[OPSEC] some thoughts on draft-jdurand-bgp-security-02.txt

[joel jaeggli <[e-mail]>]

since this is on the agenda I'd thought I'd add some comments

section-4 worth noting citing/rfc 6192

Protecting the Router Control Plane

section 5.1.2.3

these sections are too deep. needs better organization, e.g. section 5
is actually probably two or three sessions.

e.g.

5.1.1. Prefixes that MUST not be routed by definition

Most of Regional
Internet Registries do also operate an IRR and can control that
registered routes conform to allocations made.


3 of 5

should cite

http://tools.ietf.org/html/rfc4012

rpsl

would be helpful to cite irrtoolset provide an example in an appendix.

the tier one example isn't that helpful would be more interesting to
cite the example for a customer vantge point e.g. managing objects so
that your upstreams will accept them.

----

rpki section needs to be fleshed out e.g. what you do with it, how it's
used what it can't be used for needs examples.

The rest of this
section assumes the reader understands all technologies associated
with SIDR.

Whut???????

5.1.4

mixes customer prefixes filtering policy with local prefixes…

issues around loop-detection (e.g. disconnected islands) vs more
specific(s) e.g. hijacking.

outbound filtering (prefix advertisement)

5.3 and later

prefer to think of these things as import/export policy rather than
describing everything as filter.

8.

o Do not accept overly long AS path prepending from the customer.

going to have to scope that.