Re: [mpls] MPLS-RT review of draft-bonica-mpls-self-ping

[Ronald Bonica <[e-mail]>]

Lizhong,

I think that we are misunderstanding each other’s words.

RFC 6335 divides UDP ports into the following ranges:


-          Well-known (0-1023)

-          User (1024-49151)

-          Dynamic (49152-65535)

The draft says that the UDP source and destination ports will be selected from the dynamic range. It *does not* say that UDP port numbers will be selected dynamically.

When writing the draft, I was assuming that a typical implementation selects a port form the dynamic range and sends all MPLS Self-ping traffic to that port. Therefore, the user could provision an ACL for that port.

I *was not* assuming that the application would select a different port each time that it ran MPLS-ping. This would make it very difficult to ACL MPLS Self-ping traffic.

If you like, I can make that assumption explicit in the draft.

                                                                 Ron


From: [e-mail] [mailto:[e-mail]]
Sent: Thursday, March 12, 2015 10:21 AM
To: Ronald Bonica; mpls-chairs; draft-bonica-mpls-self-ping; mpls-ads
Cc: mpls
Subject: RE: MPLS-RT review of draft-bonica-mpls-self-ping


For section 6, originally ingress could identify the LSP ping packet with well-known UDP port, and configure ACL rule to reduce risk of attack. But now it is more difficult to filter the packet with access list, which may increase the risk.

Lizhong,

Implementation know the port(s) upon which they send MPLS Self-ping traffic. They can configure ACLs on that port or those ports. ACLs can protect dynamic ports, so long as they are predictable.

[Lizhong] yes, it is possible to install ACL ruls everytime when MPLS self-ping is initiated. That is different with original implementation which is static ACL rule with well-know port. So it is better to describe how to reduce the risk of DoS if  MPLS self-ping is implemented.

Lizhong

                                                                    Ron