RE: VPLS model for L2VPN Framework document

Eric,

The security concern I was thinking of is the possibility of a customer
injecting untagged frames into the SP network via a trunk port. In an
Ethernet switch all untagged frames arriving on a trunk port can either be
dropped or forwarded on the native VLAN (where the forward or drop action is
dependant on the implementation and configuration). If untagged customer
frames are not dropped by default, then access lists would have to be used
to ensure untagged customer frames were not forwarded on the untagged VPLS
instance. This is probably an implementation issue rather than something
that would need to be defined in the draft.

Richard

 > -----Original Message-----
 > From: [email protected] [mailto:[email protected]]
 > Sent: 29 May 2003 17:34
 > To: [email protected]
 > Cc: [email protected]
 > Subject: RE: VPLS model for L2VPN Framework document
 > 
 > 
 > Eric
 > 
 > Is the sole purpose of the untagged VPLS instance to carry 
 > service provider
 > BPDUs? If so there aren't any security concerns as all other 
 > untagged frames
 > can simply be dropped. However, I think the general term 
 > "untagged packets"
 > is misleading:
 > 
 > - a further distinct  VPLS instance is used to  carry the 
 > "untagged packets"
 >   of the emulated LAN.
 > 
 > Perhaps replacing "untagged packets" with "Service provider 
 > BPDUs" would
 > provide clarification on exactly what traffic can be carried 
 > using this VPLS
 > instance?
 > 
 > Richard
 > 
 >  > -----Original Message-----
 >  > From: Eric Rosen [mailto:[email protected]]
 >  > Sent: 29 May 2003 15:29
 >  > To: Spencer,R,Richard,XGH5 R
 >  > Cc: [email protected]
 >  > Subject: Re: VPLS model for L2VPN Framework document 
 >  > 
 >  > 
 >  > 
 >  > Richard> Is the  intention here  to create 1  VPLS control 
 >  > instance  (i) per
 >  > Richard> customer
 >  > 
 >  > No. 
 >  > 
 >  > Richard>  or (ii) per service provider network? 
 >  > 
 >  > Not necessarily limited to one per service provider network. 
 >  > 
 >  > However, this would be a deployment consideration, I think.
 >  > 
 >  > Richard> what  traffic  will be  carried  over  the  control 
 >  > VPLS?  Untagged
 >  > Richard> customer  frames or  untagged service  provider 
 >  > frames,  either way
 >  > Richard> this sounds like it may lead to security concerns.
 >  > 
 >  > I  think "untagged  service provider  frames" is  the 
 >  > answer.   What  is the
 >  > security concern? 
 >  > 
 > 
 > 
 >