Re: [Idr] [Responses for the comments during the IETF108] New Version Notification for draft-wang-idr-rd-orf-01.txt

[Robert Raszuk <[e-mail]>]

Aijun,

But, don’t’ you worry that if only one of the edge points being
> comprised/error-configured/attacked, then all of PEs within your domain are
> under risk?
>

First if one PE is compromised new RD can be created or routes injected
into global table completely destroying your entire network. No matter how
much protocol extensions we will define here if your network infrastructure
is attacked and the attack is successful you are over.

Now we keep telling you that any decent L3VPN or L2VPN implementation has
two completely different protections - shipping and successfully protecting
production networks:

Protection 1 - BGP prefix limit

Protection 2 - VRF limit

If you enable correctly those two checks you are pretty safe.

If not I recommend you offer CSC model and do not take any external routes
into your core infrastructure. Of course you can still carry routes for
your customers except that they will be distributed with no risk to your
core or PEs "over the top". PEs in this case *only* handle directly
connected next hops which I hops is pretty trivial to protect.

Many thx,
R.