Subject: RE: issue 21

From: "Natale, Jonathan" <[email-masked]>
Date: Thu, 26 Sep 2002 10:50:44 -0400

Let me be more exact:
Who uses *BGP's own* authentication mechanisms???

-----Original Message-----
From: Kunihiro Ishiguro [mailto:[email-masked]] 
Sent: Thursday, September 26, 2002 10:46 AM
To: Natale, Jonathan
Cc: 'Yakov Rekhter'; [email-masked]
Subject: Re: issue 21

>Who uses bgp authentication?  I though it was nobody. I thought the goal
was
>to document existing practice.

Many people are using BGP authentication both simple text and MD5
authentication.  I've got many requests to implement it in
Zebra/ZebOS.  So I believe let the current text as it is will achieve
existing practice.
-- 
Kunihiro Ishiguro

---

From: Kunihiro Ishiguro <[email-masked]>
Date: Thu, 26 Sep 2002 08:22:36 -0700

I also thought nobody uses BGP own simple password auth.  It is not
secure.  It is just a better than nothing kind of thing.  But MD5 auth
is not supported by all of vendors.  Still there are vendors only can
do simple password auth due to the limitation of TCP/IP stack
capability (Zebra also suffer from it).  In that case BGP own simple
password can be a only way.

Issue 21's main point is mentioning MD5 authentication along with BGP
own password auth.  I agree with it and current text is enough for the
purpose.  I know people actually uses BGP own auth (just a few though)
so I hesitate to say that deprecating BGP own auth.

---

From: Kunihiro Ishiguro <[email-masked]>
Date: Thu, 26 Sep 2002 09:29:21 -0700

>so I hesitate to say that deprecating BGP own auth.

I may be wrong.  I was told that Cisco does Open Message parameter's
optional simple password auth by 'neighbor password 7 LINE' but it
does not.  Jeff, how about GateD?

My opinion about this issue is keep current text then investigate
current best practice.
-- 
Kunihiro Ishiguro

---

From: Jeffrey Haas <[email-masked]>
Date: Thu, 26 Sep 2002 12:36:05 -0400

> does not.  Jeff, how about GateD?

According to Cisco's 12.2 documentation, "neigbor password" appears
to turn on tcp+md5 rather than the bgp optional parameters auth.

GateD has a spot for the tcp+md5 option in the code, but the implementation
is left to integration with a tcp stack that supports this feature.
It likely would be a socket option.

> My opinion about this issue is keep current text then investigate

As best I understand it, no one supports the AUTH optional parameter.
Deprecating it may make sense.  However, some people (see the
recent submission by the people at Huawei) seem to think that this
might be still useful.

-- 
Jeff Haas 
NextHop Technologies

---

From: Kunihiro Ishiguro <[email-masked]>
Date: Thu, 26 Sep 2002 09:49:00 -0700

>recent submission by the people at Huawei) seem to think that this

Understood.
-- 
Kunihiro Ishiguro