Subject: [Idr] recap my questions and issues raised during IDR Thurs session for draft-ietf-idr-tunnel-encaps-11

From: Linda Dunbar <[email-masked]>
Date: Thu, 28 Mar 2019 13:52:20 +0000

Just want to reiterate my questions and issues I raised during IDR Thurs session for draft-ietf-idr-tunnel-encaps-11, to make it easier for the authors to address them in the next revision (I have sent the questions multiple times on the IDR mailing list, but no one responded):

1.      When a client route can egress multiple egress ports (each with different IP addresses), does the Tunnel-Encap allow multiple "Remote-endpoint" SubTLV to be attached one UPDATE?

2.      Section 3.1 Page 10: The last paragraph states that if "Remote-Endpoint sub-TLV contains address is valid but not reachable, and the containing TLV is NOT be malformed ..". Why a address not reachable is considered as "Not Malformed"?

3.      In RFC5512, the BGP speaker indicates the originating Interface address in the NLRI (section 3):

draft-ietf-idr-tunnel-encaps-11  no longer has the BGP speaker originating the update. Is it intended? If Yes, does it mean that it allows a third party (which could be malicious entity) to inject routes on behalf of a legitimate router (but RFC5512 doesn't)?  Why add this scenario? How to address the security threats introduced? If it is a conscious decision, should have some text to explain why and how to mitigate the security threats introduced.

Thanks, Linda Dunbar