Subject: [Idr] Questions to draft-hujun-idr-bgp-ipsec-transport-mode-00.txt

From: Linda Dunbar <[email-masked]>
Date: Sun, 17 Nov 2019 12:32:09 +0000

Jun, 

I have some questions on your draft:

Figure 4: does R1 use Subnet A in NLRI? And have Tunnel-Encap with more detailed description on SubnetA<->SubnetB  & SubnetA<->Subnet C? 

How does R1 need to know that Subnet A and Subnet B needs to communicate ahead of time? 

Linda

-----Original Message-----
From: Idr <[email-masked]> On Behalf Of Hu, Jun (Nokia - US/Mountain View)
Sent: Friday, October 11, 2019 6:46 AM
To: [email-masked]
Cc: 'Paul Wouters' <[email-masked]>; 'Benjamin Kaduk' <[email-masked]>; Susan Hares <[email-masked]>
Subject: [Idr] FW: New Version Notification for draft-hujun-idr-bgp-ipsec-transport-mode-00.txt

Hi,
Here is a new draft for using BGP to provision IPsec transport mode protected tunnel config; this draft is in companion with draft-hujun-idr-bgp-ipsec-01 (Ipsec tunnel mode) to provide a complete solution of using BGP provision IPsec config.

Review and comment will be appreciated. 

-----Original Message-----
From: [email-masked] <[email-masked]> 
Sent: Thursday, October 10, 2019 3:41 PM
To: Hu, Jun (Nokia - US/Mountain View) <[email-masked]>; Hu, Jun (Nokia - US/Mountain View) <[email-masked]>
Subject: New Version Notification for draft-hujun-idr-bgp-ipsec-transport-mode-00.txt

A new version of I-D, draft-hujun-idr-bgp-ipsec-transport-mode-00.txt
has been successfully submitted by Hu Jun and posted to the IETF repository.

Name:		draft-hujun-idr-bgp-ipsec-transport-mode
Revision:	00
Title:		BGP Provisioned IPsec Transport Mode Protected Tunnel Configuration
Document date:	2019-10-10
Group:		Individual Submission
Pages:		7
URL:            https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Finternet-drafts%2Fdraft-hujun-idr-bgp-ipsec-transport-mode-00.txt&amp;data=02%7C01%7Clinda.dunbar%40futurewei.com%7C0099e48ac8854dcfe90f08d74dd3a2cb%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C637063443677284261&amp;sdata=nVGm8ifLrt6dwyLm1WCyaRfgsd6w%2FmJwXtKoVsXx5f0%3D&amp;reserved=0
Status:         https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-hujun-idr-bgp-ipsec-transport-mode%2F&amp;data=02%7C01%7Clinda.dunbar%40futurewei.com%7C0099e48ac8854dcfe90f08d74dd3a2cb%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C637063443677284261&amp;sdata=dOWaaVqKGqfY%2Fcsh%2Bg222wJXkNqa4d21DRbKd6osyVE%3D&amp;reserved=0
Htmlized:       https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-hujun-idr-bgp-ipsec-transport-mode-00&amp;data=02%7C01%7Clinda.dunbar%40futurewei.com%7C0099e48ac8854dcfe90f08d74dd3a2cb%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C637063443677284261&amp;sdata=C07AXwMSYL56roSiqIVpaMC5zWvvcr8kIUvgjGHskwQ%3D&amp;reserved=0
Htmlized:       https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-hujun-idr-bgp-ipsec-transport-mode&amp;data=02%7C01%7Clinda.dunbar%40futurewei.com%7C0099e48ac8854dcfe90f08d74dd3a2cb%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C637063443677284261&amp;sdata=xR5u8J6P5pj5eA9khQCqcNhujr%2BRV7rWIkldS4kOqp4%3D&amp;reserved=0

Abstract:
   This document defines a method of using BGP to advertise IPsec
   transport mode protected tunnel (like GRE tunnel with IPsec transport
   mode protection) configuration along with NLRI, based on
   [I-D.ietf-idr-tunnel-encaps] and [I-D.hujun-idr-bgp-ipsec].

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

_______________________________________________
Idr mailing list
[email-masked]
https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fidr&amp;data=02%7C01%7Clinda.dunbar%40futurewei.com%7C0099e48ac8854dcfe90f08d74dd3a2cb%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C637063443677284261&amp;sdata=QrCi3EnAQcbMGnfL%2FUZLUOOkw4MMdtPjphgrYJK4Lx4%3D&amp;reserved=0

---

From: Linda Dunbar <[email-masked]>
Date: Sun, 17 Nov 2019 12:52:20 +0000

Jun,

In addition, if the network has 4 routers, R1, R2, R3 and R4. Does the Update from R1 include all the <Local- Remote> pairs in each single UPDATE?

i.e. when R1 sends out the UPDATE for the Subnet A attached to R1, the UPDATE from R1 has to include
        Local subnet A <-> remote subnet B on R2
      Local subnet A <-> remote subnet D on R3
      Local subnet A <-> remote subnet F on R4

Is it correct? If there are 100 nodes in the network, the UPDATE message has to include 100 pairs?

Linda

-----Original Message-----
From: Idr <[email-masked]> On Behalf Of Linda Dunbar
Sent: Sunday, November 17, 2019 8:32 PM
To: Hu, Jun (Nokia - US/Mountain View) <[email-masked]>; [email-masked]
Cc: 'Paul Wouters' <[email-masked]>; 'Benjamin Kaduk' <[email-masked]>; Susan Hares <[email-masked]>
Subject: [Idr] Questions to draft-hujun-idr-bgp-ipsec-transport-mode-00.txt

Jun,

Linda

-----Original Message-----
From: Idr <[email-masked]<mailto:[email-masked]>> On Behalf Of Hu, Jun (Nokia - US/Mountain View)
Sent: Friday, October 11, 2019 6:46 AM
To: [email-masked]<mailto:[email-masked]>
Cc: 'Paul Wouters' <[email-masked]<mailto:[email-masked]>>; 'Benjamin Kaduk' <[email-masked]<mailto:[email-masked]>>; Susan Hares <[email-masked]<mailto:[email-masked]>>
Subject: [Idr] FW: New Version Notification for draft-hujun-idr-bgp-ipsec-transport-mode-00.txt

Hi,

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>
Sent: Thursday, October 10, 2019 3:41 PM
To: Hu, Jun (Nokia - US/Mountain View) <[email-masked]<mailto:[email-masked]>>; Hu, Jun (Nokia - US/Mountain View) <[email-masked]<mailto:[email-masked]>>
Subject: New Version Notification for draft-hujun-idr-bgp-ipsec-transport-mode-00.txt

Name:           draft-hujun-idr-bgp-ipsec-transport-mode
Revision:       00
Title:          BGP Provisioned IPsec Transport Mode Protected Tunnel Configuration
Document date:  2019-10-10
Group:          Individual Submission
Pages:          7
URL:            https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Finternet-drafts%2Fdraft-hujun-idr-bgp-ipsec-transport-mode-00.txt&amp;data=02%7C01%7Clinda.dunbar%40futurewei.com%7Cdb93469d32784754e52008d76b5a3300%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C637095907488703369&amp;sdata=L%2Bq8Gmm6svj7vUgwQqWCHqx6ex2MefKRN1U58vFwJ%2Fg%3D&amp;reserved=0
Status:         https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-hujun-idr-bgp-ipsec-transport-mode%2F&amp;data=02%7C01%7Clinda.dunbar%40futurewei.com%7Cdb93469d32784754e52008d76b5a3300%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C637095907488703369&amp;sdata=fdGi7esvdmdejiZQ6s1ZjAauLjdtzETi4BXAC8664Ss%3D&amp;reserved=0
Htmlized:       https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-hujun-idr-bgp-ipsec-transport-mode-00&amp;data=02%7C01%7Clinda.dunbar%40futurewei.com%7Cdb93469d32784754e52008d76b5a3300%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C637095907488703369&amp;sdata=5GCI9uiTuLRbdNSvjT48mpbe1IxTWT8sXPm6qzkRaIE%3D&amp;reserved=0
Htmlized:       https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-hujun-idr-bgp-ipsec-transport-mode&amp;data=02%7C01%7Clinda.dunbar%40futurewei.com%7Cdb93469d32784754e52008d76b5a3300%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C637095907488713364&amp;sdata=G3azT0TBfD9NmSvJ%2B%2BBaNCA70SFMM%2BEqrvX2IjTIef8%3D&amp;reserved=0

Abstract:

The IETF Secretariat

_______________________________________________
Idr mailing list
[email-masked]<mailto:[email-masked]>
https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fidr&amp;data=02%7C01%7Clinda.dunbar%40futurewei.com%7Cdb93469d32784754e52008d76b5a3300%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C637095907488713364&amp;sdata=5lz3DyKGqJb2asfcfarFXUtZptUy1XpsnAMsv6Rycic%3D&amp;reserved=0

_______________________________________________
Idr mailing list
[email-masked]<mailto:[email-masked]>
https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fidr&amp;data=02%7C01%7Clinda.dunbar%40futurewei.com%7Cdb93469d32784754e52008d76b5a3300%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C0%7C637095907488713364&amp;sdata=5lz3DyKGqJb2asfcfarFXUtZptUy1XpsnAMsv6Rycic%3D&amp;reserved=0

---

From: "Hu, Jun (Nokia - US/Mountain View)" <[email-masked]>
Date: Mon, 18 Nov 2019 00:12:56 +0000

Hi Linda,
I assume your questions are really about draft-hujun-idr-bgp-ipsec-01? since draft-hujun-idr-bgp-ipsec-transport-mode-00 doesn't have figure 4;
"Figure 4: does R1 use Subnet A in NLRI? And have Tunnel-Encap with more detailed description on SubnetA<->SubnetB  & SubnetA<->Subnet C? "
 Yes, R1 will advertise subnet-A in NLRI; not sure I understand your 2nd part of the question, but section 2.1 of draft-hujun-idr-bgp-ipsec-01 defines local/remote prefix sub-TLV (NLRI could be used for local prefix)

"How does R1 need to know that Subnet A and Subnet B needs to communicate ahead of time? "
This depends on use case, in this example, both R1 and R2 belong to same admin domain, so this kind of thing could be planned ahead; in other use case, if the remote prefix is not known or user want same Ipsec config for all remote prefix, then an all-zero prefix could be used in remote prefix sub-TLV

"In addition, if the network has 4 routers, R1, R2, R3 and R4. Does the Update from R1 include all the <Local- Remote> pairs in each single UPDATE?

Is it correct? If there are 100 nodes in the network, the UPDATE message has to include 100 pairs?
"
As explained above, it could be done this way, but not necessary; it really depends on granularity user case needs

From: Linda Dunbar <[email-masked]>
Sent: Sunday, November 17, 2019 8:52 PM
To: Linda Dunbar <[email-masked]>; Hu, Jun (Nokia - US/Mountain View) <[email-masked]>; [email-masked]
Cc: 'Paul Wouters' <[email-masked]>; 'Benjamin Kaduk' <[email-masked]>; Susan Hares <[email-masked]>
Subject: RE: [Idr] Questions to draft-hujun-idr-bgp-ipsec-transport-mode-00.txt

Jun,

Linda

-----Original Message-----
From: Idr <[email-masked]<mailto:[email-masked]>> On Behalf Of Linda Dunbar
Sent: Sunday, November 17, 2019 8:32 PM
To: Hu, Jun (Nokia - US/Mountain View) <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Cc: 'Paul Wouters' <[email-masked]<mailto:[email-masked]>>; 'Benjamin Kaduk' <[email-masked]<mailto:[email-masked]>>; Susan Hares <[email-masked]<mailto:[email-masked]>>
Subject: [Idr] Questions to draft-hujun-idr-bgp-ipsec-transport-mode-00.txt

Jun,

Linda

-----Original Message-----
From: Idr <[email-masked]<mailto:[email-masked]>> On Behalf Of Hu, Jun (Nokia - US/Mountain View)
Sent: Friday, October 11, 2019 6:46 AM
To: [email-masked]<mailto:[email-masked]>
Cc: 'Paul Wouters' <[email-masked]<mailto:[email-masked]>>; 'Benjamin Kaduk' <[email-masked]<mailto:[email-masked]>>; Susan Hares <[email-masked]<mailto:[email-masked]>>
Subject: [Idr] FW: New Version Notification for draft-hujun-idr-bgp-ipsec-transport-mode-00.txt

Hi,

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> <[email-masked]<mailto:[email-masked]>>
Sent: Thursday, October 10, 2019 3:41 PM
To: Hu, Jun (Nokia - US/Mountain View) <[email-masked]<mailto:[email-masked]>>; Hu, Jun (Nokia - US/Mountain View) <[email-masked]<mailto:[email-masked]>>
Subject: New Version Notification for draft-hujun-idr-bgp-ipsec-transport-mode-00.txt

Abstract:

The IETF Secretariat