Re: [Idr] IETF LC for IDR-ish document <draft-ietf-grow-bgp-reject-05.txt> (Default EBGP Route Propagation Behavior Without Policies) to Proposed Standard

Job Snijders <job@ntt.net> Thu, 20 April 2017 08:53 UTC

Return-Path: <job@instituut.net>
X-Original-To: idr@ietfa.amsl.com
Delivered-To: idr@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E9DB912EB8F for <idr@ietfa.amsl.com>; Thu, 20 Apr 2017 01:53:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.919
X-Spam-Level:
X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O_y2PCC0qFJ2 for <idr@ietfa.amsl.com>; Thu, 20 Apr 2017 01:53:36 -0700 (PDT)
Received: from mail-wm0-f46.google.com (mail-wm0-f46.google.com [74.125.82.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D81212EB84 for <idr@ietf.org>; Thu, 20 Apr 2017 01:53:35 -0700 (PDT)
Received: by mail-wm0-f46.google.com with SMTP id r190so1402474wme.1 for <idr@ietf.org>; Thu, 20 Apr 2017 01:53:35 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=gDA1dECl+SIAj3n5AhFjAPTJ99maHHnWj0canYItITY=; b=kFP7AWc5F16rzl2Re3c1aw3lL87GqXf8J8VZRXeyYm2ucjvHkDgEQL1rwfXTo6xBsJ I5T/ZBO601lmS+93jfG4UO2Xfd96yFLwuzxnjSiqBu/CItuiPG41cX3PaqSQMsggx4u4 QeFyfJplidIfvxKjQCpy4t8YSjRlAnRchSik7OLSaqfopvaoe0TAG+JixyOpuWSwN6TU XbQoUpFn2M0WZjsPEeHOCzgB47YTDknjnPIm/BAJz9VDABCzfyrVNSC0Bk219Cs6Sn8G kBfYFtw5HiI3uLIbJuFfevYgWkx55F7Um0ULCm9KGPSYyBW1llSuAHLpGS95BEpE07Sr Frkg==
X-Gm-Message-State: AN3rC/7sLIa//TdxUWa1TAqYRETs+x2twHpAKRDHkMz39YyK4brnHD6B 1qEP93sAv6Ul8w==
X-Received: by 10.28.21.13 with SMTP id 13mr2047483wmv.118.1492678414455; Thu, 20 Apr 2017 01:53:34 -0700 (PDT)
Received: from localhost ([2001:67c:208c:10:4cc4:bdef:de0c:32e0]) by smtp.gmail.com with ESMTPSA id f64sm7192072wmg.2.2017.04.20.01.53.25 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 20 Apr 2017 01:53:25 -0700 (PDT)
Date: Thu, 20 Apr 2017 10:53:16 +0200
From: Job Snijders <job@ntt.net>
To: "Acee Lindem (acee)" <acee@cisco.com>
Cc: Keyur Patel <keyur@arrcus.com>, "John G. Scudder" <jgs@juniper.net>, "idr@ietf.org" <idr@ietf.org>, Hares Susan <shares@ndzh.com>
Message-ID: <20170420085316.g4ktua67iar5nstl@hanna.meerval.net>
References: <D4E812E8-AA7B-4EA2-A0AC-034AA8922306@juniper.net> <9047A5A0-ED12-43C2-B2C5-D2A71CBB4373@arrcus.com> <D51D46A7.A9732%acee@cisco.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <D51D46A7.A9732%acee@cisco.com>
X-Clacks-Overhead: GNU Terry Pratchett
User-Agent: NeoMutt/20170306 (1.8.0)
Archived-At: <https://mailarchive.ietf.org/arch/msg/idr/vmVQkImGKIRCpSWEZA5JLAfF4DY>
Subject: Re: [Idr] IETF LC for IDR-ish document <draft-ietf-grow-bgp-reject-05.txt> (Default EBGP Route Propagation Behavior Without Policies) to Proposed Standard
X-BeenThere: idr@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Inter-Domain Routing <idr.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/idr>, <mailto:idr-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/idr/>
List-Post: <mailto:idr@ietf.org>
List-Help: <mailto:idr-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/idr>, <mailto:idr-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 20 Apr 2017 08:53:38 -0000

On Wed, Apr 19, 2017 at 08:58:50PM +0000, Acee Lindem (acee) wrote:
> I would agree with Keyur, For better or worse, our Cisco NX-OS BGP
> implementation does not require configuration of a peer policy.
> 
> In fact, this requirement is contrary to some of the auto-discovery
> mechanisms we are exploring where only knowledge of the mutual address
> families is required.

I know Cisco has been trying hard to market NX-OS as a data-center
centric device, not to be used on 'the Internet', however, folks do
connect NX-OS devices to the internet and this can result in pain for
others [1], especially when the defaults are insecure.

Kind regards,

Job

[1]: https://www.ietf.org/mail-archive/web/idr/current/msg16703.html