Re: [Idr] I-D Action: draft-ietf-idr-large-community-01.txt

[t.petch <[e-mail]>]

----- Original Message -----
From: "Jakob Heitz (jheitz)" <[e-mail]>
Sent: Friday, October 14, 2016 12:22 AM

Tom

I understand your issue and I believe every major router vendor
does too.

What to do about it?

The router cannot check if the first word is a valid ASN
or if the ASN is the intended one. Even if the ASN is correct,
The rest of the community could still be junk.

A router vendor can provide tools to make it easier
for operators to be safe with communities, large or regular.

For example, there is a knob 'send-community' that must be
configured before a router will send communities on an ebgp
session. Therefore, an operator who is unaware of the problem
will not spray junk. Another tool is the 'peeras' keyword
that allows you to match the peer's ASN in any field of
the community. This makes it easier to write generic filters
in RPL. Excuse me if I'm tooting my own horn, but I do not
believe that this funcionality is unique to Cisco.
You can match private ASN and your own ASN too.

If anyone can suggest more tools, please do.

<tp>

Jakob

I think that Brian well expressed the issue in a post 15 minutes before
yours.

My concern starts with the protocol rather than the implementation,
seeing getting the protocol right as the first step, even if it does not
seem possible at present for a router to enforce the protocol rigidly.
I see BGP as a whole as somewhat weak on security, on authentication and
data integrity, and these things only getting fixed after a disaster or
two.  So I am content to specify a protocol which implementations may or
may not catch up with at a later date.

I agree the vendors can make it easier for an operator to get right and
that they should do so, and this in turn can influence the decision as
to whose products to use but do not want to see that as feeding back
into decisions as to what the protocol should be.

Tom Petch

Thanks,
Jakob.


> -----Original Message-----
> From: Idr [mailto:[e-mail]] On Behalf Of t.petch
> Sent: Thursday, October 13, 2016 1:55 AM
> Julian
>
> I believe I understand the need that you express but the BGP protocol
> does not have the mechanics to express it!
>
> You say
> 'configure with meaning only for me and parties I interact with'
> but BGP has no such mechanism. As Jeff has already explained, an
> optional attribute either gets dropped, which is unlikely to work with
> route reflectors, or it gets passed on and this I-D chooses the option
> that it gets passed on.  So a community that only you and your fellow
> parties understand is let loose on the whole Internet where it is open
> to misinterpretation by everyone else because, e.g., they are
expecting
> an ASN and are getting something else that is private to you.
>
> And the remit of the IETF is to make the Internet as a whole work
better
> so in updating the specification of BGP, the IETF has to consider the
> trade off of something that benefits you and the parties you interact
> with versus the risk of causing some level of damage to the Internet.
>
> Obviously, I hope, I am concerned about the damage; you gain, but
> somewhere else across the globe, someone else's connectivity may fail.
>
> Of course it is possible to define a more sophisticated system that
> allows communities to go so far and no further but that is not the BGP
> we have.
>
> Tom Petch