From nobody Wed Jul 19 15:26:06 2023 Return-Path: X-Original-To: sidrops@ietfa.amsl.com Delivered-To: sidrops@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87D2DC14CE2F; Wed, 19 Jul 2023 15:26:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.101 X-Spam-Level: X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FROM_GOV_DKIM_AU=-0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nist.gov Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GYqcVB8g66xH; Wed, 19 Jul 2023 15:26:01 -0700 (PDT) Received: from GCC02-BL0-obe.outbound.protection.outlook.com (mail-bl0gcc02on2122.outbound.protection.outlook.com [40.107.89.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 26787C14CE25; Wed, 19 Jul 2023 15:25:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=X8N/05do3GGoEImel1XzADbuBWV+WBMX+vMibAkNoq7ddav27d+LMFUwemCmukmv67hOTN7jZfSMDwsLkMhyg7fdHhiCIJxKuPkrHr07LSVydgig8pui2P12TG53c7giO8Fskx6nQrw9i669kuBOGfMqgrowXsx9ypOoLCs9UMV+0EM03rTsPAb+Y9KBrOOCvn4DTBmpXOFXBc3DvOkGbdL3YmZ91lyIQ/WlgWRHz++XILIZvRtIeia5VURJJqQD7tMtlE5U6nmz8WyUcjfhkB6zMf4JmX//Qx1oY+pI+rlKFc1osDzMqUuhVfzh3nQZxXgwoAPg/FqCwt4kPAHKlA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=tL9Vo8yM6I4NXFewGGrdr2hAQa+ZJ6ie7sdPuTxyBo0=; b=Q0r4cxOIaqdSdoKqzGNYXDWXL/K7PlivnNq4sJjOzxPi7wPpq9K2AccqNyvW0BjVgndNIj9foj8hBMKFPM5yLl4bDGziPVfey3eA9W1tU3A2A7Tuzfp036W2KteuwH9iJmeYlh+s9K8iZInjgKqBjoZcrblKB2YJvNHvxL7N0wph92h/p3pGOh43rl/dSomSpet2/49YMTZK6wOgwA0/fUPLb5+YO86lWFsiG0VmN2mXEcawD68l7b57tI77DegzEjIlXe+kxuNWTKHZuq1FSN/+zg1T19skvI349Kd47Ec0UILFNFfAwvf600gl91Bou8xsDjYg4b5h7qMZBk8aGg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nist.gov; dmarc=pass action=none header.from=nist.gov; dkim=pass header.d=nist.gov; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nist.gov; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=tL9Vo8yM6I4NXFewGGrdr2hAQa+ZJ6ie7sdPuTxyBo0=; b=fKucQwbpdhcLxzNKui8UC6N+ENhINArofuius0F0Rp4h8Dmnc5WywsRfarS3miYVmU+AtxPDGy2v6XsfCaxbzVB6LkRdm3mDFmDpRd0KI72gEfbW8MpHJ9+b6r7shGeE9qCyImsjQI3uGrfl9IcR+tPrwJsmyKsQ0n8ANIs2vFUnM54aezO5Ftr+pFzq/TdoOhehTPJttthxn5LJHEeRwUZjDRcy7CpIb7mQaWalOfp5lT67hZrabD84jb7kRRyol9K3Wt5sLRcRyVlk97ndHMRJ5zVLkvRDTvG0iPmrxP23ivQjO/HXKzErRvBWhLL5Mf31XO1P53dtJJOxNWPjjw== Received: from SA1PR09MB8142.namprd09.prod.outlook.com (2603:10b6:806:171::8) by DM8PR09MB7207.namprd09.prod.outlook.com (2603:10b6:5:2f3::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6609.24; Wed, 19 Jul 2023 22:25:56 +0000 Received: from SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c109:6f7b:a858:7034]) by SA1PR09MB8142.namprd09.prod.outlook.com ([fe80::c109:6f7b:a858:7034%7]) with mapi id 15.20.6609.022; Wed, 19 Jul 2023 22:25:56 +0000 From: "Sriram, Kotikalapudi (Fed)" To: 'gengnan' CC: "sidrops@ietf.org" , "draft-ietf-sidrops-aspa-verification@ietf.org" Thread-Topic: [Sidrops] I-D Action: draft-ietf-sidrops-aspa-verification-15.txt Thread-Index: Adm6j/qb6ToCpcvESBW/zaNADjS8PQ== Date: Wed, 19 Jul 2023 22:25:56 +0000 Message-ID: References: <8d87478693d94febaa886f32b7dedc80@huawei.com> In-Reply-To: <8d87478693d94febaa886f32b7dedc80@huawei.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nist.gov; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: SA1PR09MB8142:EE_|DM8PR09MB7207:EE_ x-ms-office365-filtering-correlation-id: b631365e-974d-4324-5fdd-08db88a71ed8 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: mZ1ySMRIHRQeL9BJRs2RET4+ln0rmjjTmTgjM8ug6zZsEByo5ODkDOtqcRUfTGGs3tAYEY0omwP1ilxFz00sLAc6yDbSAkqqyGYpvtq31mZJEsnEC8SU3wpnWPB3BnPRm7Nq/wCVcBtDAL8uYGJUwFxPPa7ioshcwnToothQF/PDuy+VgXC1/l1S2y6pb5PhQq8UsF9JofO0syax4OFp0vjWVnmPe+3BYGYIz/mSiKKS/Hy6VxnIU2XMYO3qIRVIAri+IbQFQmtU7VhqZfvSWqE2oqt8eduYLsNe+7j7ELDd55+VjRORRpdkgYzPMbImXlrPV9hZuQzs9BgDXtcGktlCMVVJxzuELR8Z5EN7u4Fe7800rEZFaiz450kr+M+DWQGWpd79V7Tk7YdGzK+J/unSYsXK65n8XfNYfumlKQvHc8FF6aYML5nn17W5IXvrjw7oii9iT77DDzBXNH4LwS3n0ouS1tQ9cZqM3BQb+3MJSy8aLco2iFTcWCXXXHxwBkRgUJF0VMMm2RT1+kgo727gZatLFIZO/HFtTTMo+IGY/JxUDmlQktSt+58/+31+rUDhOuX5PSulaMzwBN8jL0vjgbmqWIQb/A1Vnid/JjNqnwN+lb7cbLr/rKqPdr7M x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA1PR09MB8142.namprd09.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230028)(4636009)(366004)(451199021)(66946007)(66476007)(76116006)(66446008)(64756008)(66556008)(6916009)(2906002)(7696005)(52536014)(8936002)(8676002)(4326008)(5660300002)(9686003)(38100700002)(54906003)(66574015)(498600001)(38070700005)(55016003)(15650500001)(33656002)(6506007)(26005)(86362001)(186003)(82960400001)(71200400001)(83380400001)(122000001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?tAh7WHBXVHgR6yyYkCT2KNUiUZnV8ki3aRx7j8Fi8KM3OQOOf3kmc7f9cXcO?= =?us-ascii?Q?uVMYTnKi55fccGH6CSL3vzdRIR0WvKgZtxeqe557u2DGiwMNWEvp+qFxi01a?= =?us-ascii?Q?fKHDrEyLcSbwdMp2oBUs6TNyKgyf7Z13GGamV6Gh7EukrMxjvmx65V3AyH2k?= =?us-ascii?Q?eCm+InRTEfhunPB15sYi9Qutg5lrNVG97i7A5P5Jq6YykQ5+rOJ4sHOwBgsg?= =?us-ascii?Q?+JVMNBluC+XU3Z+lF9d8+QK+JMI6WZL7q596FZjWIc2AO/4iLcHaaD2EqDbl?= =?us-ascii?Q?YYQTyRTvwZq5bvCV5o6lmsFL88ZBTguWw0D8i+01hBUIV1VBve4ehfYyWYBo?= =?us-ascii?Q?xkEcHLReTj4gSoBEI0cqvmQftpIsCspRhU8M6IO/rBUW2z9IZF+k+TJGVehf?= =?us-ascii?Q?zI1w5tJh5d3Dwex5s8SSR/Z627r8Y74CjXLMTifmAXLShDZfpTAC4eYlicKw?= =?us-ascii?Q?lMzrcb2qJH/SySuGNo0oa/Gwjfd6HNylZNakvJzxZkfCbK0vtocr44JJXuV6?= =?us-ascii?Q?x8enlyMB/crnUInPqVWdJ6zg6INFvn75t54x9NnurfPb/mNYLZ41jTRR40h4?= =?us-ascii?Q?/2JSeKqcPbEOqSlvbDcVUUEsPCY2/EHDqqrNopV6wKzm0FhTJ33hj/OSyZ4L?= =?us-ascii?Q?uCU5JeOL0w6R9DQMh/ZsiqRgugcVDlA0/ZyRsMe++4l8jxzExq1LfvZFPJvC?= =?us-ascii?Q?KFBRn7GhCWxT2YWZSBml9aM/yDIv4iCXn+r+G2YsUOWFGFbVNND5wYDCJhdH?= =?us-ascii?Q?7Vq4L9m3lBG2KAu1LwwiRRRpfvrgPY3GRLmXqYTaRxPZfEdJ8qTxcEhsQV7e?= =?us-ascii?Q?y5Vt5tDDkkYI5a7ARkMLkF9VQJRDu0y4IupVhCxB31M1RMA97K16ouiW8TfI?= =?us-ascii?Q?VQKkNUMJR+89HRidNQmMEICxkuYHIH003FDuCRmq4wsD9xxKEYUq28M/hh1o?= =?us-ascii?Q?CYhBoANxpPCRVHL+hsMMC9dvPOih+Gie7GE/VvdjprwVrIjkp5r0VZ73y+Ts?= =?us-ascii?Q?6K7zJP1qxenhqKA9HfKlmC462yLgpA6PPxjQZZyWxHblv4rQRh45sA7FFJY/?= =?us-ascii?Q?XTZgxokYuuNTpm0/JMZjM1JcxVzM0Jgw6hmdQxweMmucG04SCqb8/J8BZFvL?= =?us-ascii?Q?SnQSJsOcrjL763xDc6ewrz2GamZE0k6h1GFmovca2QsYZkOjnsvg1ewspzJi?= =?us-ascii?Q?Q5v67J0KSlw1EG1C1WjdrdORxG5RQ3jbrUaRqsT1pAAO/ufmJELa7/hA5qHr?= =?us-ascii?Q?VZKEk61De4wmNurAuB74m4TXbXXebWUx2pjHT3e/HR/FCZqKv0xIiFhqpiJi?= =?us-ascii?Q?A5bZL9hs0f0toWISk3kW9bmw19t5JQXWhrdlmNQkFfTn1O2fsREkRBTvJm+B?= =?us-ascii?Q?I5WgrFx3vJbetZkjPtMvVOxt35jeElVs0GabVk7UmAuP9cGrMEjCO3+2HewY?= =?us-ascii?Q?YgTlINznNzao5Nmd+0ugGp9/UPfkYbR2OM9aE+DVYSftC2KgHB6tDJU6TKZ/?= =?us-ascii?Q?Za6iILOL8exI+h7EGCSFmF6JeduEHFckrKjbTFXvdB6WybNXUXo6ba2lngGF?= =?us-ascii?Q?K9u6Ujm78Qqw7JmyX4w=3D?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR09MB8142.namprd09.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: b631365e-974d-4324-5fdd-08db88a71ed8 X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Jul 2023 22:25:56.1187 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2ab5d82f-d8fa-4797-a93e-054655c61dec X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM8PR09MB7207 Archived-At: Subject: Re: [Sidrops] I-D Action: draft-ietf-sidrops-aspa-verification-15.txt X-BeenThere: sidrops@ietf.org X-Mailman-Version: 2.1.39 Precedence: list List-Id: A list for the SIDR Operations WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jul 2023 22:26:05 -0000 Hi Nan, Thank you for the comments. >For easy understanding, there can be more descriptions on how the BGP role= s are used in verification. For path verification purposes, BGP roles are i= ntroduced, while they are not used in section 6. I feel that Section 2 adequately defines the BGP Roles and points forward t= o Sections 3, 4, and 6 where those Roles are to be utilized. It also recomm= ends (in all uppercase) the neighbor-role cross-check specified in [RFC9234= ]. Section 6 does indeed use the roles as defined in Section 2. Please see = at the top of Sections 6.1 and 6.2. The roles are also used in Section 5.=20 =20 >Also, the Verification at Egress eBGP Router should be taken from the pers= pective of the next-hop AS's BGP Role.=20 Please see the last two sentences of Section 7.2. The upstream verification= is performed at a transit provider, lateral peer, RS (local AS has RS-clie= nt role), or RS-client (local AS has RS role) as specified in Section 6.1. = So, if the AS_PATH (after adding local AS) is Invalid according to the upst= ream verification, then the route SHOULD NOT be propagated to a neighbor wi= th any of those roles. Section 7.2 also states that if the downstream verif= ication results in Invalid outcome for the AS_PATH (after adding local AS),= then the route SHOULD NOT be propagated to any eBGP neighbor (regardless o= f its BGP Role). This covers "from the perspective of the next-hop AS's BGP= Role" nicely for all cases. =20 >RFC9234 should also be an existing technology in sec. 10.=20 We have stated elsewhere (Section 2) that RFC9234 is complementary and reco= mmended (in all uppercase). But I'll think about your suggestion whether it= needs to be mentioned again in Section 10. =20 >I am interested that whether RFC9234 for preventing and detecting route le= aks is necessary if ASPA is deployed. There are overlaps of them. IMO, it is better not to state in this rfc-to-be that RFC9234 is mandatory.= Mentioning that RFC9234 is RECOMMENDED seems sufficient. The networking co= mmunity should realize that the two RFCs are complementary and each one sho= uld be implemented. They are respectively useful for short term (RFC9234) a= nd long term (ASPA). The BGP Roles are set locally and the BGP Role capabil= ity in RFC9234 only helps neighbors to cross check the Role with each other= . The BGP session is not rejected if roles do not match. The OTC attribute = in RFC9234 is a complimentary approach for route leak detection/prevention.= This rfc-to-be also has its own detection/prevention mechanisms. Especiall= y, with the addition of Section 7.2, we now have the additional mechanism o= f prevention of local route leaks at a compliant AS. I'll wait and see if my co-authors or others wish to chime in on the above. Sriram =20