Re: [Idr] I-D Action: draft-ietf-idr-flowspec-v2-02.txt

[Nat Kao <[e-mail]>]

Hi, All.

While carefully evaluating the use cases for FSv2, I have a few
questions regarding this version:

1. In section 3.1.1 & 3.1.2, the terms SubTLVs(Sub-subTLVs actually) and
components are used interchangeably, should we unify them?

2. Can SubTLV/Component type 1(IP Destination Prefix) or 2(IP Source
Prefix) appear multiple times in the same IP/IPv6 traffic rule?
If that's not the case, maybe we can add a new SubTLV/Component for
matching multiple prefixes?
I'm trying to find a solution to disseminating matching rules with
multiple prefixes(i.e. a prefix-list) using either FSv1 or FSv2.
The underlying hardware support is already there.(see Note 1)
With current components of FSv1, we have to expand prefix-list matching
rules by each prefix in the list.

3. There's an extra "Reference: " in section 3.1.17.
Since EXP field had been rename to Traffic Class field in RFC5462,
maybe we should also update this section accordingly?

Note 1:
AFAIK Juniper JUNOS & Nokia SR-OS have built-in support to match
against multiple prefixes in the same rule for a long time.
We also have this functionality in Arista EOS(as traffic-policies) &
Cisco IOS-XR(as hybrid ACLs) for years.

Thanks!
Nat




On Sun, May 21, 2023 at 9:23 PM <[e-mail]> wrote:
>
>
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories. This Internet-Draft is a work item of the Inter-Domain Routing
> (IDR) WG of the IETF.
>
>    Title           : BGP Flow Specification Version 2
>    Authors         : Susan Hares
>                      Donald Eastlake
>                      Chaitanya Yadlapalli
>                      Sven Maduschke
>    Filename        : draft-ietf-idr-flowspec-v2-02.txt
>    Pages           : 69
>    Date            : 2023-05-21
>
> Abstract:
>    BGP flow specification version 1 (FSv1), defined in RFC 8955, RFC
>    8956, and RFC 9117 describes the distribution of traffic filter
>    policy (traffic filters and actions) distributed via BGP.  Multiple
>    applications have used BGP FSv1 to distribute traffic filter policy.
>    These applications include the following: mitigation of denial of
>    service (DoS), enabling traffic filtering in BGP/MPLS VPNs,
>    centralized traffic control of router firewall functions, and SFC
>    traffic insertion.
>
>    During the deployment of BGP FSv1 a number of issues were detected
>    due to lack of consistent TLV encoding for rules for flow
>    specifications, lack of user ordering of filter rules and/or actions,
>    and lack of clear definition of interaction with BGP peers not
>    supporting FSv1.  Version 2 of the BGP flow specification (FSv2)
>    protocol addresses these features.  In order to provide a clear
>    demarcation between FSv1 and FSv2, a different NLRI encapsulates
>    FSv2.
>
> The IETF datatracker status page for this Internet-Draft is:
> https://datatracker.ietf.org/doc/draft-ietf-idr-flowspec-v2/
>
> There is also an HTML version available at:
> https://www.ietf.org/archive/id/draft-ietf-idr-flowspec-v2-02.html
>
> A diff from the previous version is available at:
> https://author-tools.ietf.org/iddiff?url2=draft-ietf-idr-flowspec-v2-02
>
> Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts
>
>
> _______________________________________________
> Idr mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/idr