Subject: RE: issue 21

From: "Natale, Jonathan" <[email-masked]>
Date: Thu, 26 Sep 2002 10:34:22 -0400

Disagree.

Who uses bgp authentication?  I though it was nobody. I thought the goal was
to document existing practice.

-----Original Message-----
From: Yakov Rekhter [mailto:[email-masked]] 
Sent: Thursday, September 26, 2002 10:04 AM
To: [email-masked]
Subject: issue 21

  21) Authentication Text Update
 
----------------------------------------------------------------------------
  Status: No Consensus
  Change: Potentially
  Summary: A small change to the "Authentication Data:" section to mention
    well established MD5 support.
  
  Discussion:
  
    P. 10, "Authentication Data:" section you might want to add this,
    It is also possible to use MD5 (RFC2385) at the transport layer to
validate
    the entire BGP message.
  
  There was no discussion on this issue.

There is already text that covers this:

  "Any authentication scheme used by TCP (e.g., RFC2385 [RFC2385]) 
   may be used in addition to BGP's own authentication mechanisms."
  
   ....

  "In addition, BGP supports the ability to authenticate its data 
   stream by using [RFC2385]."

So, I see no need to add the text proposed above.

Yakov.

---

From: Kunihiro Ishiguro <[email-masked]>
Date: Thu, 26 Sep 2002 07:45:33 -0700

>to document existing practice.

Many people are using BGP authentication both simple text and MD5
authentication.  I've got many requests to implement it in
Zebra/ZebOS.  So I believe let the current text as it is will achieve
existing practice.
-- 
Kunihiro Ishiguro

---

From: Ron Bonica <[email-masked]>
Date: Thu, 26 Sep 2002 11:03:17 -0400

Jonathan,

We authenticate BGP peering sessions.

For rationale, see
http://www.ietf.org/internet-drafts/draft-murphy-bgp-vuln-00.txt, and
http://www.ietf.org/internet-drafts/draft-murphy-bgp-protect-00.txt.

                          Ron

> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Natale, Jonathan
> Sent: Thursday, September 26, 2002 10:34 AM
> To: 'Yakov Rekhter'; [email-masked]
> Subject: RE: issue 21
>
>
> Disagree.
>

---

From: Randy Bush <[email-masked]>
Date: Thu, 26 Sep 2002 09:48:17 -0700

> Who uses bgp authentication?  I though it was nobody.

you were incorrect in that thought.  prudent operators do use it,
and some large ones have for some years now.

randy