Re: [Pals] Stephen Farrell's Discuss on draft-ietf-pals-mc-pon-04: (with DISCUSS)

[Jiangyuanlong <[e-mail]>]

Hi Stephen,

To be clear, it is proposed to add "in a single administrative domain" to the end of "this ICCP application SHOULD only be used in
   well-managed and highly monitored service provider PON access networks..." 
Thus we have the following texts "this ICCP application SHOULD only be used in
   well-managed and highly monitored service provider PON access networks in a single administrative domain".

Typically, the PON network and the MPLS network interconnection as described in the document (for scenarios including FTTx, MSO and mobile backhaul) are under the control of a single service provider. So the proposed change does not inflict any real constraint.

ICCP is a sub-type of LDP protocol (RFC5036), the same security measures of LDP are applicable too, that is, ICCP peer PEs (LDP peers) are in the same MPLS administration domain, access list and authentication mechanisms can be used between the PEs (e.g., all LDP packets are denied by the OLT if they are received from the interfaces connecting the ONUs). As this document is based on ICCP (i.e., LDP), we can use all these mechanisms described in RFC5036 and RFC7275.

Are you satisfied with this resolution? Do you have any suggestions?

Thanks,
Yuanlong


-----Original Message-----
From: Stephen Farrell [mailto:[e-mail]] 
Sent: Wednesday, September 14, 2016 7:53 AM
To: The IESG
Cc: [e-mail]; Andrew G. Malis; [e-mail]; [e-mail]; [e-mail]
Subject: Stephen Farrell's Discuss on draft-ietf-pals-mc-pon-04: (with DISCUSS)

Stephen Farrell has entered the following ballot position for
draft-ietf-pals-mc-pon-04: Discuss

When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-pals-mc-pon/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------


Is this extension to ICCP really compatible with section
10 of RFC7275?  RFC7275 says "It ought not be deployed on or over the public Internet.  ICCP is not intended to be applicable when the Redundancy Group spans PEs in different administrative domains" whereas this draft only refers to the "well-managed" stuff and says nothing about multiple domains, and this draft also refers to public contexts such as telephone poles. Can you justify for me how using ICCP here is safe? (It may well be, but I'm entirely unsure, probably mostly due to my ignorance of PON deployments.)

The same point was made in the secdir review [1] which did get a response. Sadly, I didn't get how the response answered the question. 

   [1] https://www.ietf.org/mail-archive/web/secdir/current/msg06762.html