Re: [RPSEC] BGP Security Requirements v08

>The major ISPs have important major customers and peer.  For example
>they would not want their routing corrupted by a bad route to a major
>content provider.  Therefore many major providers will only accept
>these major customer and peer routes from a very limited set of ISPs.

I hear you about the Internet mostly just works.

But we seem to have p-l-e-n-t-y of publically discussed examples of
cases where the trust structure did not not serve us well.

Furthermore, from what major ISP have said, what is said by others
about major ISPs and from the analyses of public data of some incidents,
it seems the case that some major ISPs (Spring comes to mind?) do not
filter well enough to prevent some noticable traffic redirection.
These have been accidents so far, but provide worked examples of
how bad the problem can get.

Relying on the ISP trust and policies is mostly good enough for
mostly just works.

>Add some authentication and you may have further improviment in the
>reliability of routing information.  Don't allow that to cross the
>major ISPs and the authenticaion is of very little use for ISPs.

I agree with you here!  But I don't think anyone is talking about
not allowing auth info to cross major ISPs.  We're mostly arguing
how strong a requirement to make the ability to transit un-upgraded
ISPs: MUST, SHOULD, or MAY.

--Sandy

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec