Last Call Review of draft-ietf-bess-datacenter-gateway-10
review-ietf-bess-datacenter-gateway-10-secdir-lc-migault-2021-04-27-00
| Request | Review of | draft-ietf-bess-datacenter-gateway |
|---|---|---|
| Requested revision | No specific revision (document currently at 13) | |
| Type | Last Call Review | |
| Team | Security Area Directorate (secdir) | |
| Deadline | 2021-04-29 | |
| Requested | 2021-04-15 | |
| Authors | Adrian Farrel , John Drake , Eric C. Rosen , Keyur Patel , Luay Jalil | |
| I-D last updated | 2021-04-27 | |
| Completed reviews |
Rtgdir Early review of -06
by Ravi Singh
(diff)
Rtgdir Early review of -10 by Ravi Singh (diff) Genart Last Call review of -10 by Gyan Mishra (diff) Secdir Last Call review of -10 by Daniel Migault (diff) |
|
| Assignment | Reviewer | Daniel Migault |
| State | Completed | |
| Request | Last Call review on draft-ietf-bess-datacenter-gateway by Security Area Directorate Assigned | |
| Posted at | https://mailarchive.ietf.org/arch/msg/secdir/pkR7ha1N2UYrCSRYH2f1QSx_Eo8 | |
| Reviewed revision | 10 (document currently at 13) | |
| Result | Ready | |
| Completed | 2021-04-27 |
review-ietf-bess-datacenter-gateway-10-secdir-lc-migault-2021-04-27-00
Hi, Review result: Ready I reviewed this document as part of the Security Directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the Security Area Directors. However, in this case these comments mostly reflect some question to clarify my own understanding. Document authors, document editors, and WG chairs should treat these comments just like any other IETF Last Call comments. Yours, Daniel Just to clarify my understanding of Fig 1. BGP usually selects the best route, so if AS1-AS2 is the best, none of the traffic will go through AS3. However even in this configuration AS2 will select one of the GW and all traffic will go only to one of the GW1 or GW2. The Add-Path might be able to distinguishes between AS1-AS2 and AS3 but AS1-AS2 cannot be subdivided between two paths one that would terminates in GW1 and another that would terminates at GW2. I am not sure following acronyms may be expanded as well as AFI/SAFI being described with text as opposed to their values. I let you decide whether that is needed or not. OLD: An IPv4 or IPv6 NLRI containing one of the GW's loopback addresses (that is, with an AFI/SAFI pair that is one of 1/1, 2/1, 1/4, or 2/4). NEW An IPv4 or IPv6 Network Layer Reachability Information (NLRI) [RFC4760] containing one of the GW's loopback addresses (that is, with an Address Family Number (AFI)/ Subsequent Address Family (SAFI) pair that is one of IPv4/NLRI used for unicast forwarding (1/1), IPv6/NLRI used for unicast forwarding (2/1), IPv4/NLRI with MPLS Labels (1/4), or IPv6/NLRI with MPLS Labels (2/4)). Security consideration: When the information is shared between the domains, I am wondering if the information is encrypted or if the communication appears in clear text. If no encryption is used, that information is actually not limited to the two domains but to anyone on path can read it. If that is the case, information provided by the Egress SR domain to the Ingress SR Domain seems to me transiting through the backbone which makes the information pretty much public. I am wondering if I am missing something.