Re: [Sidrops] I-D Action: draft-ietf-sidrops-aspa-verification-15.txt

["Sriram, Kotikalapudi (Fed)" <[e-mail]>]

Hi Nan,

Thank you for the comments.

>For easy understanding, there can be more descriptions on how the BGP roles are used in verification. For path verification purposes, BGP roles are introduced, while they are not used in section 6.

I feel that Section 2 adequately defines the BGP Roles and points forward to Sections 3, 4, and 6 where those Roles are to be utilized. It also recommends (in all uppercase) the neighbor-role cross-check specified in [RFC9234]. Section 6 does indeed use the roles as defined in Section 2. Please see at the top of Sections 6.1 and 6.2. The roles are also used in Section 5. 
 
>Also, the Verification at Egress eBGP Router should be taken from the perspective of the next-hop AS's BGP Role. 

Please see the last two sentences of Section 7.2. The upstream verification is performed at a transit provider, lateral peer, RS (local AS has RS-client role), or RS-client (local AS has RS role) as specified in Section 6.1. So, if the AS_PATH (after adding local AS) is Invalid according to the upstream verification, then the route SHOULD NOT be propagated to a neighbor with any of those roles. Section 7.2 also states that if the downstream verification results in Invalid outcome for the AS_PATH (after adding local AS), then the route SHOULD NOT be propagated to any eBGP neighbor (regardless of its BGP Role). This covers "from the perspective of the next-hop AS's BGP Role" nicely for all cases.   

>RFC9234 should also be an existing technology in sec. 10. 

We have stated elsewhere (Section 2) that RFC9234 is complementary and recommended (in all uppercase). But I'll think about your suggestion whether it needs to be mentioned again in Section 10.  

>I am interested that whether RFC9234 for preventing and detecting route leaks is necessary if ASPA is deployed. There are overlaps of them.

IMO, it is better not to state in this rfc-to-be that RFC9234 is mandatory. Mentioning that RFC9234 is RECOMMENDED seems sufficient. The networking community should realize that the two RFCs are complementary and each one should be implemented. They are respectively useful for short term (RFC9234) and long term (ASPA). The BGP Roles are set locally and the BGP Role capability in RFC9234 only helps neighbors to cross check the Role with each other. The BGP session is not rejected if roles do not match. The OTC attribute in RFC9234 is a complimentary approach for route leak detection/prevention. This rfc-to-be also has its own detection/prevention mechanisms. Especially, with the addition of Section 7.2, we now have the additional mechanism of prevention of local route leaks at a compliant AS.

I'll wait and see if my co-authors or others wish to chime in on the above.

Sriram