Skip to main content

Last Call Review of draft-ietf-bess-evpn-oam-req-frmwk-04
review-ietf-bess-evpn-oam-req-frmwk-04-secdir-lc-shore-2021-02-15-00

Request Review of draft-ietf-bess-evpn-oam-req-frmwk
Requested revision No specific revision (document currently at 10)
Type Last Call Review
Team Security Area Directorate (secdir)
Deadline 2021-02-16
Requested 2021-02-02
Authors Samer Salam , Ali Sajassi , Sam Aldrin , John Drake , Donald E. Eastlake 3rd
Draft last updated 2021-02-15
Completed reviews Rtgdir Last Call review of -04 by Stig Venaas (diff)
Secdir Last Call review of -04 by Melinda Shore (diff)
Genart Last Call review of -04 by David Schinazi (diff)
Tsvart Last Call review of -04 by David L. Black (diff)
Secdir Telechat review of -07 by Melinda Shore (diff)
Assignment Reviewer Melinda Shore
State Completed
Review review-ietf-bess-evpn-oam-req-frmwk-04-secdir-lc-shore-2021-02-15
Posted at https://mailarchive.ietf.org/arch/msg/secdir/4VMIavdPpc9NbHzWOOw04RM6l8I
Reviewed revision 04 (document currently at 10)
Result Has Nits
Completed 2021-02-15
review-ietf-bess-evpn-oam-req-frmwk-04-secdir-lc-shore-2021-02-15-00
This is a very nicely-structured, efficient, well-written document - among the
most clearly-written that I've read in a few years.

Nits:  As a minor point, I am really not a fan of using RFC 2119 language for
informational documents, and in this case it's being used somewhat
inconsistently (for example, the lowercase "must" in section 4).  I'm also a
bit unclear on what's intended by "must optionally authenticate" and suggest
that that should be clarified as to whether what's meant is "mandatory to
implement but optional to use," or "optional to implement" and should probably
be a "SHOULD" (or a "should").  Additionally, it may be helpful to provide an
example or two of how the EVPN OAM channel could be exploited as a DOS vector,
and to explain what problem is solved by authenticating EVPN endpoints.