Re: [sidr] AD Review of draft-ietf-sidr-bgpsec-ops-10

[Randy Bush <[e-mail]>]

unless someone screams

   As BGPsec will be rolled out over years and does not allow for
   intermediate non-signing edge routers, coverage will be spotty for a
   long time.  This presents a dilemma; should a router evaluating an
   inbound BGPsec_Path as Not Valid be very strict and discard it?  On
   the other hand, it might be the only path to that prefix, and a very
   low local-preference would cause it to be used and propagated only if
   there was no alternative.  Either choice is reasonable, but we
   recommend dropping because of the next point.

   Operators should be aware that accepting Not Valid announcements, no
   matter the local preference, will often be the equivalent of treating
   them as fully Valid.  Local preference affects only routes to the
   same set of destinations.  Consider having a Valid announcement from
   neighbor V for prefix 10.0.0.0/16 and an Not Valid announcement for
   10.0.666.0/24 from neighbor I.  If local policy on the router is not
   configured to discard the Not Valid announcement from I, then longest
   match forwarding will send packets to neighbor I no matter the value
   of local preference.