Subject: [Idr] Comments on draft-patel-raszuk-bgp-vector-routing-01

From: Steve Padgett <[email-masked]>
Date: Fri, 8 Nov 2013 09:38:26 -0800

A few questions ...

(a) What should be the behavior be if there's a loop in the path,
where the same router is configured to receive the same packet in the
same vrf multiple times in the same vector?  Note that a loop may not
be obvious by looking at the vector attribute, as the IPs listed could
be different interfaces on the same router.  If the node that detects
the loop falls back to next_hop, wouldn't that possibly create a loop?
If it jumps to it's last entry in the chain then that may prevent
loops but it'd skip other entries in the chain (which may be a
firewall :) ... possibly a security concern if this happens).

(b) What happens if one (or more) nodes in the network are part of the
path but do not understand the vector attribute?  Don't they fall back
to the next_hop, potentially creating a loop?

(c) Calculating IGP distance to the next_hop is part of the BGP path
selection. Which next-hop is used here selecting the BGP route? The
vector-calculated next-hop or the bgp next_hop attribute?

(d) Is there a security attack possible if an untrusted peer sends you
an advertisement with a vector route? If I (as the "untrusted peer")
can control what path my packets take in your network, that seems
undesirable, as I could route my traffic through whatever
nodes/service devices I want. (Assume that I advertise the route to
you with your ASN in the vector attribute, thus it'll pass the AS
number validation check).

(e) Assuming that ECMP is useful :) and that the plan as I understand
it here for ECMP support is to use 'anycast next hops' -- how does it
deal with a topology like:
(A needs to send to D, and A can ECMP to B,E,F; B forwards to C then
D; E & F forward to D directly)
A-B-C-D
A-E-D
A-F-D

Thanks,
Steve