Re: [Idr] New Version Notification for draft-liang-idr-bgp-flowspec-time-00.txt

Hi Jianjie,

I can understand the desire to have particular filter rules active on particular times of the day. I am not convinced that sending timing context along with a BGP NLRI is the way to achieve this.

A relevant difference between ACL and BGP is that ACL tends to be static and BGP is dynamic by nature.

By announcing and withdrawing a BGP NLRI you can make a rule dynamic, unless there is an absolute need to have activation/de-activation in msec sync’d.
Hence, we have a solution with BGP that is dynamic and provides relative network wide synchronised network behaviour (announce/withdraw), but it is indeed not synchronous to the msec.  

Making network control sync on msec is not easy and a valid question is if BGP should be part in such a goal? 
(There are also operational aspects to troubleshoot the network in case of unexpected behaviour … )

Brgds,
G/

> On 23 Oct 2015, at 08:35, Youjianjie <youjianjie@huawei.com> wrote:
> 
> Hi Gunter,
>  
> We collect the requirements from our customers. Actually traditional ACLs already support similar functions.
> For the last sentence, could you please explain a little more? Why do you think it is complex?
>  
> Thanks,
> Jianjie
>  
> 发件人: Gunter Van De Velde [mailto:guntervandeveldecc@icloud.com] 
> 发送时间: 2015年10月19日 15:32
> 收件人: Youjianjie
> 抄送: idr@ietf.org
> 主题: Re: [Idr] New Version Notification for draft-liang-idr-bgp-flowspec-time-00.txt
>  
> Hi Youjianjie,
>  
> I would expect a flow spec rule to be valid for consumption from the moment its originated from a flow spec controller until it is withdrawn by the controller. In the text proposed you relate to different forwarding delays for a router to receive the flow spec rule and hence justifies a need for new community to specify 'valid-time' for the flow spec route. This seems as a pretty light reason for such a complex proposed logical machine.
>  
> Be well,
> G/
> Sent from iCloud
> 
> On Oct 19, 2015, at 04:08 AM, Youjianjie <youjianjie@huawei.com <mailto:youjianjie@huawei.com>> wrote:
> 
> Dear all,
> 
> This document proposes a new BGP path attribute called "Flow Extended Attribute", which carries expected valid period information for a FlowSpec rule.
> Could you please review? Your comments are welcome.
> 
> Thanks,
> Jianjie
> 
> -----邮件原件-----
> 发件人: internet-drafts@ietf.org <mailto:internet-drafts@ietf.org> [mailto:internet-drafts@ietf.org <mailto:internet-drafts@ietf.org>] 
> 发送时间: 2015年10月19日 9:58
> 收件人: Liangqiandeng; Zhuangshunwan; Youjianjie; Zhuangshunwan; Youjianjie; Liangqiandeng
> 主题: New Version Notification for draft-liang-idr-bgp-flowspec-time-00.txt
> 
> 
> A new version of I-D, draft-liang-idr-bgp-flowspec-time-00.txt
> has been successfully submitted by Jianjie You and posted to the IETF repository.
> 
> Name:                draft-liang-idr-bgp-flowspec-time
> Revision:    00
> Title:                BGP FlowSpec with Time Constraints
> Document date:        2015-10-18
> Group:                Individual Submission
> Pages:      9
> URL: https://www.ietf.org/internet-drafts/draft-liang-idr-bgp-flowspec-time-00.txt <https://www.ietf.org/internet-drafts/draft-liang-idr-bgp-flowspec-time-00.txt>
> Status: https://datatracker.ietf.org/doc/draft-liang-idr-bgp-flowspec-time/ <https://datatracker.ietf.org/doc/draft-liang-idr-bgp-flowspec-time/>
> Htmlized: https://tools.ietf.org/html/draft-liang-idr-bgp-flowspec-time-00 <https://tools.ietf.org/html/draft-liang-idr-bgp-flowspec-time-00>
> 
> 
> Abstract:
> The BGP flow specification (FlowSpec) is an additional tool to
> mitigate the effects of Distributed Denial of Service (DDoS) attacks.
> Since DDoS attacks are dynamic, filtering of a flow may only be
> necessary for some specified time, and be undesirable at other times.
> This document proposes a new BGP path attribute called "Flow Extended
> Attribute", which carries expected valid period information for a
> FlowSpec rule. So network administrators can control certain types
> of traffic in a specified period.
> 
> 
> 
> 
> 
> Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.
> 
> The IETF Secretariat
> 
> _______________________________________________
> Idr mailing list
> Idr@ietf.org <mailto:Idr@ietf.org>
> https://www.ietf.org/mailman/listinfo/idr <https://www.ietf.org/mailman/listinfo/idr>