Re: [mpls] MPLS-RT review of draft-bonica-mpls-self-ping

[Loa Andersson <[e-mail]>]

Ron,

The MPLS-RT review spawned some discussion on access lists. I could not
remember what you said about access lists in the draft so I checked. 
Quick search "access" and "ACL" and found that you do not mention
access lists at all. Maybe you should after the discussion here.

/Loa

On 2015-03-13 08:34, Ronald Bonica wrote:
> Lizhong,
>
> I think that we are misunderstanding each other’s words.
>
> RFC 6335 divides UDP ports into the following ranges:
>
> -Well-known (0-1023)
>
> -User (1024-49151)
>
> -Dynamic (49152-65535)
>
> The draft says that the UDP source and destination ports will be
> selected from the dynamic range. It **does not** say that UDP port
> numbers will be selected dynamically.
>
> When writing the draft, I was assuming that a typical implementation
> selects a port form the dynamic range and sends all MPLS Self-ping
> traffic to that port. Therefore, the user could provision an ACL for
> that port.
>
> I **was not** assuming that the application would select a different
> port each time that it ran MPLS-ping. This would make it very difficult
> to ACL MPLS Self-ping traffic.
>
> If you like, I can make that assumption explicit in the draft.
>
>                                                                   Ron
>
> *From:*[e-mail] [mailto:[e-mail]]
> *Sent:* Thursday, March 12, 2015 10:21 AM
> *To:* Ronald Bonica; mpls-chairs; draft-bonica-mpls-self-ping; mpls-ads
> *Cc:* mpls
> *Subject:* RE: MPLS-RT review of draft-bonica-mpls-self-ping
>
>     For section 6, originally ingress could identify the LSP ping packet
>     with well-known UDP port, and configure ACL rule to reduce risk of
>     attack. But now it is more difficult to filter the packet with
>     access list, which may increase the risk.
>
>         Lizhong,
>
>         *//*
>
>         */Implementation know the port(s) upon which they send MPLS
>         Self-ping traffic. They can configure ACLs on that port or those
>         ports. ACLs can protect dynamic ports, so long as they are
>         predictable./*
>
>         [Lizhong] yes, it is possible to install ACL ruls everytime when
>         MPLS self-ping is initiated. That is different with original
>         implementation which is static ACL rule with well-know port. So
>         it is better to describe how to reduce the risk of DoS if MPLS
>         self-ping is implemented.
>
>         Lizhong
>
>         **
>
>         */
>         Ron/*
>
>         *//*
>
>
>
> _______________________________________________
> mpls mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/mpls
>

-- 


Loa Andersson                        email: [e-mail]
Senior MPLS Expert                          [e-mail]
Huawei Technologies (consultant)     phone: [phone]