[Sidrops] IETF 104 SIDROPS Meeting Minutes

[Keyur Patel <[e-mail]>]

Folks,

Attached are the meeting minutes for the SIDROPS meeting at IETF 104 in Prague.
Apologies for the delay in sending out the meeting minutes.

Best Regards,
Keyur

 Meeting Minutes from Prague IETF-104


-1) Randy Bush -- draft-ymbk-sidrops-ov-signal-02.txt

-In band marking with extended community:
Sriram K. (Nist): Evaluator does validation or router does the validation?
Randy Bush: Evaluator only.
Sriram K.: Evaluator lost its rpki connection.. how does it signal router?
Randy Bush: Draft does not cover it.
Sriram K.: Should we cover the use case in the draft?
Randy Bush: Maybe.


2) Daniel Kopp -- draft-ietf-sidrops-route-server-rpki-light-02.txt

- In domain of IXP network where ROA validation results is forwarded from RS to its peers.
- Introduce a transitive four-octet AS specific Extended Community.
Jakob Heiz: Three validation states are defined and there should be the fourth state (Validation not done).
Daniel Kopp: It is missing in the draft.
Ruediger Volk: Why not have your customers do it? Extended community was chosen because large communities was missing. Asking for routers to implement it and implementation cycles are long before it goes in production. Suggest using large community?
Daniel Kopp: Happy to adopt Large community.
Randy Bush: Agree with Ruediger Volk. Suggest using Large community and same community definition.
Doug M: IXP could offer this as service?
Daniel Kopp: Yes.
Dough M: makes sense.
Job Sniders: What is lacking in the draft is secure by default approach. Suggest abandoning the draft. Should not be propagating validation state on Ebgp.
Daniel Kopp: Do not agree.
Job Sniders: Should not propagate invalids. This makes it insecure.
Randy Bush: Trade-off is whether you act for IXP member or you give IXP member more information. Question from IXP members pov is are you outsourcing your security.
Doug M: Do not agree with outsourcing security.
Alexander Azimov: You do have filtering. Why don't you use marking and why ask for flexibility? Whats the difference?
Daniel Kopp: Would like to standardize using a community for everyone.
Rudigher Volk: Consider signaling for guys who sent you invalid stuff?
Keyur Patel: Any flavor or solution deployed today?
Daniel Kopp: Dropping for default. Tagging is not done.


3) Ruediger Volk -- draft-ymbk-sidrops-ov-egress-00.txt

Randy Bush: Whatever RFC origin clarifications became is inconvenient? We do have SNMP MIBs for dropped announcements?
Ruediger Volk: Not interested in SNMP stats.
Randy Bush: Tagging announcements with different origin-as to different peers?
Ruediger Volk: It would fall under weird policy primitives.
Randy Bush: My point is the hack you want is to put a check at the end of export policy so I don't have to duplicate it.
Ruediger Volk: We are in agreement.
John Scudder: Since your telling implementors how to implement a standard make it standards based.
Andrew Dray: Please ask the implementors to show what is exactly being dropped. Another comment I have to enable policies per peer.
Randy Bush: "do NOT do ROAs for routes NOT meant for DFZ" is for AS0 peers only.
Ruediger Volk: You seem to think AS0 is special.
Randy Bush: Lets differentiate AS0 in path versus ROA.
Ruediger Volk: Agree.
John Scudder: The slide is completely unrelated to the presentation.
Ruediger Volk: Yes.
John Scudder: Last slide is interesting and thought provoking.
Job Sniders: There may be explanations as to why you are seeing unwanted ASes, Customers make ROAs with private ASes as tags, typos, etc.
Ruediger: Only when someone presents then and only then it gets fixed.
Jeff Huston: If you really wanted to understand validity of ROA why don't you sign with AS.
Ruediger Volk: Are you suggesting we mimic where Address and AS must be signed. What I suggest is simple and straightforward.
Doug M. Why is this stuff appearing in global RPKI. Is this ignorance?
Ruediger Volk: Typos, folks not adhering to guidelines and folks not knowing what they are doing.
Doug M. concerned that one off validators might clean this up but the problems may not be solved?
Rudeger Volk: Suggest a BCP.

4) Sriram K. – RPKI/ROV data analysis with detail characterization of Invalid routes

Andrey R.: How does it work? What is the query mechanism?
Sriram: We can give you a global view or a view per AS. Don't think it is ready but can facilitate that.

5) George Michelson – RPKI Validation Reconsidered

Rob Austein: Don't agree with the check at every level.
Di Ma: We don’t use OID but we use algorithm. We can switch to new validation.
Geroge M. Cool.

6) George Michelson – Resource Tag Attestation

Job Sniders: Would like to see this move forward.

7) Oliver Borchert – draft-borchert-bgpsec-validation-signaling-00.txt

Presented BGPSec Validation State Signaling.