draft-mjsraman-l2vpn-vpls-tictoc-label-hop-00.txt ...

[Robert Raszuk <[e-mail]>]

I have read the draft-mjsraman-l2vpn-vpls-tictoc-label-hop-00.txt.

It proposed an interesting solution to apply algorithmically computed 
VPN lable (for L2VPNs, but also possible for L3VPN) where inter-as 
option C is used.

However I have a fundamental question .. from who the draft is 
protecting the inter-as service ?

Who other then participating ISPs can spoof a value of VPN label ? If 
the solution is protecting from ISPs itself then I think it does not 
help at all as corresponding ISPs/SPs still have full access to their 
PEs and could inject packets to VPN sites at will.

Moreover main issue with option C is not security (at least for the last 
10+ years). Main issue with option C and MPLS is that participating 
providers need to inject into each other's network all of their 
participating PE's /32 addresses so the end to end MPLS LSP can be 
build. Originally that was recommended to be done by mutual 
redistribution to the IGP .. now the general recommendation is to use 
labeled BGP (both IBGP and EBGP).

So fundamental question to the authors ... who is the potential 
attacker/spoofer this draft is aiming to protect from ?

Best regards,
R.