Re: [OPSEC] draft-ietf-opsec-blackhole-urpf-00

> Now, for the big question:
>
> In the draft we are are requesting a registered BGP community to be  
> used to signal your provider that you want destination based RTBH  
> applied to an announced prefix.
>
> There are two viewpoints on this -- I will try to capture them both,  
> apologies if I mess this up:
> Viewpoint 1:
> This should be removed -- different providers will implement RTBH  
> (src and dest) in different ways and will provide different  
> capabilities (drop on the "edge", only install in a specific region,  
> etc) and so there will need to be multiple communities. Getting this  
> info from your provider (and having them enable the feature), etc is  
> (and should remain) a required step.
>

Viewpoint 1 is mine..  I've seen providers with 10 communities
or more, and I'm not sure that defining well-known ones fixes
anything.

I too, as you might imagine, agree with Warren that we'd very
much like to see what the WG thinks about this.

-danny

> Viewpoint 2:
> I'd like to keep the registered community -- while different  
> providers will support different subsets of this, having a well  
> known way to enable this seems good to me. Currently providers  
> support different communities for different things (e.g: announce  
> this only to peers, set the MED, etc) but there are still some well  
> known (e.g NO_EXPORT) communities that the provider probably  
> implements. I dislike being in the situation where I am experiencing  
> a DoS attack and have misplaced the napkin that I scribbled the  
> secret community on last time. Now, while I am down I need to fight  
> my way through Tier 1 - Tier N trying to find the magic community to  
> apply for provider X. I'd rather just tag an announcement with the  
> registerd RTBH community. If the provider doesn't support this, I'm  
> no worse off, if they do, I've bought some time.
>
> I'd appreciate any feedback on this, and the rest of the doc. And,  
> once again, thnaks to all who have already provided feedback...

_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec