Subject: RE: [tcpm] Joe Touch: [Tsvwg] new I-D: TCP Simple AuthenticationOption

From: "Caitlin Bestler" <[email-masked]>
Date: Wed, 14 Jun 2006 12:01:27 -0700

Pekka Savola wrote:
> On Wed, 14 Jun 2006, Joe Touch wrote:
>> Ron Bonica wrote:
>>> I don't think that Graceful Restart will be available in call cases.
>>> For example, it is likely to be unavailable on eBGP sessions between
>>> providers and their customers.
>> 
>> Why? Why would TCP-Auth be accepted where graceful restart isn't?
>> 
>> A technical argument would be useful here, but if this is a marketing
>> prediction, it isn't.
> 
> Enabling Graceful Restart can cause black holes and loops
> under valid and rather common scenarios (e.g., power loss,
> forwarding plane crash).  It has been designed in such a
> fashion that it cannot be enabled by default due to these bad
> effects, the users must know what they are doing. [1]
> 
> As such, major router vendors do not enable graceful restart
> by default.  It is not clear to me whether major router
> vendors enable graceful restart helper-mode by default.
> Helper mode is required for GR to be used.
> 
> Hence, you have two dependencies:
>   - you explicitly enable GR yourself and face the consequence,
>   - your peers have enabled GR helper mode.
> 

Is there any reason why re-keying a TCP-Auth connection is more
graceful than simply migrating the session to a new connection
with a different key and then closing the old connection?

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm

---

From: "Bora Akyol" <[email-masked]>
Date: Thu, 15 Jun 2006 15:35:01 -0700

> 
> Q. Why isn't IPSEC used? Several reason. The re-keying and 
> hitless issues I'll leave to Ron and the authors. My core 
> reason is that IPSEC for a control plane protocol (OSPF, BGP, 
> etc.) makes the router EXTREMELY vulnerable to a DOS attack. 
> 

Barry (continuing the discussion in NANOG),

Having done IPSEC/IKE code for quite a few years, I am as puzzled about
why
IPSEC does not meet the hitless upgrades/rekeying issues as everyone
else
out there.

Using my VPN client, I can stay connected to my work VPN for 24-72 hours
and never get disconnected. With a typical rekey being about 30 mins or
so.

I am also confused about why certificates in this environment are not a
good solution
instead of using preshared keys. It's not like we are trying to do PKI
for
every ant in the world. Oops, I used the dreaded P*I word ;)

Even if we used a preshared key (secret), it would still be secure to an
extent
as the preshared key is only used to derive the symmetric keys that are
used
to actually secure the connection, which is much better than what TCP
MD5 auth does.

I think the only other reason on why IPSEC may not work in this scenario
is possibly
because of the equipment involved may not have an IPSEC/IKE protocol
code.

Hope all is well,

Bora