Re: [PWE3] PWE3 WG adoption of draft-zhang-mpls-tp-pw-oam-config-06

[<[e-mail]>]

Hi  Dave....one remark in-line:

From: [e-mail] [mailto:[e-mail]] On Behalf Of David Allan I
Sent: 22 September 2011 09:29
To: Yaakov Stein; Thomas Nadeau
Cc: [e-mail]
Subject: Re: [PWE3] PWE3 WG adoption of draft-zhang-mpls-tp-pw-oam-config-06

Hi Yaakov:

No argument on management plane configuration.

I was thinking more of the LSP-PING bootstrapping to establish binding.
NH=> This mistake arises because LDP is not a proper co-ps mode layer network.  LDP creates many problems, but here the key point is that there is no proper CP function of signalling that sets-up/tears-down LSPs...the merging LSPs (which are not connections anyway) 'self nucleate'.

Aside=> The CP/MP should tell the trail termination points of a connection that is about to be created what identifier (=SA) to expect in the DP CV OAM messages.  Similarly, the CP/MP should remove this condition when the connection is taken down.  We should not attempt such configuration via the DP OAM messages themselves.

regards, Neil
This email contains BT information, which may be privileged or confidential.
It's meant only for the individual(s) or entity named above. If you're not the intended
recipient, note that disclosing, copying, distributing or using this information
is prohibited. If you've received this email in error, please let me know immediately
on the email address above. Thank you.
We monitor our email system, and may record your emails.
British Telecommunications plc
Registered office: 81 Newgate Street London EC1A 7AJ
Registered in England no: 1800000



 I'd rather move that function to a more trusted adjacency and in the case of LDP signalling for PWs, a configuring east west exchange already exists.

My statement about trust was more along the lines that auto-discovery and trust are somewhat orthogonal concepts. A chain of trust needs to be introduced. A CP adjancency to me scales much better from the point of view of the number of security associations required, as it is one SA for the aggregate of the PWs served by the adjacency....

I'll be the first to admit I've not checked the security provisions in LSP-PING, but if if there is significant provisions, I have signalling and LSP-PING bootstrapping I now require a minimum of two SAs to establish the chain of trust to configure a PW, worse if it is an SA per ME, nightmare if it is an SA per MEP/MIP pair (not relevant to bootstrapping but mentioned the slippery slope we are discussing). We went into some of this in the security section of the TP OAM framework (now RFC 6371)

I hope that is clearer...

Dave



________________________________
From: Yaakov Stein [mailto:[e-mail]]
Sent: Thursday, September 22, 2011 4:12 PM
To: David Allan I; Thomas Nadeau
Cc: [e-mail]
Subject: RE: [PWE3] PWE3 WG adoption of draft-zhang-mpls-tp-pw-oam-config-06
Dave

I actually am closer to Tom on this issue,
but didn't see any reason to fight windmills on this one.

But was surprised at both clauses of your statement.

First, from a pure security PoV, all the management systems I have seen are more trustworthy than most control planes.
And since this is for TP which doesn't even assume an IP forwarding plane let alone IPsec,
then I have to assume that someone is going to start configuring everything using GACh payloads,
which frankly scares me, unless you have armed guards physically viewing all of your network elements.
(You may recall my rants on the lack of any security in MPLS and my futile attempts at pwsec
a few years back.)

Second, "OAM is about trust". Well yes, it is about how much the client layer trusts the server layer
or the customer trusts the service provider, or the boxes trust the fibers.
Or in many cases how little trust there is and how to check up so that you can prove your case of SLA noncompliance.
In any case I don't see the connection between this kind of "trust"
and the kind I think you are talking about in comparing control and management planes.

I trust that you will explain.

Y(J)S

From: [e-mail] [mailto:[e-mail]] On Behalf Of David Allan I
Sent: Wednesday, September 21, 2011 03:08
To: John E Drake; Thomas Nadeau
Cc: [e-mail]
Subject: Re: [PWE3] PWE3 WG adoption of draft-zhang-mpls-tp-pw-oam-config-06

IMO I prefer the trust model of using the CP to set this up and coordinate the end points, and OAM is about trust.

so I support adoption of the draft, it is a move in the right direction

cheers
Dave