Subject: BFD For MPLS LSPs

From: Vishwas Manral <[email-masked]>
Date: Mon, 17 Aug 2009 16:49:56 -0700

Hi authors,

I noticed you have wrongly used the address "0:0:0:0:0:FFFF:7F00/104"
which is not a valid IPv6 address. Can you use the addresse as defined
in the draft-ietf-pwe3-vccv-bfd-07?

It has been agreed upon when we had a discussion between Carlos, Brian
Carpenter and I (for the other drafts that use the same wrong
address).

Thanks,
Vishwas

---

From: "Shahram Davari" <[email-masked]>
Date: Mon, 17 Aug 2009 18:23:31 -0700

Hi,

For BFD processing, the Base text says:

"If the A bit is set and no authentication is in use (bfd.AuthType is zero), the packet MUST be discarded."

Isn't the bdf.AuthType set based on the A bit? If so then isn't this statement a circular logic? Shouldn't it be changed to:

"If the A bit is set and no authentication is in use (Authentication header is not present), the packet MUST be discarded."

And a general question. Since each packet is Authenticated on its own, can Authentication type change in the middle of a Session? Or can some BFD packets be transmitted with Authentication and some without (off course with proper setting of A flag)?

Thanks,
Shahram

---

From: Vishwas Manral <[email-masked]>
Date: Mon, 17 Aug 2009 20:19:55 -0700

Hi Shahram,

I think the sentence is ok in the spec. Yes we should be able to
change Keys as well. I think something related to that is given in the
spec already.

Thanks,
Vishwas

---

From: Dave Katz <[email-masked]>
Date: Mon, 17 Aug 2009 22:34:35 -0600

On Aug 17, 2009, at 7:23 PM, Shahram Davari wrote:

> Isn't the bdf.AuthType set based on the A bit? If so then isn't this  
> statement a circular logic? Shouldn't it be changed to:
>
> "If the A bit is set and no authentication is in use (Authentication  
> header is not present), the packet MUST be discarded."

No.  bfd.AuthType is the local authentication setting;  the text you  
refer to deals with received packet processing.  The check ensures  
that if the remote system is specifying authentication (A bit set) but  
the local system isn't doing authentication (bfd.AuthType is zero) the  
packet is tossed.

The Authentication Header consistency check with the A bit comes a bit  
earlier in the acceptance tests (by examining the packet length.)

>
>
> And a general question. Since each packet is Authenticated on its  
> own, can Authentication type change in the middle of a Session? Or  
> can some BFD packets be transmitted with Authentication and some  
> without (off course with proper setting of A flag)?

No, because bfd.AuthType is going to be static and unsynchronized with  
the far end.  See section 6.7.1 for a discussion on enabling and  
disabling authentication.

--Dave

---

From: Vishwas Manral <[email-masked]>
Date: Tue, 18 Aug 2009 16:18:18 -0700

Hi Authors,

I had another comment. I guess you can clarify that the BFD on the LSP
ping Initiator should be started in Passive role while on the
terminator it should be in the Active Role.

   "A system taking the Active role MUST send BFD
   Control packets for a particular session, regardless of whether it
   has received any BFD packets for that session.  A system taking the
   Passive role MUST NOT begin sending BFD packets for a particular
   session until it has received a BFD packet for that session, and thus
   has learned the remote system's discriminator value."

Thanks,
Vishwas