Subject: Re: [RPSEC] proposed message to the IESG

From: Sandy Murphy <[email-masked]>
Date: Fri, 21 Jan 2005 12:03:57 -0500 (EST)

>I can give you one!  Anycast for DNS...  Anycast is very cool...  But
>everyone uses the same prefix.

OK, that's a legitimate case.

So we'd have to design the security requirement so that it would
cover this case.

As an example of working on security requirements, would you say
that it would be OK if an AS received updates from two peers, both
claiming to be originating an address that was so duplicately
sub-allocated?  Or is this handled by having one AS authorized
as the originator and something like multi-homed in two different
places?  (NOTE: these sorts of questions are what you would have
to discuss in coming up with the security requirements - I'm not
suggesting that we'd solve the problem here and now.  Presently
we're just discussing the process of arguing, not the argument.)

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Blaine Christian <[email-masked]>
Date: Fri, 21 Jan 2005 13:57:07 -0500

> we're just discussing the process of arguing, not the argument.)

I won't try and make the solution.  But I can tell you that we did add it to
the requirements draft.  Another example is that operators need the ability
to advertise, from different AS's, the exact same prefix.  A prime example
would be a network owner that does not do BGP but is multihomed.

---

From: [email-masked]
Date: Fri, 21 Jan 2005 19:15:44 +0000

> would be a network owner that does not do BGP but is multihomed.

	amen to this..  as an operator, we do have cases where 
	there is -NOT- a unique orign AS  for a given prefix.

--bill