Re: [OPSEC] New Work: Protecting the control plane

On Tue, Jan 11, 2011 at 11:00 PM, Ronald Bonica <rbonica@juniper.net> wrote:

> Vishwas,
>
> I think that draft-ietf-opsec-filter-caps answers a slightly different
> question. It has been three years since I looked at that draft, but as I
> recall, it attempts to describe all filtering capabilities that should be
> available on a router.
>

The capabilities drafts were all about "The Router Can do X [filtering]" to
enable testing.

>
> Today, we are asking a more specific question. Specifically we want to know
> what we should do to protect a router's control plane from either a) insider
> attack or b) attack from outsiders spoofing inside source addresses.
>

Filtering things aimed at the control plane, using features enumerated in
the capabilities drafts, would be one use case.

>
> That said, I would be very happy to see somebody resume work on
> draft-ietf-opsec-filter-caps. As I recall, the IESG comments were extensive.
> So, the person signing up for that task should be ready for lots of work.
>
>
I'll go back and have a look at the IESG comments....but I think, at a
WG/AD/Charter level we'd need to revisit the roll of capabilities drafts ...
do they fit in the current charter ?  Are they useful ?  Will they
be used/change anything for the better ?    Perhaps you, I, Chris, Joel and
Joe should *talk* ?

---George

>                                                     Ron
>
>
>
> > -----Original Message-----
> > From: Vishwas Manral [mailto:vishwas.ietf@gmail.com]
> > Sent: Tuesday, January 11, 2011 1:19 PM
> > To: Ronald Bonica
> > Cc: opsec@ietf.org
> > Subject: Re: [OPSEC] New Work: Protecting the control plane
> >
> > Hi Ron,
> >
> > We already had a draft with that and a lot more:
> > http://tools.ietf.org/html/draft-ietf-opsec-filter-caps-09
> >
> > We could resurrect it, if that is a requirement. It had gone all the
> > way to the IESG.
> >
> > Thanks,
> > Vishwas
> >
> > On Tue, Jan 11, 2011 at 10:01 AM, Ronald Bonica <rbonica@juniper.net>
> > wrote:
> > > There are a few simple things that we can do (e.g., rate limit TCP
> > SYNs)
> > >
> > >                                    Ron
> > >
> > >
> > >> -----Original Message-----
> > >> From: Vishwas Manral [mailto:vishwas.ietf@gmail.com]
> > >> Sent: Tuesday, January 11, 2011 12:47 PM
> > >> To: Ronald Bonica
> > >> Cc: opsec@ietf.org
> > >> Subject: Re: [OPSEC] New Work: Protecting the control plane
> > >>
> > >> Hi Ron,
> > >>
> > >>
> > >> > - attacks from those spoofing the source address of a legitimate
> > >> control plane peer
> > >> This can be caught by authentication, mechanisms also using the
> > source
> > >> address as a part of the hash.
> > >>
> > >> > - attacks from legitimate control plane peers (that might be
> > >> compromised or otherwise misbehaving)
> > >> This is considerably harder to know for IGP's. For BGP we can verify
> > >> the origin . One thing that can be done is Public Key Cryptography.
> > >> There are mechanisms available for the same already, however the
> > >> documents are experimental.
> > >>
> > >> The question however is how important are these issues for the
> > >> operators to tackle?
> > >>
> > >> Thanks,
> > >> Vishwas
> > >
> _______________________________________________
> OPSEC mailing list
> OPSEC@ietf.org
> https://www.ietf.org/mailman/listinfo/opsec
>