Re: [OPSEC] draft-ietf-opsec-blackhole-urpf-00

[Joel Jaeggli <[e-mail]>]

Warren Kumari wrote:
> Now, for the big question:
> 
> In the draft we are are requesting a registered BGP community to be used
> to signal your provider that you want destination based RTBH applied to
> an announced prefix.

So I presented this idea and both viewpoints in the NANOG isp security
BOF and to be honest I couldn't get a rise out of anyone, They neither
called me a moron nor adopted it as their own...

I suppose one thought would be to carve it out and drop it in a second
draft so we can proceed this document without it. Personally I think a
reserved community has sufficient utility to make it a useful addition
to the toolkit, but reviews here are obviously mixed.

> There are two viewpoints on this -- I will try to capture them both,
> apologies if I mess this up:
> Viewpoint 1:
> This should be removed -- different providers will implement RTBH (src
> and dest) in different ways and will provide different capabilities
> (drop on the "edge", only install in a specific region, etc) and so
> there will need to be multiple communities. Getting this info from your
> provider (and having them enable the feature), etc is (and should
> remain) a required step.
> 
> Viewpoint 2:
> I'd like to keep the registered community -- while different providers
> will support different subsets of this, having a well known way to
> enable this seems good to me. Currently providers support different
> communities for different things (e.g: announce this only to peers, set
> the MED, etc) but there are still some well known (e.g NO_EXPORT)
> communities that the provider probably implements. I dislike being in
> the situation where I am experiencing a DoS attack and have misplaced
> the napkin that I scribbled the secret community on last time. Now,
> while I am down I need to fight my way through Tier 1 - Tier N trying to
> find the magic community to apply for provider X. I'd rather just tag an
> announcement with the registerd RTBH community. If the provider doesn't
> support this, I'm no worse off, if they do, I've bought some time.