Re: [secdir] Secdir review of draft-ietf-l2vpn-ipls-14

"Shah, Himanshu" <hshah@ciena.com> Tue, 14 October 2014 21:08 UTC

From: "Shah, Himanshu" <hshah@ciena.com>
To: "Zhangdacheng (Dacheng)" <zhangdacheng@huawei.com>, "draft-ietf-l2vpn-ipls@tools.ietf.org" <draft-ietf-l2vpn-ipls.all@tools.ietf.org>
Date: Tue, 14 Oct 2014 17:07:52 -0400
Thread-Topic: Secdir review of draft-ietf-l2vpn-ipls-14
Thread-Index: Ac+tbKBmSURf/kQdQ6KYONVa4goh8A6YqBzQ
Message-ID: <40746B2300A8FC4AB04EE722A593182B7B575438@ONWVEXCHMB04.ciena.com>
References: <C72CBD9FE3CA604887B1B3F1D145D05E7BCAD63E@nkgeml507-mbs.china.huawei.com>
In-Reply-To: <C72CBD9FE3CA604887B1B3F1D145D05E7BCAD63E@nkgeml507-mbs.china.huawei.com>
Accept-Language: en-US, en-CA
Content-Language: en-US
acceptlanguage: en-US, en-CA
Content-Type: multipart/alternative; boundary="_000_40746B2300A8FC4AB04EE722A593182B7B575438ONWVEXCHMB04cie_"
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/secdir/BB5y-z5shWbp4mAXYL3I1tSoIeg
Cc: IESG <iesg@ietf.org>, "secdir@ietf.org" <secdir@ietf.org>
Subject: Re: [secdir] Secdir review of draft-ietf-l2vpn-ipls-14
Precedence: list

Hi Dacheng,
Thanks for your review and suggestions for improvements.
I also apologize for the delay in the response.

My comments in line.

Regards,
himanshu

From: Zhangdacheng (Dacheng) [mailto:zhangdacheng@huawei.com]
Sent: Friday, August 01, 2014 2:40 AM
To: draft-ietf-l2vpn-ipls@tools.ietf.org
Cc: IESG; secdir@ietf.org
Subject: Secdir review of draft-ietf-l2vpn-ipls-14


Hello,

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

This document proposes a 'simplified' type of VPLS which only support IP. In addition, in this solution the maintenance of the MAC forwarding tables is done via a control plane protocol, rather than via the MAC address learning procedures specified in [IEEE 802.1D]

I think this document is almost ready for publication. Two comments are as follows:

1)       In security consideration, MD5 should not be recommended. So, "authenticating the LDP messages using MD5 authentication." could be changed to "authenticating the LDP messages by verifying keyed digests."

Himanshu> OK, I will change the text.

2) In this solution, a PE actively detects the presence of local CEs by snooping IP and ARP frames received over the ACs. As the PE discovers each locally attached CE, a unicast multipoint- to-point pseudowire (mp2p PW) associated exclusively with that CE is created by distributing the MAC address and optionally IP address of the CE along with a PW-Label to all the remote PE peers that participate in the same IPLS instance. So, IMHO, DDoS attacks by generating large amounts of bogus IP and ARP frames should be considered, and counter measures should be provided. For instance, MAC addresses of CEs should be distributed only in a limited frequency.

[himanshu>] I believe the rate control should be left up to the implementation.

Cheers

Dacheng

[secdir] Secdir review of draft-ietf-l2vpn-ipls-14 Zhangdacheng (Dacheng)
Re: [secdir] Secdir review of draft-ietf-l2vpn-ip… Shah, Himanshu