Re: [Sidrops] ASPA verification questions

["Wanghaibo (Rainsword)" <[e-mail]>]

Hi Ben,

I agree with you.

When an ISP wants to do ASPA verification, the ISP should sign its own ASPAs. Then the border router can calculate the peer's role according to that database.
When we set a peer's role according to RFC9234, it also makes the calculating easier. But even if we do that, I think we may also check the peer's role configuration whether match the ASPAs, because of misconfiguration may happen.

Regards,
Haibo

|-----Original Message-----
|From: Sidrops [mailto:[e-mail]] On Behalf Of Ben Maddison
|Sent: Thursday, December 15, 2022 2:11 AM
|To: Claudio Jeker <[e-mail]>
|Cc: [e-mail]
|Subject: Re: [Sidrops] ASPA verification questions
|
|Hi Claudio,
|
|On 12/14, Claudio Jeker wrote:
|> Hi all,
|>
|> I'm working on ASPA verification in OpenBGPD and while I have the
|> basic validation algorithm working I have a question that is not
|> covered by
|> draft-ietf-sidrops-aspa-verification-11:
|>
|> What should happen with ebgp peers that have no role assigned?
|
|My personal view (which I have previously discussed, without agreement, with
|some of the authors) is that the default 'provider/non-provider'
|status of an external peer should be derived from the ASPAs issued by the local
|AS.
|
|This obviously needs a knob for override on a per-peer, per-afi basis.
|
|I would prefer not to have a tight coupling with RFC9234 roles in
|implementations.
|
|Cheers,
|
|Ben