Re: [OPSEC] Comments on draft-jdurand-bgp-security-02

[Gert Doering <[e-mail]>]

Hi,

On Thu, Sep 27, 2012 at 12:29:21PM +0000, David Freedman wrote:
> I'm not aware of any implementations which can achieve
> this in a scalable way, are the authors? at present I
> would have to statically configure a next hop for each peer,
> not fun.

Both Cisco and Juniper can do

route-map foo permit 10
  set ip(v6) next-hop peer-address

(dunno the exact Juniper syntax, but have been told it can be done)

DFN(680) stated on the DECIX list that the have been doing this on
Cisco "since ever" and it works.

> Also, are you aware that some networks inject the IXP
> LAN into their IGP for the purposes of TE? (I.e leaving
> the IXP LAN next hop present in their iBGP and then
> doing MPLS TE on this LAN as opposed to next-hop-self
> on the border where all peering networks are collapsed
> into a single loopback)

Yeah, I did.  At some point.

Maybe we need to add a bit more language to the point of "if you
need to deviate from these recommendations, understand why you are
doing this, and then feel free to do so" (= "SHOULD" normative
language).

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: [phone]            USt-IdNr.: DE813185279