Re: [RPSEC] BGP Security Requirements v08

In message <20070718194558.D2FBB3F43C@pecan.tislabs.com>
Sandy Murphy writes:
>  
> >The major ISPs have important major customers and peer.  For example
> >they would not want their routing corrupted by a bad route to a major
> >content provider.  Therefore many major providers will only accept
> >these major customer and peer routes from a very limited set of ISPs.
>  
> I hear you about the Internet mostly just works.
>  
> But we seem to have p-l-e-n-t-y of publically discussed examples of
> cases where the trust structure did not not serve us well.
>  
> Furthermore, from what major ISP have said, what is said by others
> about major ISPs and from the analyses of public data of some incidents,
> it seems the case that some major ISPs (Spring comes to mind?) do not
> filter well enough to prevent some noticable traffic redirection.
> These have been accidents so far, but provide worked examples of
> how bad the problem can get.
>  
> Relying on the ISP trust and policies is mostly good enough for
> mostly just works.

This has been true for over a decade.

Back in the mid-1990s ANS days two very major incidents occurred.  One
was the intentional advertisement of very specific routes into PSI for
every DNS TLD servier.  This took out DNS for anyone who beleived
those routes.  It did not affect ANS due to IRR policy.  Another was
announding critical subnets of AOL.  Again that did not affect ANS
since they had specific filters to protect their direct customers and
any peer that wished to register in the IRR.

Even earlier, Sprint, UUNET, and PSI default routed to the NSFNET.
Someone got a 56K circuit to ANS at a university in the middle east
and announced the NSFNET address.  Sprint, UUNET and PSI were a mess
for 10 hours.  NSFNET customers were fine (then it was the PRDB).

There are ways to protect routing today.  Not everyone makes use of
them.  That's been the case for a very long time.  And they are far
from perfect.

> >Add some authentication and you may have further improviment in the
> >reliability of routing information.  Don't allow that to cross the
> >major ISPs and the authenticaion is of very little use for ISPs.
>  
> I agree with you here!  But I don't think anyone is talking about
> not allowing auth info to cross major ISPs.  We're mostly arguing
> how strong a requirement to make the ability to transit un-upgraded
> ISPs: MUST, SHOULD, or MAY.
>  
> --Sandy

Some providers may never upgrade.  Some mechanism to still pass routes
through them is needed, albiet placing less trust in those routes.

Curtis

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec