Subject: RE: issue 21

From: "Gray, Eric" <[email-masked]>
Date: Thu, 26 Sep 2002 13:36:28 -0400

Joseph,

	Thanks, but this does not actually answer my question.

	The question is not whether MD5 authentication is used,
it is how is it implemented in real BGP implementations or -
more importantly - where is the authentication information 
located in the packets sent between two BGP peers?  This is
not strictly an implementation issue because authentication
information is located in different places depending on which
version of MD5 authentication is in use.

	As is generally known, options are not necessarily good.
Currently, between RFC 1771 and RFC 2385, there are two very
distinct ways to accomplish a semantically identical function.
If the mechanism defined in RFC 1771 is not supported by a
number of interoperable implementations, it must be deprecated
per RFC 2026 prior to advancing the specification to Draft
Standard.  If it is not implemented and actually in use, it
should be deprecated if for no other reason than to make the
operator's life easier.

Eric W. Gray
Systems Architect
Celox Networks, Inc.
[email-masked]
508 305 7214

> -----Original Message-----
> From: Joseph T. Klein [mailto:[email-masked]]
> Sent: Thursday, September 26, 2002 1:16 PM
> To: Gray, Eric; 'Randy Bush'; Natale, Jonathan
> Cc: 'Yakov Rekhter'; [email-masked]
> Subject: RE: issue 21
> 
> An operators 2 cents.
> 
> In the case of AS19548, almost all inter domain peers are configured
> using MD5 authentication-key. We have found only a few organizations
> that have issue with using an authetication key.
> 
> --On Thursday, 26 September 2002 13:01 -0400 "Gray, Eric"
> <[email-masked]> wrote:
> 
> > Randy,
> >
> > 	Operators use which form of BGP Authentication?   TCP
> > native (RFC 2385) or BGP's 'own' authentication?  It would
> > be nice if we could be precise...
> >
> > Eric W. Gray
> > Systems Architect
> > Celox Networks, Inc.
> > [email-masked]
> > 508 305 7214
> >
> >
> >> -----Original Message-----
> >> From: Randy Bush [mailto:[email-masked]]
> >> Sent: Thursday, September 26, 2002 12:48 PM
> >> To: Natale, Jonathan
> >> Cc: 'Yakov Rekhter'; [email-masked]
> >> Subject: RE: issue 21
> >>
> >> > Who uses bgp authentication?  I though it was nobody.
> >>
> >> you were incorrect in that thought.  prudent operators do use it,
> >> and some large ones have for some years now.
> >>
> >> randy
> >
> 
> 
> 
> --
> Joseph T. Klein                                         [email-masked]
> 
>                         "g/Class C/s//\/24/g"

---

From: Yakov Rekhter <[email-masked]>
Date: Thu, 26 Sep 2002 10:51:30 -0700

Eric,

[changed subject, as to avoid confusion with issue 21].

> Standard.  

To be more precise, 

   In cases in which one or more options or features have not been
   demonstrated in at least two interoperable implementations, the
   specification may advance to the Draft Standard level only if 
   those options or features are removed.

So, the relevant question is whether we have at least two implementations
that support authentication as described in rfc1771.

Folks who implemented authentication, as described in rfc1771,
please speak up.

Yakov.

---

From: "Joseph T. Klein" <[email-masked]>
Date: Thu, 26 Sep 2002 18:16:17 -0000

Eric,

It is RFC2385 and it is frequently used between vendor C and
vendor J. I suspect others will be happy to correct me if I am wrong.

I apologize if my comment was ambiguous and furthered confusion.

I agree with Yakov on the text.

                        "g/Class C/s//\/24/g"