Re: [mpls] Roman Danyliw's Discuss on draft-ietf-mpls-egress-protection-framework-06: (with DISCUSS and COMMENT)

[Yimin Shen <[e-mail]>]

Hi Roman,

We are planning to update the "Security Considerations" section as below to address your suggestions. Please let us know if you can agree on this and clear the discuss state.  

-----

       The framework in this document involves rerouting traffic around an egress node or link failure, via a bypass path from a PLR to a protector, and ultimately to a backup egress router. Some control plane protocols may be used between these routers to facilitate the establishment of egress protection. The general security measures of the protocols SHOULD be used whenever applicable. In particular, the framework requires a service label distribution protocol between an egress router and a protector. The security measures of the chosen protocol SHOULD be used to achieve a secured session between the two routers. Common secure measures include authentication methods and password-based methods. This framework does not foresee requiring additional security measures for these protocols. The security aspects SHOULD be defined in the protocol-specific documents.

       Also, the PLR, protector, and backup egress router are located close to the protected egress router, and normally in the same administrative domain. If they are not in the same administrative domain, a certain level of trust MUST be established between them in order for the protocols to be allowed and run securely across the domain boundary. The forwarding performed by the routers in the data plane is also anticipated, as part of the planning of egress protection.

       In one possible case, the egress link between an egress router and a CE could become a point of attack. An attacker that gains control of the CE might use it to simulate link failures and trigger constant and cascading activities in the network. Such attack could occur regardless of the existence of egress protection. If egress link protection is in place, the attack might also trigger egress link protection activities. As a general solution to defeat the attack, a damping mechanism SHOULD be used by the egress router to promptly suppress the services associated with the link or CE. The egress router would stop advertising the services, essentially detaching them from the network and eliminating the effect of the simulated link failures.

Thanks,

-- Yimin

On 7/12/19, 9:59 AM, "Yimin Shen" <[e-mail]> wrote:

    the same manner as that of an inter-AS protocols