[mpls] Roman Danyliw's Discuss on draft-ietf-mpls-egress-protection-framework-06: (with DISCUSS and COMMENT)

[Roman Danyliw via Datatracker <[e-mail]>]

Roman Danyliw has entered the following ballot position for
draft-ietf-mpls-egress-protection-framework-06: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-mpls-egress-protection-framework/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

A few questions about the Security Considerations:

(1) Section 11.  I appreciate that this a framework document that is trying to
be generic.  Section 4 (and others) seem to lay out generic requirements. 
However, this Security Considerations section is both vague on the protocol
choices (understandable) and the security services/properties they would have
(the gap).   For example, “The general security measures of the protocols
SHOULD be used whenever applicable.” and “The available security measures of
the chosen protocol SHOULD be used to achieve a secured session between the two
routers.”  Some discussion of what a “secured session” would look like would be
helpful.

(2) Section 11.  What are the elements and enablers of “a certain level of
trust … [being] established between the routers for the protocols to run
securely”?


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

(3) Section 4.  Per “The framework MUST consider minimizing disruption during
deployment”, why is this MUST only to _consider_ minimizing rather than
actually minimizing the disruption?

(4) Section 5.7.  Per “a globally unique IPv4/v6 address  is assigned to a
protected egress {E, P} as the identifier of the protected egress {E, P}”, I
recommend being explicit and saying and s/IPv4\\v6/IPv4 or v6/

(5) Section 9.  I’m missing something obvious -- what is a “label table
pe2.mpls”?