Re: [Sidrops] WGLC = draft-ietf-sidrops-aspa-verification - ENDS 03/22/2023 (Mar 22 2023)

["Sriram, Kotikalapudi (Fed)" <[e-mail]>]

Hi all,

Nan Geng also reviewed a pre-publication version of v-12 ( https://datatracker.ietf.org/doc/draft-ietf-sidrops-aspa-verification/ ).

His comments are copied below. They have been carefully considered and changes incorporated.

Thank you, Nan.

Sriram

===================================

Nan Geng's Comments Set #1:

From: gengnan <[e-mail]> 
Sent: Wednesday, March 1, 2023 7:40 AM

Hi Sriram,

Here are some comments on the ASPA verification draft v11. Hope they are helpful. 
Since I did not participate in the discussion of the draft from the beginning, something may be missed. If it does happen, please tell me what I missed. Thanks. 

1. Sec.5: How about discussing the process of AS_SET in section 5, together with the discussion of AS_PATH and AS_PATH4?

2. Sec. 5: Consider a case where i) a router enables ASPA verification but ii) there is no ASPA data. Suppose a BGP update is received but the AS path length is zero or AS_SET exists or neighbor AS is wrong. When conduct ASPA verification for the AS path, which verification result will be return? Unknow (because no data) or invalid (because the rules in sec. 5)? In the implementation of openbgpd, the result seems to be unknown. Can we make the point clear in section 5 or somewhere?

3. Sec 5.1.1: how do we know the peer AS is transparent RS or non-transparent RS so that the AS path can be pre-processed before the verification?

4. Sec. 5.3: “The upstream ramp stops (reaches its apex) when the ASPA validation to check customer-to-provider relationship of the AS-pair corresponding to the next AS hop gives Invalid or Unknown result.” The apex is reached if either invalid or unknown is returned or if only invalid result is returned? (The latter is taken by https://github.com/QratorLabs/ASPA/blob/master/aspa_logic.py)

5. Sec 5.4: If Tier-1 is present as an RS-client, it must register an ASPA showing the RS AS as a provider. But in the ASPA profile draft v12, sec. 1 said transparent RS is not listed as PAS in ASPA. So, do you mean Tier-1 must register an ASPA showing the non- transparent RS AS as a provider?

6. Sec 5.5: The title “AS_PATH Verification Recommendation”  “AS_PATH Verification Recommendations”, to keep consistent with the title of sec. 5.4

7. Sec. 7: What is the relationship between ASPA and RFC 9234? Can we give some operational considerations on the configuration of local AS role? RFC 9234 does not support the direct configuration of complex relations. How to deal with the configure issue when we have ASPA data for siblings. And, when we conduct ASPA verification at a sibling hop, downstream check should be carried out I think. But there is not related description.

8. Suppose AS X configures itself as a customer of AS Y by RFC9234. But the ASPA data of AS Y considers AS X as Y’s provider. Do we need to have a check to avoid such wrong configurations or wrong registers?

9. Sec. 10: I think the deprecation of AS_SET can be mentioned, because some networks may possibly use AS_SET. And, legitimate non-valley-free AS paths may exist. ASPA verification may drop such BGP updates by mistake.

Best,
Nan