Re: Éric Vyncke's Discuss on draft-ietf-bfd-vxlan-09: (with DISCUSS and COMMENT)

Jeffrey Haas <> Wed, 18 December 2019 21:36 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id CBBAB120236; Wed, 18 Dec 2019 13:36:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id EqkmO4FZjLRc; Wed, 18 Dec 2019 13:36:32 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 809CA12001A; Wed, 18 Dec 2019 13:36:32 -0800 (PST)
Received: by (Postfix, from userid 1001) id 725D51E2F6; Wed, 18 Dec 2019 16:41:02 -0500 (EST)
Date: Wed, 18 Dec 2019 16:41:02 -0500
From: Jeffrey Haas <>
To: "Carlos Pignataro (cpignata)" <>
Cc: "Eric Vyncke (evyncke)" <>, The IESG <>, "" <>, "" <>, "" <>
Subject: Re: =?iso-8859-1?Q?=C9ric_Vyncke's_Discus?= =?iso-8859-1?Q?s?= on draft-ietf-bfd-vxlan-09: (with DISCUSS and COMMENT)
Message-ID: <>
References: <> <> <> <>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <>
User-Agent: Mutt/1.5.21 (2010-09-15)
Archived-At: <>
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "RTG Area: Bidirectional Forwarding Detection DT" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 18 Dec 2019 21:36:34 -0000


On Wed, Dec 18, 2019 at 09:28:30PM +0000, Carlos Pignataro (cpignata) wrote:
> The TTL of 1 recommended for RFC 4379 / RFC 8029 S4.3 is because if the MPLS packet is mis-routed, or there's a forwarding mis-programming, then an MPLS LSE pop would expose the BFD packet and so that the BFD is not further mis-forwarded.
> In the VXLAN case an intermediate router would not remove the VXLAN encap because the outer encap is IP (with a destination address, not an MPLS Label that can be mis-interpreted in context) and a mid-point router would not understand VXLAN.

Explained, that now seems obvious.  Thanks. :-)

But given that point, what precisely is the objection to the inner IP header
of the BFD for vxlan having a TTL of 1?

I think this is partially a matter of attack spaces varying depending on
whether we're targeting the management VNI vs. a tenant.  In the case of the
management VNI, we (should) have very strong control over what BFD traffic
is getting encapsulated.  

However, for tenant VNI mode, is the argument that depending on what the
other vxlan PDU parameters look like, tenant sourced BFD PDUs may be
indistinguishable from ones sourced by the management infrastructure?  And
if so, how would GTSM help us here?

-- Jeff