Subject: [Isis-wg] 答复: draft-you-isis-flowspec-extensions concern.

From: Youjianjie <[email-masked]>
Date: Mon, 15 Feb 2016 02:53:47 +0000

Hi,

We've updated the draft according to the comments we received. Please review; further comments are welcome!

Regards,
Jianjie

Name:		draft-you-isis-flowspec-extensions
Revision:	04
Title:		IS-IS Extensions for Flow Specification
Document date:	2016-02-14
Group:		Individual Submission
Pages:		15
URL:            https://www.ietf.org/internet-drafts/draft-you-isis-flowspec-extensions-04.txt
Status:         https://datatracker.ietf.org/doc/draft-you-isis-flowspec-extensions/
Htmlized:       https://tools.ietf.org/html/draft-you-isis-flowspec-extensions-04
Diff:           https://www.ietf.org/rfcdiff?url2=draft-you-isis-flowspec-extensions-04

Abstract:
   Dissemination of the Traffic flow information was first introduced in
   the BGP protocol [RFC5575].  FlowSpec rules are used to distribute
   traffic filtering rules that are used to filter Denial-of-Service
   (DoS) attacks.  For the networks that only deploy IS-IS or IS-IS
   variant, it is required that IS-IS is extended to distribute Flow
   Specification or FlowSpec rules.

   This document discusses the use cases for distributing flow
   specification (FlowSpec) routes using IS-IS.  Furthermore, this
   document defines a new IS-IS FlowSpec Reachability TLV encoding
   format that can be used to distribute FlowSpec rules, its validation
   procedures for imposing the filtering information on the routers, and
   a capability to indicate the support of FlowSpec functionality.

> -----邮件原件-----
> 发件人: Isis-wg [mailto:[email-masked]] 代表 Christian Hopps
> 发送时间: 2015年12月6日 17:03
> 收件人: [email-masked]
> 抄送: [email-masked]
> 主题: [Isis-wg] draft-you-isis-flowspec-extensions concern.
> 
> 
> I'd like to query the WG once more for opinions on this draft. I believe from
> IETF-94 the question was who would actually use it
> (i.e., not have BGP deployed as well).   One use case from China
> Mobile was presented where IS-IS was used in MANs where BGP was
> not deployed.   My understanding of why flowspec in BGP was
> created and is useful is that it allows for the advertisement of fine-grained
> filtering across AS (administrative) boundaries. Without it a less fine-grained
> approach (destination
> only) would have to be used, or some other form of coordination between
> providers would be required. This is a fairly compelling
> reason for flowspecin BGP.   In the case of IS-IS the creation of
> the filter and the use of the filter all occur within the same administrative
> domain. So isn't this basically using IS-IS to configure one's own routers, and
> aren't there better ways to do that?
> 
> Thanks,
> Chris.
> 
> _______________________________________________
> Isis-wg mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/isis-wg