Re: [secdir] draft-ietf-bess-virtual-subnet-05 SECDIR Review

[Donald Eastlake <[e-mail]>]

Hi Xiaohu,

On Tue, Nov 24, 2015 at 9:03 PM, Xuxiaohu <[e-mail]> wrote:
> Hi Donald,
>
> Thanks a lot for your review. Please see my response inline.
>
>> -----Original Message-----
>> From: Donald Eastlake [mailto:[e-mail]]
>> Sent: Wednesday, November 25, 2015 2:34 AM
>> To: [e-mail]; [e-mail]
>> Cc: [e-mail]
>> Subject: draft-ietf-bess-virtual-subnet-05 SECDIR Review
>>
>>...
>>
>> Security:
>>
>> The Security Considerations section in its entirety is as follows:
>>
>>    This document doesn't introduce additional security risk to BGP/MPLS
>>    IP VPN, nor does it provide any additional security feature for BGP/
>>    MPLS IP VPN.
>>
>> While I don't think the Security Considerations section of this Informational
>> document needs to be particularly large or heavy, I believe there is more to be
>> said. Perhaps points such as the security of the L2 or IP addresses used by the
>> hosts/servers in the data centers or the PE devices seeming like ideal
>> concentration points to observe traffic metadata and content so systems along
>> the lines of those described here should take that into account.
>
> How about adding the following text to the security consideration section?
>
> "Since the BGP/MPLS IP VPN signaling is reused without any change, those security considerations as described in [RFC4364] are applicable to this document. Meanwhile, since security issues associated with the NDP are inherited due to the use of NDP proxy, those security considerations and recommendations as described in [RFC6583] are applicable to this document as well."

Adding that would be a good. I have read the security considerations
referred to above and they cover most of my concerns. So I would be
satisfied if you added that text.

Thanks for offering to fix all the things below.

Donald
=============================
 Donald E. Eastlake 3rd   [phone] (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [e-mail]

>> Other:
>>
>> While I understand that many disagree with me, I believe that, except in special
>> circumstances, front page authors should list a postal address and/or telephone
>> number in the Authors Addresses section as well as an email address. In my
>> opinion, the Authors Addresses section of this draft is an example of schlock
>> corner cutting.
>
> OK, I will fix it.
>
>> Trivia:
>>
>> Section 1, page 3, item b: "challenge on the forwarding" -> "challenge to the
>> forwarding".
>>     item c: "growing by multiples" -> "multiplying"
>
> Will fix it.
>
>> Section 1, page 4: "infrastructures and their corresponding experiences" ->
>> "infrastructure and experience".
>
> Will fix it
>
>> Section 3.4: "Acting as an ARP or ND proxies, a PE routers" -> "Acting as an ARP
>> or ND proxy, a PE router"
>
> Will fix it.
>
>> I'm not sure what the occurrences of "Infrastructure-as-a-Service (IaaS)" and
>> "IaaS" add other than buzzword compliance think the draft would be improved
>> by deleting them.
>
> Will delete them. Thanks a lot again for your review.
>
> Best regards,
> Xiaohu
>
>> Thanks,
>> Donald
>> =============================
>>  Donald E. Eastlake 3rd   [phone] (cell)
>>  155 Beaver Street, Milford, MA 01757 USA  [e-mail]