Subject: [RPSEC] incremental deployment

From: [email-masked]
Date: Thu, 19 Jan 2006 11:27:07 -0500 (EST)

The bgp security requirement draft speaks of tolerance of incremental
deployment, with the motivation that deployment across the Internet
will not be instantaneous.

That would be the traditional interpretation of the term "incremental"
- there's a suggestion that eventually the entire system will be covered.

But as has been mentioned at various times in various discussions and
spec, there may never be ubiquitous deployment.  There may never be
such widespread deployment that we can consider areas of non-use as
special cases to be dealt with separately.  We should consider
"incremental deployment" to mean "non-homogeneous deployment" and
treat it as a consistent requirement, not a phase.

BGP-4 ubiquitously replaced BGP-3 (I sure hope no one speaks up
to shatter that illusion).  And that surely required upgrades to
software and configurations, maybe even platforms.  But the security
deployment will vary by factors that probably will not change over
time, including network design.

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Jeffrey Haas <[email-masked]>
Date: Thu, 19 Jan 2006 11:45:53 -0500

Sandy,

> time, including network design.

I think a better analogy would be the deployment of multi-protocol
BGP with respect to IPv6 or multicast SAFIs.  Many people still speak
BGP-4 conformantly without supporting these extentions.  Many networks
support MP-BGP without having deployed multicast or IPv6.

Probably the strongest protocol specific analogy would be the AS-4byte
support for BGP-4.  A transition mechanism is part of the specification.
At some point, it is hoped that the transition mechanism just goes away
and that the entire Internet is AS-4byte based.

-- 
Jeff Haas 
NextHop Technologies