Re: Authentication Question

[Dave Katz <dkatz at juniper.net>]

On Aug 17, 2009, at 7:23 PM, Shahram Davari wrote:

> Hi,
>
> For BFD processing, the Base text says:
>
> "If the A bit is set and no authentication is in use (bfd.AuthType  
> is zero), the packet MUST be discarded."
>
> Isn't the bdf.AuthType set based on the A bit? If so then isn't this  
> statement a circular logic? Shouldn't it be changed to:
>
> "If the A bit is set and no authentication is in use (Authentication  
> header is not present), the packet MUST be discarded."

No.  bfd.AuthType is the local authentication setting;  the text you  
refer to deals with received packet processing.  The check ensures  
that if the remote system is specifying authentication (A bit set) but  
the local system isn't doing authentication (bfd.AuthType is zero) the  
packet is tossed.

The Authentication Header consistency check with the A bit comes a bit  
earlier in the acceptance tests (by examining the packet length.)

> And a general question. Since each packet is Authenticated on its  
> own, can Authentication type change in the middle of a Session? Or  
> can some BFD packets be transmitted with Authentication and some  
> without (off course with proper setting of A flag)?

No, because bfd.AuthType is going to be static and unsynchronized with  
the far end.  See section 6.7.1 for a discussion on enabling and  
disabling authentication.

--Dave

> Thanks,
> Shahram