Re: [mpls] MPLS-RT review of draft-bonica-mpls-self-ping

[Ron Bonica <[e-mail]>]

Ack.

I will catch this in the next draft version.

                              Ron


> -----Original Message-----
> From: Loa Andersson [mailto:[e-mail]]
> Sent: Friday, March 13, 2015 4:02 AM
> To: Ronald Bonica; [e-mail]; mpls-chairs; draft-bonica-mpls-self-
> ping; mpls-ads
> Cc: mpls
> Subject: Re: [mpls] MPLS-RT review of draft-bonica-mpls-self-ping
> 
> Ron,
> 
> The MPLS-RT review spawned some discussion on access lists. I could not
> remember what you said about access lists in the draft so I checked.
> Quick search "access" and "ACL" and found that you do not mention access
> lists at all. Maybe you should after the discussion here.
> 
> /Loa
> 
> On 2015-03-13 08:34, Ronald Bonica wrote:
> > Lizhong,
> >
> > I think that we are misunderstanding each other's words.
> >
> > RFC 6335 divides UDP ports into the following ranges:
> >
> > -Well-known (0-1023)
> >
> > -User (1024-49151)
> >
> > -Dynamic (49152-65535)
> >
> > The draft says that the UDP source and destination ports will be
> > selected from the dynamic range. It **does not** say that UDP port
> > numbers will be selected dynamically.
> >
> > When writing the draft, I was assuming that a typical implementation
> > selects a port form the dynamic range and sends all MPLS Self-ping
> > traffic to that port. Therefore, the user could provision an ACL for
> > that port.
> >
> > I **was not** assuming that the application would select a different
> > port each time that it ran MPLS-ping. This would make it very
> > difficult to ACL MPLS Self-ping traffic.
> >
> > If you like, I can make that assumption explicit in the draft.
> >
> >                                                                   Ron
> >
> > *From:*[e-mail] [mailto:[e-mail]]
> > *Sent:* Thursday, March 12, 2015 10:21 AM
> > *To:* Ronald Bonica; mpls-chairs; draft-bonica-mpls-self-ping;
> > mpls-ads
> > *Cc:* mpls
> > *Subject:* RE: MPLS-RT review of draft-bonica-mpls-self-ping
> >
> >     For section 6, originally ingress could identify the LSP ping packet
> >     with well-known UDP port, and configure ACL rule to reduce risk of
> >     attack. But now it is more difficult to filter the packet with
> >     access list, which may increase the risk.
> >
> >         Lizhong,
> >
> >         *//*
> >
> >         */Implementation know the port(s) upon which they send MPLS
> >         Self-ping traffic. They can configure ACLs on that port or those
> >         ports. ACLs can protect dynamic ports, so long as they are
> >         predictable./*
> >
> >         [Lizhong] yes, it is possible to install ACL ruls everytime when
> >         MPLS self-ping is initiated. That is different with original
> >         implementation which is static ACL rule with well-know port. So
> >         it is better to describe how to reduce the risk of DoS if MPLS
> >         self-ping is implemented.
> >
> >         Lizhong
> >
> >         **
> >
> >         */
> >         Ron/*
> >
> >         *//*
> >
> >
> >
> > _______________________________________________
> > mpls mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/mpls
> >
> 
> --
> 
> 
> Loa Andersson                        email: [e-mail]
> Senior MPLS Expert                          [e-mail]
> Huawei Technologies (consultant)     phone: [phone]