RE: VPLS model for L2VPN Framework document

I'm not sure these are implementation only issues -
I suspect most service providers have requirements to
(i) use network assigned services instances for their own network management
purposes and
(ii) inject & remove OAM traffic for diagnostic purposes into vpls service
instances

Steven Wright

> -----Original Message-----
> From: [email protected] [mailto:[email protected]]
> Sent: Thursday, May 29, 2003 1:21 PM
> To: [email protected]; [email protected]
> Cc: [email protected]
> Subject: RE: VPLS model for L2VPN Framework document
>
>
> Eric,
>
> The security concern I was thinking of is the possibility of
> a customer
> injecting untagged frames into the SP network via a trunk port. In an
> Ethernet switch all untagged frames arriving on a trunk port
> can either be
> dropped or forwarded on the native VLAN (where the forward or
> drop action is
> dependant on the implementation and configuration). If
> untagged customer
> frames are not dropped by default, then access lists would
> have to be used
> to ensure untagged customer frames were not forwarded on the
> untagged VPLS
> instance. This is probably an implementation issue rather
> than something
> that would need to be defined in the draft.
>
> Richard
>
>  > -----Original Message-----
>  > From: [email protected] [mailto:[email protected]]
>  > Sent: 29 May 2003 17:34
>  > To: [email protected]
>  > Cc: [email protected]
>  > Subject: RE: VPLS model for L2VPN Framework document
>  >
>  >
>  > Eric
>  >
>  > Is the sole purpose of the untagged VPLS instance to carry
>  > service provider
>  > BPDUs? If so there aren't any security concerns as all other
>  > untagged frames
>  > can simply be dropped. However, I think the general term
>  > "untagged packets"
>  > is misleading:
>  >
>  > - a further distinct  VPLS instance is used to  carry the
>  > "untagged packets"
>  >   of the emulated LAN.
>  >
>  > Perhaps replacing "untagged packets" with "Service provider
>  > BPDUs" would
>  > provide clarification on exactly what traffic can be carried
>  > using this VPLS
>  > instance?
>  >
>  > Richard
>  >
>  >  > -----Original Message-----
>  >  > From: Eric Rosen [mailto:[email protected]]
>  >  > Sent: 29 May 2003 15:29
>  >  > To: Spencer,R,Richard,XGH5 R
>  >  > Cc: [email protected]
>  >  > Subject: Re: VPLS model for L2VPN Framework document
>  >  >
>  >  >
>  >  >
>  >  > Richard> Is the  intention here  to create 1  VPLS control
>  >  > instance  (i) per
>  >  > Richard> customer
>  >  >
>  >  > No.
>  >  >
>  >  > Richard>  or (ii) per service provider network?
>  >  >
>  >  > Not necessarily limited to one per service provider network.
>  >  >
>  >  > However, this would be a deployment consideration, I think.
>  >  >
>  >  > Richard> what  traffic  will be  carried  over  the  control
>  >  > VPLS?  Untagged
>  >  > Richard> customer  frames or  untagged service  provider
>  >  > frames,  either way
>  >  > Richard> this sounds like it may lead to security concerns.
>  >  >
>  >  > I  think "untagged  service provider  frames" is  the
>  >  > answer.   What  is the
>  >  > security concern?
>  >  >
>  >
>  >
>  >
>
>