[OPSEC] draft-ietf-opsec-blackhole-urpf-00

[Warren Kumari <[e-mail]>]

Hello all,

I have just posted draft-ietf-opsec-blackhole-urpf-00 (ex raft-kumari- 
blackhole-blckhole-02)

I appreciate all of the feedback (and especially the suggested  
text :-)) that people have been supplying and hope that I have  
accurately captured your input -- if not, I *do* apologize, I decided  
to batch up all the changes and they might have gotten away from me.  
Please let me know if I messed up and I will fix it...

Now, for the big question:

In the draft we are are requesting a registered BGP community to be  
used to signal your provider that you want destination based RTBH  
applied to an announced prefix.

There are two viewpoints on this -- I will try to capture them both,  
apologies if I mess this up:
Viewpoint 1:
This should be removed -- different providers will implement RTBH (src  
and dest) in different ways and will provide different capabilities  
(drop on the "edge", only install in a specific region, etc) and so  
there will need to be multiple communities. Getting this info from  
your provider (and having them enable the feature), etc is (and should  
remain) a required step.

Viewpoint 2:
I'd like to keep the registered community -- while different providers  
will support different subsets of this, having a well known way to  
enable this seems good to me. Currently providers support different  
communities for different things (e.g: announce this only to peers,  
set the MED, etc) but there are still some well known (e.g NO_EXPORT)  
communities that the provider probably implements. I dislike being in  
the situation where I am experiencing a DoS attack and have misplaced  
the napkin that I scribbled the secret community on last time. Now,  
while I am down I need to fight my way through Tier 1 - Tier N trying  
to find the magic community to apply for provider X. I'd rather just  
tag an announcement with the registerd RTBH community. If the provider  
doesn't support this, I'm no worse off, if they do, I've bought some  
time.

I'd appreciate any feedback on this, and the rest of the doc. And,  
once again, thnaks to all who have already provided feedback...


W


--
"Go on, prove me wrong. Destroy the fabric of the universe. See if I  
care."  -- Terry Prachett

_______________________________________________
OPSEC mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/opsec