Subject: [VRRP] The usefulness of Priority 0 VRRP packet.

From: Mukesh Gupta <[email-masked]>
Date: Thu, 20 Feb 2003 19:42:50 -0800

Folks,

During the discussions on VRRP security, someone had raised a case where
IPsec AH security would have helped a bit. The case was the
vulnerability of DOS attack using Priority 0 (current master stopped
participating) VRRP packet.

As we are planning to remove the security completely from VRRP, I wanted
to get an idea about the usefulness of this priority 0 packet defined in
VRRP spec. If it is not more useful than the security risks it exposed
VRRP to, we could consider removing it from the spec.

Please express your opinion about this packet.

Regards,
Mukesh

_______________________________________________
vrrp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/vrrp

---

From: Jeffrey Haas <[email-masked]>
Date: Fri, 21 Feb 2003 09:50:25 -0500

Mukesh,

I was asked to review VRRP by our company.  I have no actual implementation
or operational experience, so please take my comments with a grain of
salt.

As specified, the priority 0 (explicit withdrawal) is useful under
some graceful restart type situations.  It should be kept.

IMO, the only way to truly "fix" VRRP as specified is to replace ARP
with something that is secure that includes a VRRP-like mechanism.

While that might be nice, I find it highly unlikely to ever happen.

-- 
Jeff Haas 
NextHop Technologies