IETF Logo Mail Archive

Re: [mpls] MPLS-RT review of draft-bonica-mpls-self-ping

Ronald Bonica <rbonica@juniper.net> Thu, 12 March 2015 02:50 UTC

Return-Path: <rbonica@juniper.net>
X-Original-To: mpls@ietfa.amsl.com
Delivered-To: mpls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 208721A89FE for <mpls@ietfa.amsl.com>; Wed, 11 Mar 2015 19:50:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -101.901
X-Spam-Level:
X-Spam-Status: No, score=-101.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dbY9oTaK23dB for <mpls@ietfa.amsl.com>; Wed, 11 Mar 2015 19:50:32 -0700 (PDT)
Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2on0133.outbound.protection.outlook.com [65.55.169.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A64D01A89FC for <mpls@ietf.org>; Wed, 11 Mar 2015 19:50:31 -0700 (PDT)
Received: from CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) by CO1PR05MB442.namprd05.prod.outlook.com (10.141.73.146) with Microsoft SMTP Server (TLS) id 15.1.106.15; Thu, 12 Mar 2015 02:50:29 +0000
Received: from CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.61]) by CO1PR05MB442.namprd05.prod.outlook.com ([169.254.13.61]) with mapi id 15.01.0106.007; Thu, 12 Mar 2015 02:50:29 +0000
From: Ronald Bonica <rbonica@juniper.net>
To: "lizho.jin@gmail.com" <lizho.jin@gmail.com>, mpls-chairs <mpls-chairs@tools.ietf.org>, draft-bonica-mpls-self-ping <draft-bonica-mpls-self-ping@tools.ietf.org>, mpls-ads <mpls-ads@tools.ietf.org>
Thread-Topic: MPLS-RT review of draft-bonica-mpls-self-ping
Thread-Index: AQHQUBZCJvzLYgooPEWTjWPAAzQbFJ0V/JCHgAI/60A=
Date: Thu, 12 Mar 2015 02:50:28 +0000
Message-ID: <CO1PR05MB44294439D8B4C216054A1E5AE060@CO1PR05MB442.namprd05.prod.outlook.com>
References: <54EC4776.5040402@pi.nu> <2015031100220789189743@gmail.com>
In-Reply-To: <2015031100220789189743@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [66.129.241.13]
authentication-results: gmail.com; dkim=none (message not signed) header.d=none;
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:CO1PR05MB442;
x-forefront-antispam-report: BMV:1; SFV:NSPM; SFS:(10019020)(6009001)(19609705001)(19580395003)(230783001)(74316001)(16236675004)(122556002)(66066001)(33656002)(40100003)(2656002)(99286002)(50986999)(54356999)(87936001)(76176999)(19300405004)(77156002)(15975445007)(102836002)(86362001)(2501003)(92566002)(76576001)(2950100001)(62966003)(46102003)(106116001)(2900100001); DIR:OUT; SFP:1102; SCL:1; SRVR:CO1PR05MB442; H:CO1PR05MB442.namprd05.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en;
x-microsoft-antispam-prvs: <CO1PR05MB442F69EA5D5FA02BA272F15AE060@CO1PR05MB442.namprd05.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:;
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(5002009)(5005006); SRVR:CO1PR05MB442; BCL:0; PCL:0; RULEID:; SRVR:CO1PR05MB442;
x-forefront-prvs: 05134F8B4F
Content-Type: multipart/alternative; boundary="_000_CO1PR05MB44294439D8B4C216054A1E5AE060CO1PR05MB442namprd_"
MIME-Version: 1.0
X-OriginatorOrg: juniper.net
X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Mar 2015 02:50:28.7972 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR05MB442
Archived-At: <http://mailarchive.ietf.org/arch/msg/mpls/k-zEY7G7zAnCe0ukXy52nZ0VhtM>
Cc: mpls <mpls@ietf.org>
Subject: Re: [mpls] MPLS-RT review of draft-bonica-mpls-self-ping
X-BeenThere: mpls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Multi-Protocol Label Switching WG <mpls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mpls>, <mailto:mpls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/mpls/>
List-Post: <mailto:mpls@ietf.org>
List-Help: <mailto:mpls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mpls>, <mailto:mpls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 12 Mar 2015 02:50:35 -0000

For section 6, originally ingress could identify the LSP ping packet with well-known UDP port, and configure ACL rule to reduce risk of attack. But now it is more difficult to filter the packet with access list, which may increase the risk.

Lizhong,

Implementation know the port(s) upon which they send MPLS Self-ping traffic. They can configure ACLs on that port or those ports. ACLs can protect dynamic ports, so long as they are predictable.

                                                                    Ron

v2.23.0 | Report a Bug | By Email