Re: [Sidrops] WGLC for draft-ietf-sidrops-ov-egress-00.txt - ENDS 11/25/2019 (November 25 2019)

[Randy Bush <[e-mail]>]

> The general case here is likely that in a complex network (more than a
> few routers), it's possible to have wonky things going on. Randy's one
> example certainly is true, from a real network though I know of a case
> where SOMETIMES prefixes get their origin-as set via initial creation
> of the route (static route), and SOMETIMES the operator decided:
> 
>   "Oh, I should match on community-foo + attribute-bar and reset
>    origin-as to BLOOP"
> 
> This leads to some hilarity when attempting to sort out RPKI/ROA data :(
> 
>   "Oh, that's clearly AS-BAR because we set that on the creation of
>   the route!"
> 
> followed shortly by:
> 
>   "wait what? why is it AS-BLOOP??? WTF?"

yep

> In any case: "make the ROA you intend, all of them" is sound advice.
> Verifying prior to shipping across your peering edge sure seems like
> "being polite to the world" as well.

someone could give 500kg of complex advice to the operator who does this
stuff.  that ain't me.

the purpose of this draft is to request that the *vendors* allow origin
validation *after* all such kink.  hence the name.

randy