Re: [Idr] I-D ACTION:draft-ietf-idr-bgp-identifier-09.txt

[Enke Chen <enkechen at cisco.com>]

Hi, Ilya:

Please note that the OPEN message processing (and the session 
establishment) is on a per-session basis. Thus the collision resolution 
of one session (either ibgp or ebgp) would not impact another session.

Regards,   -- Enke

Ilya Varlashkin wrote:
>> -----Original Message-----
>> From: idr-bounces at ietf.org [mailto:idr-bounces at ietf.org] On 
>> Behalf Of Internet-Drafts at ietf.org
>> Sent: Tuesday, May 13, 2008 7:45 PM
>> To: i-d-announce at ietf.org
>> Cc: idr at ietf.org
>> Subject: [Idr] I-D ACTION:draft-ietf-idr-bgp-identifier-09.txt
>>
>> A New Internet-Draft is available from the on-line 
>> Internet-Drafts directories.
>>     
>
> I've looked at the draft and in current state there are potentially
> problems with sections 2.3 and 4 as follow:
>
> Consider existing iBGP session within AS-A where identifier of the
> remote side is X, and then new session connection comes from AS-B but
> also having BGP identifier of X. If AS-B is numerically larger than
> AS-A, then according to section 2.3 of the draft iBGP session towards
> router with id X should be closed.
>  This is security issue - an attacker
> with high AS number could deliberately set router-id to be same as some
> other router of a peering network (they may or may not be penalised for
> this but perhaps they want to do it anyway), effectively causing
> shutdown of iBGP session in remote AS. Nevertheless, section 4 of the
> draft says that security issues are not changed by the draft - I believe
> they're, and they make protocol weaker than original spec.
>
> If it's necessary to relax BGP ID definition and have it unique only
> locally within given AS, then in all collision detections BGP ID should
> only be compared when ASN are equal. If two sessions have same BGP ID on
> remote end but each with different ASN, then they should be considered
> as different routers.
>
> Kind regards,
> iLya
> _______________________________________________
> Idr mailing list
> Idr at ietf.org
> https://www.ietf.org/mailman/listinfo/idr
>   

_______________________________________________
Idr mailing list
Idr at ietf.org
https://www.ietf.org/mailman/listinfo/idr