Subject: RE: ppvpn effort support

From: "Steven.Wright" <[email-masked]>
Date: Wed, 7 May 2003 10:54:25 -0400

> -----Original Message-----
> From: Eric Rosen [mailto:[email-masked]]
> Sent: Thursday, April 24, 2003 1:20 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: ppvpn effort support
>
>
>
> Steven> while the  hierarchical concepts of draft lasserre
> are important, I
> Steven> expect  these   notions  of   hierarchy  will  be
> associated  with
> Steven> administrative  boundaries.  Administrative
> boundaries  also  imply
> Steven> administrative  policy and  BGP is  the accepted
> tool  for managing
> Steven> this.
>
> I wonder  if you could  be more specific  about this, perhaps
> an  example of
> inter-AS L2VPN  service where you  want to set  up policies
> at  the inter-AS
> border.   I'd like  to  understand better  the  degree to
> which the  policy
> management is dependent on the underlying signaling protocol.
>
 Consider the security aspects in an inter-AS case.
Current administrative policy restricts inter-AS control plane interactions
to those between BGP peers.
It would take a significant effort to change this security policy to permit
signaling (using another protocol no less!) from outside my AS to an
arbitrary router within my AS. Service architectures need to fit within the
constraints of administrative security policies.

---

From: "Busschbach, Peter B (Peter)" <[email-masked]>
Date: Wed, 7 May 2003 13:26:47 -0400

> From: Steven.Wright [mailto:[email-masked]]
> Sent: Wednesday, May 07, 2003 10:54 AM

> constraints of administrative security policies.

Steven,

In case of PW-over-MPLS, I would think that the setup of an LSP between two PEs needs to comply with the administrative poicies that govern inter-AS traffic. However, once that LSP has been set up and the two PES are essentially peers, do you still need to through BGP routers to exchange PW labels?

In case of PW-over-IP the situation is different (which sounds like an echo of Neil Harrison's emails). I would argue that in general all signaling doesn't through BGP peers, e.g. in case of the setup of IPsec tunnels. The bigger question, however, is: do you think that in case of PW-over-IP, use of BGP for signaling solves all security problems?

Thanks,

Peter