[OPSEC] Comments on draft-jdurand-bgp-security

[Ronald Bonica <[e-mail]>]

Authors,

Thanks for writing draft-jdurand-bgp-security. On the whole, it is a very well written document. The following are a few comments:

Section 2.5
============
Somewhere between Section 2 and Section 3, you should mention that the BGP process needs to be protected from stray packets. Protection can be achieved by applying a forwarding plane ACL. The ACL accepts all packets that meet the following criteria:

- directed to TCP port 179 on the local device
- sourced from a known BGP neighbor

It discards all packets directed to TCP port 179 on the local device and sourced from an address not known to be a BGP neighbor.


Section 3.1
============
In Section 3.1, you talk about MD5 Password Protection. This make the reader think that you are talking about RFC 2385. However, the reference is to RFC 5925 (TCP-AO). Please be clear about which you are recommending.

In this regard, we have a dilemma. The IETF has obsoleted RFC 2385 and replaced it with RFC 5925. However, to the best of my knowledge, there are no commercially available implementations.

Section 4.1.1.1
===============
Rather than listing every IPv4 special-use address, you might want to simply refer the reader to RFC 5735 and 5736.

Section 4.1.1.2
================
Rather than listing every IPv6 special-use address, you might want to refer the reader to http://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xml. It might be better to refer the reader to the registry, because it will be kept up to date in the future.


Section 4.1.3
=============
It is true that most ISPs will not accept advertisements beyond a certain level of specificity. However, this is an issue to be worked out between the operators, and not an issue for standardization.

--------------------------
Ron Bonica
vcard:       www.bonica.org/ron/ronbonica.vcf