Re: [Idr] WG Adoption call for draft-hao-idr-flowspec-evpn (1/19/2015 to 2/2/2015

Hi Donald,

Thanks for your great comments. The layer 2 flowspec deployment in layer 2 VPN network is similar to layer 3 flowspec. The following is the typical deployment scenario.

Attacker--------Router A-----Router B-------Router C----Traffic analyzer
             AS 100       |                    AS200

The procedures:
1. Traffic are sampled on Router C and Router D using netstream like method, then the traffic is sent to the traffic analyzer.
2. When the traffic analyzer detects exceptional traffic relying on rules defined in beforehand, the analyzer constructs BGP flowspec routes automatically, then it sends the
flowspec routes to peer Router C.  
3. Then router C  transmits the flowspec routes to ingress PE of Router B.
4. Router B converts the flowspec routes to local ACL rules, downloads the ACL rules to chipset for traffic filtering.

Your further complementary usecases and deployment mode are welcomed.

As for security issue, would you like to give some detail suggestions?

Thanks,
weiguo
________________________________________
From: Idr [idr-bounces@ietf.org] on behalf of Susan Hares [shares@ndzh.com]
Sent: Wednesday, January 21, 2015 0:17
To: 'Smith, Donald'; Zhuangshunwan; 'idr wg'
Cc: draft-hao-idr-flowspec-evpn.all@tools.ietf.org; 'John G. Scudder'
Subject: Re: [Idr] WG Adoption call for draft-hao-idr-flowspec-evpn (1/19/2015 to 2/2/2015

Donald:

I hope that service providers will comment on the list on the usefulness of
this draft.   If you have suggestions on improving the security
considerations, please send these to the list during the WG adoption call.

Sue

-----Original Message-----
From: Idr [mailto:idr-bounces@ietf.org] On Behalf Of Smith, Donald
Sent: Tuesday, January 20, 2015 10:23 AM
To: Zhuangshunwan; 'Susan Hares'; 'idr wg'
Cc: draft-hao-idr-flowspec-evpn.all@tools.ietf.org; 'John G. Scudder'
Subject: Re: [Idr] WG Adoption call for draft-hao-idr-flowspec-evpn
(1/19/2015 to 2/2/2015

So far all the "support" responses re from Huawei ( single vendor support)
engineers.

When will the intended status be decided?

Intended RFC status:Unknown

The draft itself at first review appears to be pretty good. I didn't see any
large technical issues with it (yet:)

I am considering how an ISP would use this or if they would.

"Please comment on the usefulness of the draft in deployments and on the
technical pros/cons of the draft." so I look forward to use cases or other
descriptions of how/when people would use this.

I think the security considerations should probably match what other
flow-spec drafts have said.
Currently it is very weak and probably inaccurate.

I will withhold support for now. But also don't object to adoption by this
wg!

(coffee != sleep) & (!coffee == sleep)
 Donald.Smith@centurylink.com

From: Idr [idr-bounces@ietf.org] on behalf of Zhuangshunwan
[zhuangshunwan@huawei.com]
Sent: Tuesday, January 20, 2015 12:21 AM
To: 'Susan Hares'; 'idr wg'
Cc: 'John G. Scudder'
Subject: Re: [Idr] WG Adoption call for draft-hao-idr-flowspec-evpn
(1/19/2015 to 2/2/2015

Support as co-author and not aware any IPR regarding this document.

Thanks,
Shunwan

发件人: Idr [mailto:idr-bounces@ietf.org] 代表 Susan Hares
发送时间: 2015年1月20日 0:31
收件人: idr wg
抄送: 'John G. Scudder'
主题: [Idr] WG Adoption call for draft-hao-idr-flowspec-evpn (1/19/2015 to
2/2/2015

This is to begin a 2 week adoption call for draft-hao-idr-flowspec-evpn.
Please comment on the usefulness of the draft in deployments and on the
technical pros/cons of the draft.  In your comments please include:
“support” or “no support” indicate.  Authors should indicate if any IPR
exists for this draft.

The draft can be found at:

http://datatracker.ietf.org/doc/draft-hao-idr-flowspec-evpn

Sue Hares
This communication is the property of CenturyLink and may contain
confidential or privileged information. Unauthorized use of this
communication is strictly prohibited and may be unlawful. If you have
received this communication in error, please immediately notify the sender
by reply e-mail and destroy all copies of the communication and any
attachments.
_______________________________________________
Idr mailing list
Idr@ietf.org
https://www.ietf.org/mailman/listinfo/idr

_______________________________________________
Idr mailing list
Idr@ietf.org
https://www.ietf.org/mailman/listinfo/idr