Re: Securing BGP sessions (Issue#41)
Mahesh Jethanandani <[email protected]> Fri, 13 Dec 2019 15:55:08 -0800
| Newsgroups | gmane.ietf.idr |
|---|---|
| Message-ID | <[email protected]> |
--===============4627553993539147384== Content-Type: multipart/alternative; boundary="Apple-Mail=_29C6CEBA-F582-42B8-98FC-55AA7CCC248E" --Apple-Mail=_29C6CEBA-F582-42B8-98FC-55AA7CCC248E Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Acee, I realize that the last e-mail did not help. So let me see if this is = any better. If I understand you correctly, you are suggesting that securing BGP with = MD5 and TCP-AO is adequately documented, and I agree. We just need a = YANG model (in a different document) that defines groupings for them = such that the BGP model can use them. BTW, work has started in TCPM to = define just that model, just that it is still an I-D, and not a WG = document. That puts BGP YANG model in a downrev with that draft. If at = the time of publication, the draft has not made progress, IDR will have = to make a decision of whether they want to keep that dependency or push = support for secure sessions out into a -bis document. To the question of IPsec, and whether we should support it or not, as I = said, I will let Jeff comment. But what kind of documentation are you = hoping for? Isn=E2=80=99t it just a question of giving IKE the = parameters it needs to setup a IPsec tunnel? If we decide to support it, = i2nsf WG has been working on an IKE model, as I just learnt, complete = with re-keying, which with a few changes could be used by the BGP model. Cheers. > On Dec 13, 2019, at 10:47 AM, Acee Lindem (acee) <[email protected]> = wrote: >=20 > Hi Mahesh,=20 >=20 > =EF=BB=BFOn 12/10/19, 8:41 PM, "Mahesh Jethanandani" = <[email protected] <mailto:[email protected]>> wrote: >=20 >=20 >=20 >> On Dec 10, 2019, at 5:29 PM, Acee Lindem (acee) <[email protected]> = wrote: >>=20 >> Hi Mahesh,=20 >>=20 >> On 12/10/19, 8:19 PM, "Mahesh Jethanandani" <[email protected]> = wrote: >>=20 >> Hi Acee, >>=20 >>> On Dec 10, 2019, at 5:10 PM, Acee Lindem (acee) <[email protected]> = wrote: >>>=20 >>> Hi Mahesh,=20 >>> I assume by IPsec, you mean transport mode IPsec. >>=20 >> Yes. The assumption is that the underlying transport is secured = using IPsec, and the model provides (if needed) key parameters needed to = kick off the IKE to setup the SA in IPsec. >>=20 >> HTH. >>=20 >> Well it doesn't help at all.... Normally, the usage of IPsec (AH, = ESP, algorithms, key exchange, etc.) would be specified in some = document. For example, IPsec usage by OSPFv3 is specified in RFC 4552. = Granted, it is a lot simpler for BGP than OSPFv3 since BGP is strictly = P2P but specification would still seem to necessary.=20 >=20 > You are right. It should be some document. That document in my mind = is the YANG model for IPsec/IKE, something we need to ask the SEC ADs = about. You would agree that what needs to be defined is not BGP = specific, and therefore does not belong in the BGP model. >=20 > Much like TCP-AO and TCP-MD5 I expect this other document to define = a grouping that the BGP model imports and uses to define what is needed = to setup IPsec. >=20 > Actually I disagree with you - TCP MD5 and TCP-AO are more than = adequately documented.=20 >=20 > MD5 - https://datatracker.ietf.org/doc/rfc2385/ = <https://datatracker.ietf.org/doc/rfc2385/> > TCP-AO - https://datatracker.ietf.org/doc/rfc5925/ = <https://datatracker.ietf.org/doc/rfc5925/> >=20 > It is only IPsec transport mode that isn't described. Also, I don't = know of anyone who supports this so I'm wondering why it is in the = discussion for this version of the BGP YANG model. >=20 > Thanks, > Acee >=20 >=20 > Cheers. >=20 >>=20 >> Thanks, >> Acee >>=20 >>=20 >>> For IPsec protection of BGP, where are the details specified?=20 >>> Thanks, >>> Acee >>>=20 >>> On 12/10/19, 7:35 PM, "Idr on behalf of Mahesh Jethanandani" = <[email protected] on behalf of [email protected]> wrote: >>>=20 >>> This is the second thread in the list of issues that were discussed = in IETF 106 w.r.t. to BGP YANG model. This particular thread is to = discuss the issue of defining how BGP sessions are going to be secured. >>>=20 >>> As stated in Singapore, the model is being defined to secure BGP = sessions using=20 >>> - TCP AO >>> - TCP MD5 >>> - IPSec >>>=20 >>> In case there was a question of why MD5, it is because there are = existing implementations that are choosing to stay with MD5, regardless = of the issues that have been raised about MD5. The model therefore has = to support such implementations. >>>=20 >>> The model will use the ietf-key-chain model=E2=80=99s (RFC 8177) = key-chain-ref to refer to an instance of the key chain. By doing that it = will make use of the key rollover capability defined in that model, and = for static key configuration by setting the end time to infinite in the = key chain. The BGP model will leave the case of IPSec as TBD for now, = and fill it when/if the IPSec YANG model is defined. >>>=20 >>> Questions/Concerns? >>>=20 >>> Mahesh Jethanandani >>> [email protected] >>>=20 >>>=20 >>>=20 >>> _______________________________________________ >>> Idr mailing list >>> [email protected] >>> https://www.ietf.org/mailman/listinfo/idr >>>=20 >>>=20 >>=20 >> Mahesh Jethanandani >> [email protected] >>=20 >>=20 >>=20 >>=20 >>=20 >=20 > Mahesh Jethanandani > [email protected] --Apple-Mail=_29C6CEBA-F582-42B8-98FC-55AA7CCC248E Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">Hi = Acee,<div class=3D""><br class=3D""></div><div class=3D"">I realize that = the last e-mail did not help. So let me see if this is any = better.</div><div class=3D""><br class=3D""></div><div class=3D"">If I = understand you correctly, you are suggesting that securing BGP with MD5 = and TCP-AO is adequately documented, and I agree. We just need a YANG = model (in a different document) that defines groupings for them such = that the BGP model can use them. BTW, work has started in TCPM to define = just that model, just that it is still an I-D, and not a WG document. = That puts BGP YANG model in a downrev with that draft. If at the time of = publication, the draft has not made progress, IDR will have to make a = decision of whether they want to keep that dependency or push support = for secure sessions out into a -bis document.</div><div class=3D""><br = class=3D""></div><div class=3D"">To the question of IPsec, and whether = we should support it or not, as I said, I will let Jeff comment. But = what kind of documentation are you hoping for? Isn=E2=80=99t it just a = question of giving IKE the parameters it needs to setup a IPsec tunnel? = If we decide to support it, i2nsf WG has been working on an IKE model, = as I just learnt, complete with re-keying, which with a few changes = could be used by the BGP model.</div><div class=3D""><br = class=3D""></div><div class=3D"">Cheers.<br class=3D""><div><br = class=3D""><blockquote type=3D"cite" class=3D""><div class=3D"">On Dec = 13, 2019, at 10:47 AM, Acee Lindem (acee) <<a = href=3D"mailto:[email protected]" class=3D"">[email protected]</a>> = wrote:</div><br class=3D"Apple-interchange-newline"><div class=3D""><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;" class=3D"">Hi Mahesh,<span = class=3D"Apple-converted-space"> </span></span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;" class=3D"">=EF=BB=BFOn 12/10/19, 8:41 PM, = "Mahesh Jethanandani" <</span><a = href=3D"mailto:[email protected]" style=3D"font-family: Helvetica; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: normal; letter-spacing: normal; orphans: auto; text-align: = start; text-indent: 0px; text-transform: none; white-space: normal; = widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; = -webkit-text-stroke-width: 0px;" = class=3D"">[email protected]</a><span style=3D"caret-color: rgb(0, = 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline !important;" = class=3D"">> wrote:</span><br style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><br style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><br style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><br style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><blockquote type=3D"cite" = style=3D"font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = orphans: auto; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; widows: auto; word-spacing: 0px; = -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D"">On Dec 10, 2019, at 5:29 PM, Acee = Lindem (acee) <<a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:<br class=3D""><br class=3D"">Hi = Mahesh,<span class=3D"Apple-converted-space"> </span><br = class=3D""><br class=3D"">On 12/10/19, 8:19 PM, "Mahesh Jethanandani" = <<a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:<br class=3D""><br = class=3D""> Hi Acee,<br class=3D""><br class=3D""><blockquote = type=3D"cite" class=3D"">On Dec 10, 2019, at 5:10 PM, Acee Lindem (acee) = <<a href=3D"mailto:[email protected]" class=3D"">[email protected]</a>> = wrote:<br class=3D""><br class=3D"">Hi Mahesh,<span = class=3D"Apple-converted-space"> </span><br class=3D"">I assume by = IPsec, you mean transport mode IPsec.<br class=3D""></blockquote><br = class=3D""> Yes. The assumption is that the underlying = transport is secured using IPsec, and the model provides (if needed) key = parameters needed to kick off the IKE to setup the SA in IPsec.<br = class=3D""><br class=3D""> HTH.<br class=3D""><br = class=3D"">Well it doesn't help at all.... Normally, the usage of IPsec = (AH, ESP, algorithms, key exchange, etc.) would be specified in some = document. For example, IPsec usage by OSPFv3 is specified in RFC 4552. = Granted, it is a lot simpler for BGP than OSPFv3 since BGP is strictly = P2P but specification would still seem to necessary.<span = class=3D"Apple-converted-space"> </span><br = class=3D""></blockquote><br style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><span style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline !important;" = class=3D""> You are right. It should be some document. = That document in my mind is the YANG model for IPsec/IKE, something we = need to ask the SEC ADs about. You would agree that what needs to be = defined is not BGP specific, and therefore does not belong in the BGP = model.</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D""><br style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D""><span style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;" = class=3D""> Much like TCP-AO and TCP-MD5 I expect this = other document to define a grouping that the BGP model imports and uses = to define what is needed to setup IPsec.</span><br style=3D"caret-color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: normal; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><br style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><span style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline !important;" = class=3D"">Actually I disagree with you - TCP MD5 and TCP-AO are more = than adequately documented.<span = class=3D"Apple-converted-space"> </span></span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;" class=3D""> MD5 -<span = class=3D"Apple-converted-space"> </span></span><a = href=3D"https://datatracker.ietf.org/doc/rfc2385/" style=3D"font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; orphans: auto; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; = -webkit-text-stroke-width: 0px;" = class=3D"">https://datatracker.ietf.org/doc/rfc2385/</a><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;" class=3D""> TCP-AO -<span = class=3D"Apple-converted-space"> </span></span><a = href=3D"https://datatracker.ietf.org/doc/rfc5925/" style=3D"font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; orphans: auto; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; = -webkit-text-stroke-width: 0px;" = class=3D"">https://datatracker.ietf.org/doc/rfc5925/</a><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;" class=3D"">It is only IPsec transport mode = that isn't described. Also, I don't know of anyone who supports this so = I'm wondering why it is in the discussion for this version of the BGP = YANG model.</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D""><br style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D""><span style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;" = class=3D"">Thanks,</span><br style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><span style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline !important;" = class=3D"">Acee</span><br style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><br style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><br style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><span style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline !important;" = class=3D""> Cheers.</span><br style=3D"caret-color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: normal; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><br style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><blockquote type=3D"cite" = style=3D"font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: normal; letter-spacing: normal; = orphans: auto; text-align: start; text-indent: 0px; text-transform: = none; white-space: normal; widows: auto; word-spacing: 0px; = -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; = text-decoration: none;" class=3D""><br class=3D"">Thanks,<br = class=3D"">Acee<br class=3D""><br class=3D""><br class=3D""><blockquote = type=3D"cite" class=3D"">For IPsec protection of BGP, where are the = details specified?<span class=3D"Apple-converted-space"> </span><br = class=3D"">Thanks,<br class=3D"">Acee<br class=3D""><br class=3D"">On = 12/10/19, 7:35 PM, "Idr on behalf of Mahesh Jethanandani" <<a = href=3D"mailto:[email protected]" class=3D"">[email protected]</a> = on behalf of <a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:<br class=3D""><br = class=3D""> This is the second thread in the list of issues that = were discussed in IETF 106 w.r.t. to BGP YANG model. This particular = thread is to discuss the issue of defining how BGP sessions are going to = be secured.<br class=3D""><br class=3D""> As stated in Singapore, = the model is being defined to secure BGP sessions using<span = class=3D"Apple-converted-space"> </span><br class=3D""> - TCP = AO<br class=3D""> - TCP MD5<br class=3D""> - IPSec<br = class=3D""><br class=3D""> In case there was a question of why MD5, = it is because there are existing implementations that are choosing to = stay with MD5, regardless of the issues that have been raised about MD5. = The model therefore has to support such implementations.<br class=3D""><br= class=3D""> The model will use the ietf-key-chain model=E2=80=99s = (RFC 8177) key-chain-ref to refer to an instance of the key chain. By = doing that it will make use of the key rollover capability defined in = that model, and for static key configuration by setting the end time to = infinite in the key chain. The BGP model will leave the case of IPSec as = TBD for now, and fill it when/if the IPSec YANG model is defined.<br = class=3D""><br class=3D""> Questions/Concerns?<br class=3D""><br = class=3D""> Mahesh Jethanandani<br class=3D""> <a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a><br class=3D""><br class=3D""><br = class=3D""><br = class=3D""> _______________________________________________<br = class=3D""> Idr mailing list<br class=3D""> <a = href=3D"mailto:[email protected]" class=3D"">[email protected]</a><br = class=3D""> <a href=3D"https://www.ietf.org/mailman/listinfo/idr" = class=3D"">https://www.ietf.org/mailman/listinfo/idr</a><br class=3D""><br= class=3D""><br class=3D""></blockquote><br class=3D""> Mahesh = Jethanandani<br class=3D""> <a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a><br class=3D""><br class=3D""><br = class=3D""><br class=3D""><br class=3D""><br class=3D""></blockquote><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;" class=3D""><span = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: = normal; letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none; float: none; = display: inline !important;" class=3D""> Mahesh = Jethanandani</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;" class=3D""><span style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: normal; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;" = class=3D""> <a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a></span></div></blockquote></div><br = class=3D""></div></body></html>= --Apple-Mail=_29C6CEBA-F582-42B8-98FC-55AA7CCC248E-- --===============4627553993539147384== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Idr mailing list [email protected] https://www.ietf.org/mailman/listinfo/idr --===============4627553993539147384==--