Subject: RE: VPLS model for L2VPN Framework document

From: [email-masked]
Date: Thu, 29 May 2003 18:21:01 +0100

Eric,

The security concern I was thinking of is the possibility of a customer
injecting untagged frames into the SP network via a trunk port. In an
Ethernet switch all untagged frames arriving on a trunk port can either be
dropped or forwarded on the native VLAN (where the forward or drop action is
dependant on the implementation and configuration). If untagged customer
frames are not dropped by default, then access lists would have to be used
to ensure untagged customer frames were not forwarded on the untagged VPLS
instance. This is probably an implementation issue rather than something
that would need to be defined in the draft.

Richard

 > -----Original Message-----
 > From: [email-masked] [mailto:[email-masked]]
 > Sent: 29 May 2003 17:34
 > To: [email-masked]
 > Cc: [email-masked]
 > Subject: RE: VPLS model for L2VPN Framework document
 > 
 > 
 > Eric
 > 
 > Is the sole purpose of the untagged VPLS instance to carry 
 > service provider
 > BPDUs? If so there aren't any security concerns as all other 
 > untagged frames
 > can simply be dropped. However, I think the general term 
 > "untagged packets"
 > is misleading:
 > 
 > - a further distinct  VPLS instance is used to  carry the 
 > "untagged packets"
 >   of the emulated LAN.
 > 
 > Perhaps replacing "untagged packets" with "Service provider 
 > BPDUs" would
 > provide clarification on exactly what traffic can be carried 
 > using this VPLS
 > instance?
 > 
 > Richard
 > 
 >  > -----Original Message-----
 >  > From: Eric Rosen [mailto:[email-masked]]
 >  > Sent: 29 May 2003 15:29
 >  > To: Spencer,R,Richard,XGH5 R
 >  > Cc: [email-masked]
 >  > Subject: Re: VPLS model for L2VPN Framework document 
 >  > 
 >  > 
 >  > 
 >  > Richard> Is the  intention here  to create 1  VPLS control 
 >  > instance  (i) per
 >  > Richard> customer
 >  > 
 >  > No. 
 >  > 
 >  > Richard>  or (ii) per service provider network? 
 >  > 
 >  > Not necessarily limited to one per service provider network. 
 >  > 
 >  > However, this would be a deployment consideration, I think.
 >  > 
 >  > Richard> what  traffic  will be  carried  over  the  control 
 >  > VPLS?  Untagged
 >  > Richard> customer  frames or  untagged service  provider 
 >  > frames,  either way
 >  > Richard> this sounds like it may lead to security concerns.
 >  > 
 >  > I  think "untagged  service provider  frames" is  the 
 >  > answer.   What  is the
 >  > security concern? 
 >  > 
 > 
 > 
 >

---

From: "Steven.Wright" <[email-masked]>
Date: Thu, 29 May 2003 15:28:55 -0400

I'm not sure these are implementation only issues -
I suspect most service providers have requirements to
(i) use network assigned services instances for their own network management
purposes and
(ii) inject & remove OAM traffic for diagnostic purposes into vpls service
instances

Steven Wright

> Sent: Thursday, May 29, 2003 1:21 PM
> To: [email-masked]; [email-masked]

---

From: Eric Rosen <[email-masked]>
Date: Fri, 30 May 2003 10:25:54 -0400

Richard> The  security concern I  was thinking  of is  the possibility  of a
Richard> customer injecting untagged frames into  the SP network via a trunk
Richard> port. 

I'm not sure I see what this has to do with VPLS.  I'd have thought that SPs
don't let their  customers inject untagged frames into the  SP network via a
trunk port.  If they do, there seems to be a security problem whether or not
VPLS is in use.