Subject: Re: BFD LSP Ping

From: Greg Mirsky <[email-masked]>
Date: Tue, 9 Feb 2010 13:36:48 -0800

Dear All,
I've found this thread is the closest to a question of my own and since I
couldn't find any conclusion decided to add $.02
As Vishwas have mentioned, BFD MPLS draft requires single hop UDP port 3784
when BFD control packets are sent over MPLS LSP in IP/UDP encapsulation. But
it requires set IP TTL of BFD packet to 1 while BFD single hop document in
Section 5 requires TTL == 255 if Authentication not in use. BFD packet must
be discarded if received TTL /= 255. If Authentication being used, still,
TTL == 255 required, but "check TTL" eased to "may drop if TTL /= 255".

Should BFD MPLS text be changed to sync with BFD single hop in regard to
setting TTL value?

Regards,
Greg

On Wed, Oct 28, 2009 at 9:58 AM, Vishwas Manral <[email-masked]>wrote:

> Hi,
>
> I noticed a basic issue with BFD LSP ping with a a TTL processing in a
> Uniform Model LSP.
>
> The draft states that:
>
>
>   The BFD control packet sent by the ingress LSR MUST be a UDP packet
>   with a well known destination port 3784 [BFD-IP] and a source port
>   assigned by the sender as per the procedures in [BFD-IP].
>
> A single hop session verifies the TTL is 255. However the TTL in the
> IP header is changed at the Egress before the IP header handling
> because we are using hte uniform model. I think the easiest and the
> best way for this would be to use Multihop sessions in both
> directions.
>
> Do let me know if I am missing something?
>
> Thanks,
> Vishwas
>

---

From: "Shahram Davari" <[email-masked]>
Date: Tue, 9 Feb 2010 14:02:21 -0800

Hi Greg,

Do you know the reason why TTL=255 check is not required for BFD with Authentication?

Thanks,
Shahram

________________________________
From: [email-masked] [mailto:[email-masked]] On Behalf Of Greg Mirsky
Sent: Tuesday, February 09, 2010 1:37 PM
To: Vishwas Manral
Cc: Kireeti Kompella; [email-masked]; [email-masked]
Subject: Re: BFD LSP Ping

Dear All,
I've found this thread is the closest to a question of my own and since I couldn't find any conclusion decided to add $.02
As Vishwas have mentioned, BFD MPLS draft requires single hop UDP port 3784 when BFD control packets are sent over MPLS LSP in IP/UDP encapsulation. But it requires set IP TTL of BFD packet to 1 while BFD single hop document in Section 5 requires TTL == 255 if Authentication not in use. BFD packet must be discarded if received TTL /= 255. If Authentication being used, still, TTL == 255 required, but "check TTL" eased to "may drop if TTL /= 255".

Should BFD MPLS text be changed to sync with BFD single hop in regard to setting TTL value?

Regards,
Greg

On Wed, Oct 28, 2009 at 9:58 AM, Vishwas Manral <[email-masked]<mailto:[email-masked]>> wrote:
Hi,

The draft states that:

Thanks,
Vishwas

---

From: Vishwas Manral <[email-masked]>
Date: Tue, 9 Feb 2010 14:04:08 -0800

Hi Shahram,

The idea is the TTL check is an approximation of the sanity of the packet.
When authentication is enabled this check is redundant in my view and hence
the check is not required.

Thanks,
Vishwas
On Tue, Feb 9, 2010 at 2:02 PM, Shahram Davari <[email-masked]> wrote:

>  ------------------------------
> *From:* [email-masked] [mailto:[email-masked]] *On
> Behalf Of *Greg Mirsky
> *Sent:* Tuesday, February 09, 2010 1:37 PM
> *To:* Vishwas Manral
> *Cc:* Kireeti Kompella; [email-masked]; [email-masked]
>
> *Subject:* Re: BFD LSP Ping
>
>   Dear All,

---

From: "Shahram Davari" <[email-masked]>
Date: Tue, 9 Feb 2010 14:07:41 -0800

Hi Wishwas,

One more questions. The BFD drafts are all very ambiguous regarding interface binding check? is there a requirement to check BFD binding to incoming interface? How about binding to an incoming tunnel?

Thanks,
Shahram

________________________________
From: Vishwas Manral [mailto:[email-masked]]
Sent: Tuesday, February 09, 2010 2:04 PM
To: Shahram Davari
Cc: Greg Mirsky; Kireeti Kompella; [email-masked]; [email-masked]
Subject: Re: BFD LSP Ping

Hi Shahram,

The idea is the TTL check is an approximation of the sanity of the packet. When authentication is enabled this check is redundant in my view and hence the check is not required.

Thanks,
Vishwas
On Tue, Feb 9, 2010 at 2:02 PM, Shahram Davari <[email-masked]<mailto:[email-masked]>> wrote:
Hi Greg,

Thanks,
Shahram

________________________________
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Greg Mirsky
Sent: Tuesday, February 09, 2010 1:37 PM
To: Vishwas Manral
Cc: Kireeti Kompella; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>

Dear All,

Regards,
Greg

The draft states that:

Thanks,
Vishwas

---

From: Greg Mirsky <[email-masked]>
Date: Tue, 9 Feb 2010 14:22:05 -0800

Hi Shahram,
I agree with Shahram. TTL Check is viewed as minimal, weaker than
authentication, security measure to protect one from spoofing.
To your second question (another mail I've noticed), I believe that Section
9. Security Considerations in BFD single hop document recommends association
of a BFD session with incoming interface as method to improve infrastructure
security.

Regards,
Greg

---

From: Vishwas Manral <[email-masked]>
Date: Tue, 9 Feb 2010 15:05:09 -0800

Hi Shahram,

I think for single-hop sessions the interface/ tunnel binding check is
necessary. This however may not be the case for Multi-hop sessions.

Thanks,
Vishwas

On Tue, Feb 9, 2010 at 2:07 PM, Shahram Davari <[email-masked]> wrote:

>  Hi Wishwas,
>
> One more questions. The BFD drafts are all very ambiguous regarding
> interface binding check? is there a requirement to check BFD binding to
> incoming interface? How about binding to an incoming tunnel?
>
> Thanks,
> Shahram
>
>
>
> *From:* Vishwas Manral [mailto:[email-masked]]
> *Sent:* Tuesday, February 09, 2010 2:04 PM
> *To:* Shahram Davari
> *Cc:* Greg Mirsky; Kireeti Kompella; [email-masked]; [email-masked]
>
> On Tue, Feb 9, 2010 at 2:02 PM, Shahram Davari <[email-masked]>wrote:
>
>>  Hi Greg,
>>
>> As Vishwas have mentioned, BFD MPLS draft requires single hop UDP port
>> 3784 when BFD control packets are sent over MPLS LSP in IP/UDP
>> encapsulation. But it requires set IP TTL of BFD packet to 1 while BFD
>> single hop document in Section 5 requires TTL == 255 if Authentication not
>> in use. BFD packet must be discarded if received TTL /= 255. If
>> Authentication being used, still, TTL == 255 required, but "check TTL" eased
>> to "may drop if TTL /= 255".
>>

---

From: "Shahram Davari" <[email-masked]>
Date: Tue, 9 Feb 2010 16:09:18 -0800

Hi,

But this doesn't work when you have MPLS PHP or when you have MPLS FRR or when you have OSPF rerouting to a different interface.

Regards,
Shahram

Sent: Tuesday, February 09, 2010 3:05 PM

Hi Shahram,

I think for single-hop sessions the interface/ tunnel binding check is necessary. This however may not be the case for Multi-hop sessions.

Thanks,
Vishwas

On Tue, Feb 9, 2010 at 2:07 PM, Shahram Davari <[email-masked]<mailto:[email-masked]>> wrote:
Hi Wishwas,

Thanks,
Shahram

________________________________
From: Vishwas Manral [mailto:[email-masked]<mailto:[email-masked]>]
Sent: Tuesday, February 09, 2010 2:04 PM
To: Shahram Davari
Cc: Greg Mirsky; Kireeti Kompella; [email-masked]<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>

Hi Shahram,

Thanks,
Vishwas

Thanks,
Shahram

Dear All,

Regards,
Greg

The draft states that:

Thanks,
Vishwas

---

From: Vishwas Manral <[email-masked]>
Date: Tue, 9 Feb 2010 16:42:36 -0800

Hi Shahram,

There is no-rerouting allowed in the case of a directly connected interface
adjacency in OSPF.

However you are right regarding rerouting etc where we probably need to
check the two LSP's as one.

Thanks,
Vishwas
On Tue, Feb 9, 2010 at 4:09 PM, Shahram Davari <[email-masked]> wrote:

>  Hi,
>
> But this doesn't work when you have MPLS PHP or when you have MPLS FRR or
> when you have OSPF rerouting to a different interface.
>
> Regards,
> Shahram
>
> *Sent:* Tuesday, February 09, 2010 3:05 PM
>
> *To:* Shahram Davari
> On Tue, Feb 9, 2010 at 2:07 PM, Shahram Davari <[email-masked]>wrote:
>
>>  Hi Wishwas,
>>

---

From: "Shahram Davari" <[email-masked]>
Date: Tue, 9 Feb 2010 17:26:00 -0800

Hi Wishwas,

OK, may be no OSPF reroute is possible for 1-hop, but in a multi-access media such as 802.1 Ethernet, the Spanning tree can change the arriving interface. Also LAG can also change the interface.

Therefore I don't think checking the interface is a good thing.

Regards,
Shahram

Sent: Tuesday, February 09, 2010 4:43 PM

Hi Shahram,

There is no-rerouting allowed in the case of a directly connected interface adjacency in OSPF.

However you are right regarding rerouting etc where we probably need to check the two LSP's as one.

Thanks,
Vishwas
On Tue, Feb 9, 2010 at 4:09 PM, Shahram Davari <[email-masked]<mailto:[email-masked]>> wrote:
Hi,

Regards,
Shahram

To: Shahram Davari

Hi Shahram,

Thanks,
Vishwas

Thanks,
Shahram

Hi Shahram,

Thanks,
Vishwas

Thanks,
Shahram

Dear All,

Regards,
Greg

The draft states that:

Thanks,
Vishwas

---

From: Vishwas Manral <[email-masked]>
Date: Tue, 9 Feb 2010 17:31:22 -0800

LAG interfaces will be shown as 1 interface to layer-3.

Thanks,
Vishwas
On Tue, Feb 9, 2010 at 5:26 PM, Shahram Davari <[email-masked]> wrote:

>  Hi Wishwas,
>
> OK, may be no OSPF reroute is possible for 1-hop, but in a multi-access
> media such as 802.1 Ethernet, the Spanning tree can change the arriving
> interface. Also LAG can also change the interface.
>
> *Sent:* Tuesday, February 09, 2010 4:43 PM
>
> *To:* Shahram Davari
> On Tue, Feb 9, 2010 at 4:09 PM, Shahram Davari <[email-masked]>wrote:
>
>>  Hi,
>>
>>> The idea is the TTL check is an approximation of the sanity of the
>>> packet. When authentication is enabled this check is redundant in my view
>>> and hence the check is not required.
>>>
>>> Thanks,
>>> Vishwas
>>>> I've found this thread is the closest to a question of my own and since
>>>> I couldn't find any conclusion decided to add $.02
>>>> On Wed, Oct 28, 2009 at 9:58 AM, Vishwas Manral <[email-masked]
>>>> > wrote:
>>>>
>>>>> Hi,
>>>>>