Subject: [secdir] Secdir early review of draft-ietf-idr-rpd-15

From: Linda Dunbar via Datatracker <[email-masked]>
Date: Wed, 26 Jan 2022 17:20:40 -0800

Reviewer: Linda Dunbar
Review result: Has Nits

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area directors.
Document editors and WG chairs should treat these comments just like any other
last-call comments.

Summary:
This draft describes the mechanism for routing policies to be automatically
distributed, which is very important for adjusting and optimizing traffic. The
mechanism is written very clear. I just have a few questions: - From the
security perspective, does a BGP node need to validate the node that initiates
the Routing Policy?

- Figure 2 (Traffice advertised from AS200 to AS100 for Prefix2) is to
influence ingress traffic to AS200, isn't it?

- Does the RPD mechanism replace the FlowSpec?

- Page 7 says that the "Peer IP" (default 0) indicates a BGP Speaker will apply
the policy in the message to all its IPv4/IPv6 peers. Does it mean Applying the
policy to packets received from all peers?

Thank you very much
Linda Dunbar

---

From: Huaimo Chen <[email-masked]>
Date: Thu, 27 Jan 2022 18:29:17 +0000

Hi Linda,

    Thank you very much for your comments.
    My answers/explanations are inline below with [HC].

Best Regards,
Huaimo on behalf of co-authors

________________________________
From: Linda Dunbar via Datatracker <[email-masked]>
Sent: Wednesday, January 26, 2022 8:20 PM
To: [email-masked] <[email-masked]>
Cc: [email-masked] <[email-masked]>; [email-masked] <[email-masked]>
Subject: Secdir early review of draft-ietf-idr-rpd-15

Reviewer: Linda Dunbar
Review result: Has Nits

Summary:
This draft describes the mechanism for routing policies to be automatically
distributed, which is very important for adjusting and optimizing traffic. The
mechanism is written very clear. I just have a few questions: - From the
security perspective, does a BGP node need to validate the node that initiates
the Routing Policy?
[HC]: BGP does not directly include security mechanisms.
But other security measures such as those described in RFC 7454
can be used by operators.

- Figure 2 (Traffice advertised from AS200 to AS100 for Prefix2) is to
influence ingress traffic to AS200, isn't it?
[HC]: It is to influence the traffic from AS100 to AS200.
It shows that the traffic goes from AS100 to AS200,
and provider wants to adjust the traffic to different out-interface.

- Does the RPD mechanism replace the FlowSpec?
[HC]: No. RPD is used to adjust routing then influence the traffic.
FlowSpec is used to directly adjust the packet.

- Page 7 says that the "Peer IP" (default 0) indicates a BGP Speaker will apply
the policy in the message to all its IPv4/IPv6 peers. Does it mean Applying the
policy to packets received from all peers?
[HC]: It means applying the policy to all peers for the prefixes specified.
The BGP routes originally received from all peers may change their path
attributes after the policy is applied.

Thank you very much
Linda Dunbar

---

From: Linda Dunbar <[email-masked]>
Date: Thu, 27 Jan 2022 21:46:32 +0000

Huaimo,

Thank you very much for the detailed explanation. They make sense. I will change my review record.

Linda

From: Huaimo Chen <[email-masked]>
Sent: Thursday, January 27, 2022 12:29 PM
To: [email-masked]; Linda Dunbar <[email-masked]>
Cc: [email-masked]; [email-masked]
Subject: Re: Secdir early review of draft-ietf-idr-rpd-15

Hi Linda,

Best Regards,

________________________________
From: Linda Dunbar via Datatracker <[email-masked]<mailto:[email-masked]>>
Sent: Wednesday, January 26, 2022 8:20 PM
To: [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>
Subject: Secdir early review of draft-ietf-idr-rpd-15

Reviewer: Linda Dunbar
Review result: Has Nits

Summary:

Thank you very much
Linda Dunbar

---

From: Keyur <[email-masked]>
Date: Thu, 27 Jan 2022 13:54:50 -0800

Thank you for the review and comments Linda.

Best Regards,
Keyur

> On Jan 27, 2022, at 1:46 PM, Linda Dunbar <[email-masked]> wrote:
> 
> 
> Huaimo,
>