Subject: [Idr] Soliciting feedback from IPsec experts on using BGP to announce clients routes that can be carried by IPsec SAs.

From: Linda Dunbar <[email-masked]>
Date: Wed, 10 Feb 2021 20:38:58 +0000

IPsec Experts,

We have a draft in IDR on using BGP to distribute routes attached to SDWAN edge nodes (https://datatracker.ietf.org/doc/draft-dunbar-idr-sdwan-edge-discovery/ ).
Since SDWAN can have L3/L2 VPN paths and IPsec paths between edge nodes, we think using the BGP UPDATE to announce all possible paths (including IPsec SAs) for reaching the client routes is more efficient than declaring the client routes as  the  IPsec SA Child.

Do you see any issues?

Here is control flow:
In the figure below, C-PE2 has public internet facing WAN ports from ISP1 (192.0.0.1) and ISP2 (170.0.0.1). Suppose there are already IPsec SA established between the WAN ports

  *   IPsec SA #1: between C-PE1 and CPE2 (170.0.0.1 <-> 160.0.0.1);
  *   IPsec SA#2: between C-PE1 and CPE2 (192.0.0.1 <-> 192.10.0.10);
  *   IPsec SA#3: between C-PE2(170.0.0.1)<-> C-PE3 (180.0.0.1).

For C-PE2 to announce its attached routes being reachable by L3VPN path and IPsec SAs, the BGP UPDATE can include the following in its Tunnel attributes.

Your feedback is greatly appreciated.

Linda Dunbar