Re: [RPSEC] Discontiguous Deployment (Show of Hands)....

[ Adding the list back on. ]

On Mon, 29 Jan 2007, Curtis Villamizar wrote:
>
> Tony, Russ,
>
> Tony Tauber writes:
>
>>   possible to deploy a such a protocol to all routers in a large AS at
>>                      ^^^^^^^^
>
>
> Looks better with the additions.  Note the minor typo above.

Fixed. Thanks.

> Another practical consideration is deployment rollout.

Makes sense.

> This might be a good replacement for your third bullet.
>
> -   o  In an environment where both secured and non-secured systems are
> -      interoperating a mechanism MUST exist for secured systems to
> -      identify whether an originator intended the information to be
> -      secured.
>
>
>   o  In an environment where secured service is in the process of
>      being deplyed a mechanism MUST exist to support a transition
>      free of service interruption.

I think the original bullet is about something else and still has
merit, but I like your addition.

> For some providers resetting the BGP sessions during a service
> rollout would be at least highly undesireable and might be
> completely unacceptable.  With providers trying to acheive higher
> service availability than their competitors, this becomes very
> important.
>
> Curtis

At first, I was inclined to put this kind of thing in as a SHOULD, but
after thinking for a bit, am leaning toward MUST.
Re-setting an eBGP session here or there is an event any deployment
should be able to deal with fairly gracefully for an upgrade of such
magnitude.  Taking down major parts of one's iBGP infrastructure,
however, is not acceptable, IMO.

I'll add this text unless the list disapproves.

Thanks,

Tony

_______________________________________________
RPSEC mailing list
RPSEC@ietf.org
https://www1.ietf.org/mailman/listinfo/rpsec