Re: [Idr] Warren Kumari's Discuss on draft-ietf-idr-bgp-gr-notification-15: (with DISCUSS)

[Jeffrey Haas <[e-mail]>]

Warren,

> On May 22, 2018, at 2:53 PM, Warren Kumari <[e-mail]> wrote:
> I'm sure that this has already been discussed somewhere, and that I'll be able
> to quickly clear my DISCUSS once pointed at it, but: "To put an upper bound on
> the amount of time a router retains the stale routes, an implementation MUST
> support a (configurable) timer, called the "stale timer", that imposes this
> upper bound. A suggested default value for the stale timer is 180 seconds. An
> implementation MAY provide the option to disable the timer (i.e., to provide an
> infinite retention time) but MUST NOT do so by default."
> 
> The "infinite retention time" part of this makes me deeply uncomfortable -- I
> can see a good reason for the stale timer, and the default "feels" fine to me,
> but having an infinite retention time (or, really anything over 10 to 15
> minutes) feels like a really dangerous idea, and that it will come back and
> bite.

This is a point where I point at your supposed opeational background and suggest shame on you. :-)

For my part, I would rather see this option discussed and given a caveat rather than elided from the specification.  Otherwise you simply have vendors who've implemented such an option and someone wagging their finger at their supposed non-conformance.  And it's usually some operator that wanted the thing present in the first place!


> 
> I'm hoping that I'm missing something obvious, but can you please explain under
> what conditions an infinite retention policy makes sense? It seems like there
> would be multiple opportunities for blackholing traffic with this.

There are situations, especially closed L3VPN networks, where infinite retention is potentially desired.  In situations where such a knob is configured and the operator decides that the underlying behavior needs to be addressed, a reset of the necessary session state could be done.  E.g. deconfigure the peer.

It should be noted that earlier forms of the long lived graceful restart feature, which this was intended to service, tried to provide significant caveats about not applying the feature to address families like those carrying the Internet for exactly the reason you're concerned with.


-- Jeff