAjxB k=;
IronPort-PHdr: =?us-ascii?q?9a23=3AmajgpR2o08qwh4YJsmDT+zVfbzU7u7jyIg8e44?= =?us-ascii?q?YmjLQLaKm44pD+JxGCt+51ggrPWoPWo7JfhuzavrqoeFRI4I3J8TgZdYBUER?= =?us-ascii?q?oMiMEYhQslVceOBEDTJ//xZCt8F8NHBxdo?=
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B2AADk2/Nd/5ldJa1lHAEBAQEBBwE?= =?us-ascii?q?BEQEEBAEBgWsGAQELAYFKJCwFbFggBAsqhAODRgOLDIJfiVuOKoEugSQDVAk?= =?us-ascii?q?BAQEMAQEYCwoCAQGEQAIXgXgkNQgOAgMNAQEEAQEBAgEFBG2FNwyFXgEBAQE?= =?us-ascii?q?CAQEBEBERDAEBLAsBDwIBCA4KAgImAgICHwYLFRACBA4FIoMAAYJGAw4gAQI?= =?us-ascii?q?MojACgTiIYXWBMoJ+AQEFgUlBQIJFDQuCFwMGgQ4oAYwXGoIAgTgggkw+ght?= =?us-ascii?q?JAQEDAYFfgxAygiyNMYMCjy6OKS9DCoIwhyiKN4QlG5pHlxqCGY9eAgQCBAU?= =?us-ascii?q?CDgEBBYFUATaBWHAVOyoBgkFQERSNEg0Wg1CFFIU+AXSBKI4nAQE?=
X-IronPort-AV: E=Sophos;i="5.69,309,1571702400"; d="scan'208";a="684306892"
Received: from rcdn-core-2.cisco.com ([173.37.93.153]) by rcdn-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 13 Dec 2019 18:48:06 +0000
Received: from XCH-RCD-005.cisco.com (xch-rcd-005.cisco.com [173.37.102.15]) by rcdn-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id xBDIm2Hj009574 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 13 Dec 2019 18:48:04 GMT
Received: from xhs-rtp-001.cisco.com (64.101.210.228) by XCH-RCD-005.cisco.com (173.37.102.15) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 13 Dec 2019 12:48:01 -0600
Received: from xhs-rtp-003.cisco.com (64.101.210.230) by xhs-rtp-001.cisco.com (64.101.210.228) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 13 Dec 2019 13:48:00 -0500
Received: from NAM04-BN3-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-003.cisco.com (64.101.210.230) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Fri, 13 Dec 2019 13:48:00 -0500
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=WFm8sKSilX9XbLlM1zyceA4lncuT6R2tG85BkhyVKjDgEtFIX7r/B/2cVq7gjh6dX80fxFroAISsR0HRBO+9rcMKCQeawWGt1L57Xu0lZtYgrX9995tt2DmY6vHpP76K93YoRj+NRXvYvt49+uT8T/PMp2lKtenGoVmaBrfT0SDjQ2/2cnQC9FLoHGvIw6gtI1fgmrotW8gO7n19MU5o3LLLJQeEjPBa0jwuFWA3anwMLpSlfooj1Rhv9dHyFpnhcZQAINhh90WaqJkRuylEAnT/WLlOkN2o1bV1RwgnRVa5QPyorkwFzYOgPkgcv7zCrQEVUiOwS8TWtWFdPF2jmA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ILarogfPLsGIzUbsO1lXB+9dpNij3Vk43dkElnJ5ZoI=; b=ZYBldF3gtwqiSde4m+xioaIlvlUKvAovRilYycaSvjJCV02m9DJXtJeCFb06Jm41p25Z7eSN+MMf0JgjpjMrO7yr9h2GTYfiHSK80DUhEKJ4j+ScO3RfzFxqn59Hplz5qE5bm+9YFTE+r+mp/pbKNJKBzu4aUBwnRo1t689yQRKCfuOeKd18D2AKS5R8KDb9pA+jtnCczgc+lSeHxA1FqTukd+/xxa0bQH1Gc/ALmiW8bEeAffyfgwmFdTY7b3vZeDhRPk7SY9CGtWK5gBsh5A2bP+eCPPVn/YTeOQQMvmZI7USMB8TpcQfnxlbuXn8b/+NjjQE7seEl30vTFL4hlw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ILarogfPLsGIzUbsO1lXB+9dpNij3Vk43dkElnJ5ZoI=; b=YwCXuTGb8iS8F/gdKimnYEvyj4+1819GXvDePDaIgaX9vRkLo4+d+LrwKad8oYKa9G8LKaZLJQ+W7qhkAWQj3+Q+UC/ir8EGISzsMozVD2In1EQGK1mcQxsQ0Ake7oZpIEz3B3/k9Llg2x45hiaxWJ34k7C45O/9FrOqW05UzrA=
Received: from MN2PR11MB4221.namprd11.prod.outlook.com (52.135.38.14) by MN2PR11MB4064.namprd11.prod.outlook.com (20.179.150.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2538.15; Fri, 13 Dec 2019 18:47:56 +0000
Received: from MN2PR11MB4221.namprd11.prod.outlook.com ([fe80::f065:2931:17b6:7b5d]) by MN2PR11MB4221.namprd11.prod.outlook.com ([fe80::f065:2931:17b6:7b5d%3]) with mapi id 15.20.2538.017; Fri, 13 Dec 2019 18:47:56 +0000
From: "Acee Lindem (acee)" <acee@cisco.com>
To: Mahesh Jethanandani <mjethanandani@gmail.com>
CC: "idr@ietf.org" <idr@ietf.org>
Thread-Topic: [Idr] Securing BGP sessions (Issue#41)
Thread-Index: AQHVr7rd/5qGVW58hUml+zqJVoppf6ezzC0AgABWPgD//68bAIAAVwmAgAPv0oA=
Date: Fri, 13 Dec 2019 18:47:55 +0000
Message-ID: <DE40EA38-504C-4D6F-B697-DD3325577C05@cisco.com>
References: <D9C310C0-89C6-4CB5-80A2-98C274581E7F@gmail.com> <68B00DBF-3590-4ECE-8028-301643B9E49E@cisco.com> <91B63CF9-B92B-4D14-98CA-EBC865999B08@gmail.com> <A8395DB8-6D10-46A1-99A1-DFFB9B2CBD9D@cisco.com> <E126FB83-AB0B-46C6-91F0-396C9C4FBE9E@gmail.com>
In-Reply-To: <E126FB83-AB0B-46C6-91F0-396C9C4FBE9E@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=acee@cisco.com;
x-originating-ip: [2001:420:c0c4:1006::8f]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 97b620e1-8356-4c48-89da-08d77ffcf7bc
x-ms-traffictypediagnostic: MN2PR11MB4064:
x-microsoft-antispam-prvs: <MN2PR11MB40641460A75BFAABB12AC032C2540@MN2PR11MB4064.namprd11.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-forefront-prvs: 0250B840C1
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(376002)(346002)(39860400002)(136003)(366004)(199004)(189003)(71200400001)(33656002)(36756003)(66476007)(8936002)(66446008)(81166006)(6512007)(66556008)(64756008)(8676002)(2906002)(6916009)(316002)(6486002)(2616005)(5660300002)(53546011)(6506007)(81156014)(4326008)(66946007)(76116006)(86362001)(966005)(186003)(478600001); DIR:OUT; SFP:1101; SCL:1; SRVR:MN2PR11MB4064; H:MN2PR11MB4221.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: JcnGM/dixgYqLLubUxwDsZbcl1WxBn2zYVXhXlY5P8jWZ2K0VwZPAnTNRFJm29vuCQCTNDo0Ihwbvdxhy+n439VHgKsu62zOf+mZ81PNFE4/KEoICiZw+nzyyGwfO3AZw5DMz5L4IsC6GhpD3L4q7kRskS/g4BfHdRtIMjSRo8LFrfsNJTci4lsf9taLo6Wclh2wbWGx9HY7UgJfTcCBd91tU2Elnbp4ejD0KENJWBuV405AqlzsHyKuN5jnwe1jCpt6DHKhbIsG4UmP+f12Gz7JkKCfsEh5PYq6yhGPJGNfqhZTVoBzcpt2nqFjd/tMxsn2qZLyGs8P2iQq4/3dA3CAkkkFl7y3No4WOdFzLfaFocbKZJtLTFF1DX2q5zaWmC85h/En7IzTUGBzFbD7AzKqagXauq3RP/LNOwO3bxM8gCO+lZQAOr35TF6+XJXvi24KZERDJ/EBss0OeHcg/QOR96BAVQEluIBovD8nDRI=
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="utf-8"
Content-ID: <1F6FBDA0E6FF364BAD6435E16C610DB2@namprd11.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 97b620e1-8356-4c48-89da-08d77ffcf7bc
X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Dec 2019 18:47:55.9220 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: rCQIlAHGiBO2p6a+bpldPQa7HuxHAHJJjtOf0OkgAUe5O2CsIiBZGukfE3wnoeC7
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4064
X-OriginatorOrg: cisco.com
X-Outbound-SMTP-Client: 173.37.102.15, xch-rcd-005.cisco.com
X-Outbound-Node: rcdn-core-2.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/idr/bwN9bJddAZ374gofIFjU_DeRGjc>
Subject: Re: [Idr] Securing BGP sessions (Issue#41)
X-BeenThere: idr@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Inter-Domain Routing <idr.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/idr>, <mailto:idr-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/idr/>
List-Post: <mailto:idr@ietf.org>
List-Help: <mailto:idr-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/idr>, <mailto:idr-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 13 Dec 2019 18:48:14 -0000

Hi Mahesh, 

On 12/10/19, 8:41 PM, "Mahesh Jethanandani" <mjethanandani@gmail.com> wrote:

    
    
    > On Dec 10, 2019, at 5:29 PM, Acee Lindem (acee) <acee@cisco.com> wrote:
    > 
    > Hi Mahesh, 
    > 
    > On 12/10/19, 8:19 PM, "Mahesh Jethanandani" <mjethanandani@gmail.com> wrote:
    > 
    >    Hi Acee,
    > 
    >> On Dec 10, 2019, at 5:10 PM, Acee Lindem (acee) <acee@cisco.com> wrote:
    >> 
    >> Hi Mahesh, 
    >> I assume by IPsec, you mean transport mode IPsec.
    > 
    >    Yes. The assumption is that the underlying transport is secured using IPsec, and the model provides (if needed) key parameters needed to kick off the IKE to setup the SA in IPsec.
    > 
    >    HTH.
    > 
    > Well it doesn't help at all.... Normally, the usage of IPsec (AH, ESP, algorithms, key exchange, etc.) would be specified in some document. For example, IPsec usage by OSPFv3 is specified in RFC 4552. Granted, it is a lot simpler for BGP than OSPFv3 since BGP is strictly P2P but specification would still seem to necessary. 
    
    You are right. It should be some document. That document in my mind is the YANG model for IPsec/IKE, something we need to ask the SEC ADs about. You would agree that what needs to be defined is not BGP specific, and therefore does not belong in the BGP model.
    
    Much like TCP-AO and TCP-MD5 I expect this other document to define a grouping that the BGP model imports and uses to define what is needed to setup IPsec.

Actually I disagree with you - TCP MD5 and TCP-AO are more than adequately documented. 

   MD5 - https://datatracker.ietf.org/doc/rfc2385/
   TCP-AO - https://datatracker.ietf.org/doc/rfc5925/

It is only IPsec transport mode that isn't described. Also, I don't know of anyone who supports this so I'm wondering why it is in the discussion for this version of the BGP YANG model.

Thanks,
Acee

    
    Cheers.
    
    > 
    > Thanks,
    > Acee
    > 
    > 
    >> For IPsec protection of BGP, where are the details specified? 
    >> Thanks,
    >> Acee
    >> 
    >> On 12/10/19, 7:35 PM, "Idr on behalf of Mahesh Jethanandani" <idr-bounces@ietf.org on behalf of mjethanandani@gmail.com> wrote:
    >> 
    >>   This is the second thread in the list of issues that were discussed in IETF 106 w.r.t. to BGP YANG model. This particular thread is to discuss the issue of defining how BGP sessions are going to be secured.
    >> 
    >>   As stated in Singapore, the model is being defined to secure BGP sessions using 
    >>   - TCP AO
    >>   - TCP MD5
    >>   - IPSec
    >> 
    >>   In case there was a question of why MD5, it is because there are existing implementations that are choosing to stay with MD5, regardless of the issues that have been raised about MD5. The model therefore has to support such implementations.
    >> 
    >>   The model will use the ietf-key-chain model’s (RFC 8177) key-chain-ref to refer to an instance of the key chain. By doing that it will make use of the key rollover capability defined in that model, and for static key configuration by setting the end time to infinite in the key chain. The BGP model will leave the case of IPSec as TBD for now, and fill it when/if the IPSec YANG model is defined.
    >> 
    >>   Questions/Concerns?
    >> 
    >>   Mahesh Jethanandani
    >>   mjethanandani@gmail.com
    >> 
    >> 
    >> 
    >>   _______________________________________________
    >>   Idr mailing list
    >>   Idr@ietf.org
    >>   https://www.ietf.org/mailman/listinfo/idr
    >> 
    >> 
    > 
    >    Mahesh Jethanandani
    >    mjethanandani@gmail.com
    > 
    > 
    > 
    > 
    > 
    
    Mahesh Jethanandani
    mjethanandani@gmail.com