From fernando@gont.com.ar Tue Mar 2 21:27:50 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F18723A8D0C for ; Tue, 2 Mar 2010 21:27:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.466 X-Spam-Level: X-Spam-Status: No, score=-3.466 tagged_above=-999 required=5 tests=[AWL=0.133, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mu4jzTyGX4xR for ; Tue, 2 Mar 2010 21:27:50 -0800 (PST) Received: from smtp1.xmundo.net (smtp1.xmundo.net [201.216.232.80]) by core3.amsl.com (Postfix) with ESMTP id 0EB763A8D07 for ; Tue, 2 Mar 2010 21:27:49 -0800 (PST) Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id 9D2386B6800; Wed, 3 Mar 2010 02:27:55 -0300 (ART) Received: from [192.168.0.100] (129-130-17-190.fibertel.com.ar [190.17.130.129]) (authenticated bits=0) by venus.xmundo.net (8.13.8/8.13.8) with ESMTP id o235RjCL017137; Wed, 3 Mar 2010 02:27:45 -0300 Message-ID: <4B8DF353.5070208@gont.com.ar> Date: Wed, 03 Mar 2010 02:27:47 -0300 From: Fernando Gont User-Agent: Thunderbird 2.0.0.23 (Windows/20090812) MIME-Version: 1.0 To: "'opsec@ietf.org'" X-Enigmail-Version: 0.96.0 OpenPGP: id=D076FFF1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Wed, 03 Mar 2010 02:27:54 -0300 (ART) Cc: Stefan Fouant Subject: [OPSEC] ip options filtering I-D X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Mar 2010 05:27:51 -0000 Hello, folks, At the Hiroshima IETF Ron (Bonica) mentioned that there was interest (in NANOG?) in an I-D that provided advise on the filtering of IP packets based on the IP options they contain. I've just posted a drafty version -00 of such I-D at: http://tools.ietf.org/id/draft-gont-opsec-ip-options-filtering-00.txt I hope that we can rev it before the non-version-00 cut-off. Nevertheless, we're already interested in what you think about the document structure. FWIW, it has been structured in roughly the same way as the icmp-filtering I-D of this wg (draft-ietf-opsec-icmp-filtering). Thanks! Kind regards, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 From joelja@bogus.com Sat Mar 6 16:55:53 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BCB1F28C216 for ; Sat, 6 Mar 2010 16:55:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lLe7bjCf+ta4 for ; Sat, 6 Mar 2010 16:55:53 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [147.28.0.81]) by core3.amsl.com (Postfix) with ESMTP id 0E48B28C0DE for ; Sat, 6 Mar 2010 16:55:52 -0800 (PST) Received: from [192.168.254.151] (62-50-198-127.client.stsn.net [62.50.198.127]) (authenticated bits=0) by nagasaki.bogus.com (8.14.3/8.14.3) with ESMTP id o270tpSj069340 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Sun, 7 Mar 2010 00:55:54 GMT (envelope-from joelja@bogus.com) Message-ID: <4B92F991.3070904@bogus.com> Date: Sat, 06 Mar 2010 16:55:45 -0800 From: Joel Jaeggli User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20100222 Lightning/1.0b1 Thunderbird/3.0.1 MIME-Version: 1.0 To: opsec@ietf.org References: <4B6DC3E1.4060806@bogus.com> In-Reply-To: <4B6DC3E1.4060806@bogus.com> X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.2 (nagasaki.bogus.com [147.28.0.81]); Sun, 07 Mar 2010 00:55:55 +0000 (UTC) Subject: Re: [OPSEC] IETF 77 timeline, updated X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Mar 2010 00:55:53 -0000 FYI the below remaining timeline items apply. if you're updating drafts please do so by 1700 PST monday. As of now we has two agenda items submitted which I will include in the draft agenda, anything else that should be brought up please let me know. On 02/06/2010 11:32 AM, Joel Jaeggli wrote: > 2010-03-08 (Monday): Internet Draft final submission cut-off by 17:00 > PST (01:00 Tuesday, March 9 UTC), upload using IETF ID Submission Tool. > > 2010-03-10 (Wednesday): Draft Working Group agendas due by 17:00 PST > (01:00 Thursday, March 11 UTC), upload using IETF Meeting Materials > Management Tool. > > 2010-03-12 (Friday): Early Bird registration and payment cut-off at > 17:00 PST (01:00 Saturday, March 13 UTC). > > 2010-03-15 (Monday): Revised Working Group agendas due by 17:00 PDT > (24:00 UTC), upload using IETF Meeting Materials Management Tool. > > 2010-03-15 (Monday): Registration cancellation cut-off at 17:00 PDT > (24:00 UTC). > > 2010-03-19 (Friday): Final Pre-Registration and Pre-Payment cut-off at > 17:00 PDT (24:00 UTC). > > 2010-03-21 - 2010-03-26: 77th IETF Meeting in Anaheim, California, USA. > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > From joelja@bogus.com Thu Mar 11 09:49:54 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 50F553A6B66 for ; Thu, 11 Mar 2010 09:49:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.953 X-Spam-Level: X-Spam-Status: No, score=-1.953 tagged_above=-999 required=5 tests=[AWL=0.646, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4CbWVcrPC8i3 for ; Thu, 11 Mar 2010 09:49:53 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [147.28.0.81]) by core3.amsl.com (Postfix) with ESMTP id 5D5AF3A6987 for ; Thu, 11 Mar 2010 09:29:19 -0800 (PST) Received: from [10.192.0.252] ([206.132.194.20]) (authenticated bits=0) by nagasaki.bogus.com (8.14.3/8.14.3) with ESMTP id o2BHTN2f015233 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Thu, 11 Mar 2010 17:29:24 GMT (envelope-from joelja@bogus.com) Message-ID: <4B992872.10701@bogus.com> Date: Thu, 11 Mar 2010 09:29:22 -0800 From: Joel Jaeggli User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20100222 Lightning/1.0b1 Thunderbird/3.0.1 MIME-Version: 1.0 To: "'opsec@ietf.org'" X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.2 (nagasaki.bogus.com [147.28.0.81]); Thu, 11 Mar 2010 17:29:24 +0000 (UTC) Subject: [OPSEC] preliminary agenda... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Mar 2010 17:49:54 -0000 Discussion of: http://tools.ietf.org/id/draft-gont-opsec-ip-options-filtering-00.txt http://tools.ietf.org/id/draft-ietf-tcpm-tcp-security-01.txt (previously presented in opsec, review being done in tcpm) http://tools.ietf.org/html/draft-dugal-opsec-protect-control-plane-02 (potentially take on as a wg item) status updates: draft-ietf-psec-routing-protocols-crypto-issues-03 (currently in iesg queue) draft-ietf-opsec-ip-security-02 (currently awaiting inclusion of alfred's changes from last call) Others (please suggest) From manav.bhatia@alcatel-lucent.com Thu Mar 11 14:57:30 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CF5293A683B for ; Thu, 11 Mar 2010 14:57:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.571 X-Spam-Level: X-Spam-Status: No, score=-2.571 tagged_above=-999 required=5 tests=[AWL=0.028, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k6-Gn3X3Bhwi for ; Thu, 11 Mar 2010 14:57:30 -0800 (PST) Received: from ihemail2.lucent.com (ihemail2.lucent.com [135.245.0.35]) by core3.amsl.com (Postfix) with ESMTP id F385A3A6906 for ; Thu, 11 Mar 2010 14:57:15 -0800 (PST) Received: from inbansmailrelay1.in.alcatel-lucent.com (h135-250-11-31.lucent.com [135.250.11.31]) by ihemail2.lucent.com (8.13.8/IER-o) with ESMTP id o2BMvFwc010891 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Thu, 11 Mar 2010 16:57:17 -0600 (CST) Received: from INBANSXCHHUB01.in.alcatel-lucent.com (inbansxchhub01.in.alcatel-lucent.com [135.250.12.32]) by inbansmailrelay1.in.alcatel-lucent.com (8.14.3/8.14.3/GMO) with ESMTP id o2BMvEgj031841 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NOT); Fri, 12 Mar 2010 04:27:14 +0530 Received: from INBANSXCHMBSA1.in.alcatel-lucent.com ([135.250.12.38]) by INBANSXCHHUB01.in.alcatel-lucent.com ([135.250.12.32]) with mapi; Fri, 12 Mar 2010 04:27:14 +0530 From: "Bhatia, Manav (Manav)" To: Joel Jaeggli , "'opsec@ietf.org'" Date: Fri, 12 Mar 2010 04:27:12 +0530 Thread-Topic: [OPSEC] preliminary agenda... Thread-Index: AcrBQ1hQwTaJQkpuQDK8M2UQ/dgRvwAKqnaw Message-ID: <7C362EEF9C7896468B36C9B79200D8350CC8D07AED@INBANSXCHMBSA1.in.alcatel-lucent.com> References: <4B992872.10701@bogus.com> In-Reply-To: <4B992872.10701@bogus.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.57 on 135.245.2.35 X-Scanned-By: MIMEDefang 2.64 on 135.250.11.31 Subject: Re: [OPSEC] preliminary agenda... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Mar 2010 22:57:30 -0000 Minor addition to the status update: draft-ietf-opsec-igp-crypto-requirements-00.txt accepted as a WG doc.=20 Cheers, Manav > -----Original Message----- > From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org]=20 > On Behalf Of Joel Jaeggli > Sent: Thursday, March 11, 2010 10.59 PM > To: 'opsec@ietf.org' > Subject: [OPSEC] preliminary agenda... >=20 > Discussion of: >=20 > http://tools.ietf.org/id/draft-gont-opsec-ip-options-filtering-00.txt >=20 > http://tools.ietf.org/id/draft-ietf-tcpm-tcp-security-01.txt > (previously presented in opsec, review being done in tcpm) >=20 > http://tools.ietf.org/html/draft-dugal-opsec-protect-control-plane-02 > (potentially take on as a wg item) >=20 > status updates: >=20 > draft-ietf-psec-routing-protocols-crypto-issues-03 > (currently in iesg queue) >=20 > draft-ietf-opsec-ip-security-02 > (currently awaiting inclusion of alfred's changes from last call) >=20 > Others (please suggest) > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec > = From joelja@bogus.com Fri Mar 12 08:56:21 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9D7523A6876 for ; Fri, 12 Mar 2010 08:56:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.276 X-Spam-Level: X-Spam-Status: No, score=-2.276 tagged_above=-999 required=5 tests=[AWL=0.323, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PhTMtC3-G4JB for ; Fri, 12 Mar 2010 08:56:21 -0800 (PST) Received: from nagasaki.bogus.com (nagasaki.bogus.com [147.28.0.81]) by core3.amsl.com (Postfix) with ESMTP id D769A3A67EA for ; Fri, 12 Mar 2010 08:49:12 -0800 (PST) Received: from [10.192.0.252] ([206.132.194.20]) (authenticated bits=0) by nagasaki.bogus.com (8.14.3/8.14.3) with ESMTP id o2CGnDHf087039 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Fri, 12 Mar 2010 16:49:14 GMT (envelope-from joelja@bogus.com) Message-ID: <4B9A7088.5080003@bogus.com> Date: Fri, 12 Mar 2010 08:49:12 -0800 From: Joel Jaeggli User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.7) Gecko/20100222 Lightning/1.0b1 Thunderbird/3.0.1 MIME-Version: 1.0 To: "Bhatia, Manav (Manav)" References: <4B992872.10701@bogus.com> <7C362EEF9C7896468B36C9B79200D8350CC8D07AED@INBANSXCHMBSA1.in.alcatel-lucent.com> In-Reply-To: <7C362EEF9C7896468B36C9B79200D8350CC8D07AED@INBANSXCHMBSA1.in.alcatel-lucent.com> X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.2 (nagasaki.bogus.com [147.28.0.81]); Fri, 12 Mar 2010 16:49:14 +0000 (UTC) Cc: "'opsec@ietf.org'" Subject: Re: [OPSEC] preliminary agenda... X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Mar 2010 16:56:21 -0000 Noted, will add. It should be also be said that if people are on the agenda but not planning on attending or wish to be on the agenda but aren't, don't panic, just contact the working grounp chairs, joe or myself. thanks joel On 03/11/2010 02:57 PM, Bhatia, Manav (Manav) wrote: > Cheers, Manav From joelja@bogus.com Mon Mar 22 13:32:48 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 375713A68E0 for ; Mon, 22 Mar 2010 13:32:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.958 X-Spam-Level: X-Spam-Status: No, score=-0.958 tagged_above=-999 required=5 tests=[AWL=0.511, BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ecHxGoCwa92R for ; Mon, 22 Mar 2010 13:32:47 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [147.28.0.81]) by core3.amsl.com (Postfix) with ESMTP id 5D20B3A6855 for ; Mon, 22 Mar 2010 13:32:47 -0700 (PDT) Received: from [130.129.24.69] (dhcp-wireless-open-abg-24-69.meeting.ietf.org [130.129.24.69]) (authenticated bits=0) by nagasaki.bogus.com (8.14.3/8.14.3) with ESMTP id o2MKX1JC029981 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Mon, 22 Mar 2010 20:33:05 GMT (envelope-from joelja@bogus.com) Message-ID: <4BA7D3FC.90309@bogus.com> Date: Mon, 22 Mar 2010 13:33:00 -0700 From: Joel Jaeggli User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.8) Gecko/20100316 Lightning/1.0b1 Thunderbird/3.0.3 MIME-Version: 1.0 To: "'opsec@ietf.org'" X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.2 (nagasaki.bogus.com [147.28.0.81]); Mon, 22 Mar 2010 20:33:05 +0000 (UTC) Subject: [OPSEC] Send me your slides.... If you have them. X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Mar 2010 20:32:48 -0000 I've got one set already, while I'll upgload plus my own, anyone else who wants present should toss their slides my way. we meet: 1740-1940 Afternoon Session III Redondo opsec wg From rfgraveman@gmail.com Fri Mar 26 09:07:15 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3C94C3A6AF4 for ; Fri, 26 Mar 2010 09:07:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.469 X-Spam-Level: X-Spam-Status: No, score=-1.469 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6ewfRd6uX64k for ; Fri, 26 Mar 2010 09:07:14 -0700 (PDT) Received: from mail-iw0-f191.google.com (mail-iw0-f191.google.com [209.85.223.191]) by core3.amsl.com (Postfix) with ESMTP id 030383A6B7C for ; Fri, 26 Mar 2010 09:06:19 -0700 (PDT) Received: by iwn29 with SMTP id 29so4726836iwn.17 for ; Fri, 26 Mar 2010 09:06:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:received:message-id :subject:from:to:cc:content-type; bh=MHtmqyU/xbhFACDUtYMMn2IINkYbXB2lIhDlnQxzz3c=; b=V7sEv47c/lCGF+vfeZEC8qXdBUEMLPQAiFCctTnS0qONzkjk/f0Q3+p+4XJeedUI+5 z1W+HS/Nj3cL33FTDRk/7x0X2NiKDzYH0cvrVqV4hLFWhA4UD28qEbN8osG3Y7e0fJsK mFU4f283iX17kNJpmxm6BYUb4lQiA7Payy3yY= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:cc:content-type; b=liwjuxagsc8/TrJyyhxD7RaaJ3aVJDz/TJHUivMJG1QvM21Vjh2J+tpBtN6ywWwl9J SWf8KodhD85ipEndiS7rnnoV57TD0uNkGN5uXET2D9cSAczddS34aa0LlSPuxIzTKP3J zzUV9H7oJ43vGY5EQR+eCAl+C8ItGI1lB8DH4= MIME-Version: 1.0 Received: by 10.231.157.5 with HTTP; Fri, 26 Mar 2010 09:06:40 -0700 (PDT) Date: Fri, 26 Mar 2010 12:06:40 -0400 Received: by 10.231.168.136 with SMTP id u8mr515433iby.56.1269619600272; Fri, 26 Mar 2010 09:06:40 -0700 (PDT) Message-ID: <45c8c21a1003260906j41580868p12466e6ed42ef3d0@mail.gmail.com> From: Richard Graveman To: ddugal@juniper.net Content-Type: text/plain; charset=ISO-8859-1 Cc: opsec@ietf.org Subject: [OPSEC] OPSEC control plane protection draft X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Mar 2010 16:07:15 -0000 David, I read the draft carefully after the meeting and realize that my comments missed the point of what the draft is trying to accomplish. Sorry. Nevertheless, I think the draft should mention that the protocols allowed to reach the control plane (OSPF, RSVP, TCP, SNMP, DNS, NTP, and of course, SSH, TLS, or ESP, etc.) may have cryptographic security methods applied to them, and this is not a replacement for these methods. One other comment: although the examples use IPv4, the language in the security considerations section is also IPv4-specific in places. I suggest making it IPv4-IPv6 neutral. I support taken this on in the WG. Richard Graveman From ddugal@juniper.net Fri Mar 26 10:02:32 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 02C7E3A6B47 for ; Fri, 26 Mar 2010 10:02:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.869 X-Spam-Level: X-Spam-Status: No, score=-2.869 tagged_above=-999 required=5 tests=[BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XYIvP1S+g28c for ; Fri, 26 Mar 2010 10:02:31 -0700 (PDT) Received: from exprod7og118.obsmtp.com (exprod7og118.obsmtp.com [64.18.2.8]) by core3.amsl.com (Postfix) with ESMTP id C170A3A6807 for ; Fri, 26 Mar 2010 10:02:23 -0700 (PDT) Received: from source ([66.129.224.36]) (using TLSv1) by exprod7ob118.postini.com ([64.18.6.12]) with SMTP ID DSNKS6zoszF8/hdKuOjeUMSYnM6bTJaHs4EN@postini.com; Fri, 26 Mar 2010 10:02:48 PDT Received: from [172.28.130.43] (172.28.130.43) by P-EMHUB01-HQ.jnpr.net (172.24.192.33) with Microsoft SMTP Server id 8.1.393.1; Fri, 26 Mar 2010 09:57:30 -0700 Message-ID: <4BACE777.3010000@juniper.net> Date: Fri, 26 Mar 2010 09:57:27 -0700 From: David Dugal Organization: Juniper Networks, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.23) Gecko/20090812 Lightning/0.9 Thunderbird/2.0.0.23 Mnenhy/0.7.5.0 MIME-Version: 1.0 To: Richard Graveman References: <45c8c21a1003260906j41580868p12466e6ed42ef3d0@mail.gmail.com> In-Reply-To: <45c8c21a1003260906j41580868p12466e6ed42ef3d0@mail.gmail.com> X-Enigmail-Version: 1.0.1 X-Stationery: 0.5.1 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: "draft-dugal-opsec-protect-control-plane@tools.ietf.org" , "opsec@ietf.org" Subject: Re: [OPSEC] OPSEC control plane protection draft X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Mar 2010 17:02:32 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Richard. Thank you very much for the scrutiny, analysis and feedback. As mentioned during my brief presentation, our hope is that this recommendation by example will provide awareness of a possible attack surface occasionally overlooked, especially by smaller or newer installations. I appreciate the feedback and will enhance the draft to make reference to cryptographic security, as well as attempt to make the document IP version agnostic. Thank you for your support, both in carefully reading the document, and for your willingness to have our draft taken under the OPSEC WG wing. - --- David G. Dugal Support: +1-408-745-9500 Security Incident Response Team Direct: +1-978-589-0719 Juniper Networks Mobile: +1-603-377-1162 Westford, MA, USA PGP Key: 0xAB6E02A5 On Fri Mar 26 2010 09:06:40 GMT-0700 (Pacific Daylight Time), Richard Graveman proclaimed ... > David, > > I read the draft carefully after the meeting and realize that my > comments missed the point of what the draft is trying to accomplish. > Sorry. > > Nevertheless, I think the draft should mention that the protocols > allowed to reach the control plane (OSPF, RSVP, TCP, SNMP, DNS, NTP, > and of course, SSH, TLS, or ESP, etc.) may have cryptographic security > methods applied to them, and this is not a replacement for these > methods. > > One other comment: although the examples use IPv4, the language in the > security considerations section is also IPv4-specific in places. I > suggest making it IPv4-IPv6 neutral. > > I support taken this on in the WG. > > Richard Graveman > . > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (MingW32) iEYEARECAAYFAkus53cACgkQh59lzatuAqVE9wCgh53mgxNRPWUztlI27aOITHRr 2zMAoPb5y3phm260P1zSoDu0LSbUjNcN =kitD -----END PGP SIGNATURE----- From robbird@gmail.com Fri Mar 26 10:27:23 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 519C93A6BDA for ; Fri, 26 Mar 2010 10:27:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.132 X-Spam-Level: * X-Spam-Status: No, score=1.132 tagged_above=-999 required=5 tests=[BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rmZp33q7NeZJ for ; Fri, 26 Mar 2010 10:27:21 -0700 (PDT) Received: from mail-pv0-f172.google.com (mail-pv0-f172.google.com [74.125.83.172]) by core3.amsl.com (Postfix) with ESMTP id D3E593A6B54 for ; Fri, 26 Mar 2010 10:27:21 -0700 (PDT) Received: by pvh1 with SMTP id 1so4989634pvh.31 for ; Fri, 26 Mar 2010 10:27:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:received:message-id:subject:from:to:cc:content-type; bh=PagTrHGZEH70yZm0FP0vzObLTOvPtgELD6ujbXUL7E4=; b=iD69/Ki+mo9IC3dj7KCKn3l7fwt//taakGdJrfEuI1YOCEf7O7zVT4NZUuvzB0NE0l cmdz6R/w+kDSMFlvE8yhiOzwucz9xqYzOpq8DlIe1GkWCWnFlORqKcLOV0UWL1b4/xnO ZoUzYOLtdIGUoTN6K9hdtVDEqrVIgePCozfr0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=Z8vgx2ZwZ8hskEhEFM9QJEfVvqzrbUp0SHLve/gkbXrEljHKIqvtWFl+bCs/cwuA/s we591P6TjRzNa9JwL9W2/EtEAtiCZWOPFZiAXCoBnYa7ahF+JnhGjgh+UWSYEZYf2fh3 TE085j6TbjPEkf7FeRYTy2lcJu5dSs+i5KOCY= MIME-Version: 1.0 Received: by 10.151.15.10 with HTTP; Fri, 26 Mar 2010 10:27:42 -0700 (PDT) Received: by 10.151.15.10 with HTTP; Fri, 26 Mar 2010 10:27:42 -0700 (PDT) In-Reply-To: <4BACE777.3010000@juniper.net> References: <45c8c21a1003260906j41580868p12466e6ed42ef3d0@mail.gmail.com> <4BACE777.3010000@juniper.net> Date: Fri, 26 Mar 2010 13:27:42 -0400 Received: by 10.115.85.21 with SMTP id n21mr1649254wal.111.1269624463009; Fri, 26 Mar 2010 10:27:43 -0700 (PDT) Message-ID: From: Rob Bird To: David Dugal Content-Type: multipart/alternative; boundary=0016e64caffc1da8330482b77b77 Cc: "draft-dugal-opsec-protect-control-plane@tools.ietf.org" , "opsec@ietf.org" Subject: Re: [OPSEC] OPSEC control plane protection draft X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Mar 2010 17:27:23 -0000 --0016e64caffc1da8330482b77b77 Content-Type: text/plain; charset=UTF-8 This is most excellent. I was just advising a customer this morning on this very issue (again). I look forward to working on this. Rob - Rob Bird, Chief Technology Officer Red Lambda, Inc. "Network security at global scale" www.redlambda.com On Mar 26, 2010 1:03 PM, "David Dugal" wrote: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Richard. Thank you very much for the scrutiny, analysis and feedback. As mentioned during my brief presentation, our hope is that this recommendation by example will provide awareness of a possible attack surface occasionally overlooked, especially by smaller or newer installations. I appreciate the feedback and will enhance the draft to make reference to cryptographic security, as well as attempt to make the document IP version agnostic. Thank you for your support, both in carefully reading the document, and for your willingness to have our draft taken under the OPSEC WG wing. - --- David G. Dugal Support: +1-408-745-9500 Security Incident Response Team Direct: +1-978-589-0719 Juniper Networks Mobile: +1-603-377-1162 Westford, MA, USA PGP Key: 0xAB6E02A5 On Fri Mar 26 2010 09:06:40 GMT-0700 (Pacific Daylight Time), Richard Graveman proclaimed ... > David, > > I read the draft carefully after the meeting and realize that my > comments missed the... > . > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (MingW32) iEYEARECAAYFAkus53cACgkQh59lzatuAqVE9wCgh53mgxNRPWUztlI27aOITHRr 2zMAoPb5y3phm260P1zSoDu0LSbUjNcN =kitD -----END PGP SIGNATURE----- _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.o... --0016e64caffc1da8330482b77b77 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

This is most excellent. I was just advising a customer this morning on t= his very issue (again).

I look forward to working on this.
Rob

-
Rob Bird, Chief Technology Officer
Red Lambda, Inc.
"Network security at global scale"
www.redlambda.com

On Mar 26, 2010 1:03 PM, "David Dugal&quo= t; <ddugal@juniper.net> wro= te:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Richard.

Thank you very much for the scrutiny, analysis and feedback. =C2=A0As
mentioned during my brief presentation, our hope is that this
recommendation by example will provide awareness of a possible attack
surface occasionally overlooked, especially by smaller or newer
installations.

I appreciate the feedback and will enhance the draft to make reference
to cryptographic security, as well as attempt to make the document IP
version agnostic.

Thank you for your support, both in carefully reading the document, and
for your willingness to have our draft taken under the OPSEC WG wing.

- ---
David G. Dugal =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Support: +1-408-745-9500
Security Incident Response Team =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Direct: = =C2=A0+1-978-589-0719
Juniper Networks =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 Mobile: =C2=A0+1-603-377-1162
Westford, MA, USA =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0PGP Key: 0xAB6E02A5


On Fri Mar 26 2010 09:06:40 GMT-0700 (Pacific Daylight Time), Richard
Graveman <rfgraveman@gmail.com> proclaimed ...

> David,
>
> I read the draft ca= refully after the meeting and realize that my
> comments missed the..= .

> .
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)

iEYEARECAAYFAkus53cACgkQh59lzatuAqVE9wCgh53mgxNRPWUztlI27aOITHRr
2zMAoPb5y3phm260P1zSoDu0LSbUjNcN
=3DkitD
-----END PGP SIGNATURE-----

_______________________________________________<= br>OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.o...

<= /blockquote>

--0016e64caffc1da8330482b77b77-- From cpignata@cisco.com Fri Mar 26 18:14:57 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 24F573A6B1B for ; Fri, 26 Mar 2010 18:14:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.402 X-Spam-Level: X-Spam-Status: No, score=-7.402 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DNS_FROM_OPENWHOIS=1.13, RCVD_IN_DNSWL_HI=-8, RCVD_NUMERIC_HELO=2.067] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3hF4CQNkzipx for ; Fri, 26 Mar 2010 18:14:56 -0700 (PDT) Received: from rtp-iport-1.cisco.com (rtp-iport-1.cisco.com [64.102.122.148]) by core3.amsl.com (Postfix) with ESMTP id 1C8333A6AB7 for ; Fri, 26 Mar 2010 18:14:56 -0700 (PDT) Authentication-Results: rtp-iport-1.cisco.com; dkim=neutral (message not signed) header.i=none X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Av0EAGr5rEutJV2Y/2dsb2JhbACbKgJzpXSLKAmNaIJrghME X-IronPort-AV: E=Sophos;i="4.51,317,1267401600"; d="scan'208";a="96576906" Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by rtp-iport-1.cisco.com with ESMTP; 27 Mar 2010 01:15:19 +0000 Received: from xbh-rcd-301.cisco.com (xbh-rcd-301.cisco.com [72.163.63.8]) by rcdn-core-1.cisco.com (8.14.3/8.14.3) with ESMTP id o2R1FJa6024259; Sat, 27 Mar 2010 01:15:19 GMT Received: from xmb-rcd-206.cisco.com ([72.163.62.213]) by xbh-rcd-301.cisco.com with Microsoft SMTPSVC(6.0.3790.3959); Fri, 26 Mar 2010 20:15:18 -0500 Received: from 72.163.62.136 ([72.163.62.136]) by XMB-RCD-206.cisco.com ([72.163.62.213]) with Microsoft Exchange Server HTTP-DAV ; Sat, 27 Mar 2010 01:15:18 +0000 References: <45c8c21a1003260906j41580868p12466e6ed42ef3d0@mail.gmail.com> <4BACE777.3010000@juniper.net> Message-ID: From: "Carlos Pignataro (cpignata)" Thread-Topic: OPSEC control plane protection draft Thread-Index: AcrNSvaAoxRWzoBvSuWEZKvQ3lhSEg== To: "David Dugal" In-Reply-To: <4BACE777.3010000@juniper.net> Content-Type: text/plain; format=flowed; delsp=yes; charset="us-ascii" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 (iPhone Mail 7E18) Date: Fri, 26 Mar 2010 21:15:16 -0400 X-OriginalArrivalTime: 27 Mar 2010 01:15:18.0832 (UTC) FILETIME=[F6F9CB00:01CACD4A] Cc: draft-dugal-opsec-protect-control-plane@tools.ietf.org, opsec@ietf.org Subject: Re: [OPSEC] OPSEC control plane protection draft X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Mar 2010 01:14:57 -0000 Richard, These are great comments that will Improve the document -- many thanks. Thumb typed by Carlos Pignataro. On Mar 26, 2010, at 1:02 PM, "David Dugal" wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi Richard. > > Thank you very much for the scrutiny, analysis and feedback. As > mentioned during my brief presentation, our hope is that this > recommendation by example will provide awareness of a possible attack > surface occasionally overlooked, especially by smaller or newer > installations. > > I appreciate the feedback and will enhance the draft to make reference > to cryptographic security, as well as attempt to make the document IP > version agnostic. > > Thank you for your support, both in carefully reading the document, > and > for your willingness to have our draft taken under the OPSEC WG wing. > > - --- > David G. Dugal Support: +1-408-745-9500 > Security Incident Response Team Direct: +1-978-589-0719 > Juniper Networks Mobile: +1-603-377-1162 > Westford, MA, USA PGP Key: 0xAB6E02A5 > > > On Fri Mar 26 2010 09:06:40 GMT-0700 (Pacific Daylight Time), Richard > Graveman proclaimed ... >> David, >> >> I read the draft carefully after the meeting and realize that my >> comments missed the point of what the draft is trying to accomplish. >> Sorry. >> >> Nevertheless, I think the draft should mention that the protocols >> allowed to reach the control plane (OSPF, RSVP, TCP, SNMP, DNS, NTP, >> and of course, SSH, TLS, or ESP, etc.) may have cryptographic >> security >> methods applied to them, and this is not a replacement for these >> methods. >> >> One other comment: although the examples use IPv4, the language in >> the >> security considerations section is also IPv4-specific in places. I >> suggest making it IPv4-IPv6 neutral. >> >> I support taken this on in the WG. >> >> Richard Graveman >> . >> > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.10 (MingW32) > > iEYEARECAAYFAkus53cACgkQh59lzatuAqVE9wCgh53mgxNRPWUztlI27aOITHRr > 2zMAoPb5y3phm260P1zSoDu0LSbUjNcN > =kitD > -----END PGP SIGNATURE----- > From danny@tcb.net Tue Mar 30 05:18:12 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E43063A6821 for ; Tue, 30 Mar 2010 05:18:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -98.25 X-Spam-Level: X-Spam-Status: No, score=-98.25 tagged_above=-999 required=5 tests=[BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13, RCVD_IN_SORBS_WEB=0.619, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nYzyEA-BTFNM for ; Tue, 30 Mar 2010 05:18:12 -0700 (PDT) Received: from dog.tcb.net (dog.tcb.net [64.78.150.133]) by core3.amsl.com (Postfix) with ESMTP id 03D613A6984 for ; Tue, 30 Mar 2010 05:18:09 -0700 (PDT) Received: by dog.tcb.net (Postfix, from userid 0) id F1B702684E1; Tue, 30 Mar 2010 06:18:37 -0600 (MDT) Received: from [10.255.255.140] (66.46.153.245 [66.46.153.245]) (authenticated-user smtp) (TLSv1/SSLv3 AES128-SHA 128/128) by dog.tcb.net with SMTP; for opsec@ietf.org; Tue, 30 Mar 2010 06:18:37 -0600 (MDT) (envelope-from danny@tcb.net) X-Avenger: version=0.7.8; receiver=dog.tcb.net; client-ip=66.46.153.245; client-port=57320; client-dnsfail=66.46.153.245: name server failure; syn-fingerprint=65535:55:1:64:M1460,N,W3,N,N,T,S MacOS 10.4.8; data-bytes=0 From: Danny McPherson Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Date: Tue, 30 Mar 2010 06:18:22 -0600 Message-Id: To: opsec wg mailing list Mime-Version: 1.0 (Apple Message framework v1077) X-Mailer: Apple Mail (2.1077) Subject: [OPSEC] Comments on draft-dugal-opsec-protect-control-plane-02 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Mar 2010 12:18:13 -0000 I support this document becoming an OPSEC WG item. A few mostly trivial comments below. I do believe the document would benefit from an overwrite for readability, but it seems to be in pretty good shape (and that's the purpose of making it a WG item). One substantive item is that I believe it needs to be a lot more detailed on IPv6 examples, in particular as they relate to ICMP. This is where lots of operators really need extra guidance today. Also, it should be clear about how transit traffic with TTL expiry isn't necessarily addressed to the device, but might get punted to the control plane. There is some text that touches on this, but this issue is not clear from the text. Finally, after giving RFC 1812 another read (phew), my comments at the microphone about references to that document aren't really useful. I had thought it had more detailed information on what it terms "in-band" access, however, the guidance there isn't particular useful in this context. -danny --- S 1. s/as as/as/ s/traffic unwanted traffic/unwanted traffic/ --- S 2. I think the document would benefit from IPv6 examples as well, and should reference that use case here and provide it further along in parallel to IPv6 examples. --- S 3. s/sample router introduced/sample router is introduced/ --- S 3.1. While I realize it's for example only, it might well be useful to add some sort of authentication packets to that example, so that folks can login if they have non-local auth models. Also, does anyone have recent rates of ICMP traffic destined to the control plane of high-end routers? 2 Mbps of ICMP seems pretty high to me.. --- S 3.2 It might be useful for the document, or the appendices to recommend allowing all traffic initially and auditing what hits the control plane before applying explicit filters or rate limits. Additionally, use of flow-based behavioral analysis or even CLI functions to identify what client/server functions a given control plane handles would be very useful during initial policy development phases (and certainly for forensics afterwards). Perhaps this belongs at the end of S 3.3, in the last graf where you touch on some of this. --- S 3.3 I'm not sure what "sub-traffic" is.. It might be worth expanding this a bit to say that an astute operator would likely define varying rate limits for ICMP such than internal traffic (i.e., from internal address blocks) obtains uninhibited access to the control plane, while traffic from external blocks is rate limited. I think you meant to allude to this, but don't really make it clear in the current text. --- S 4. I believe it'd be worthwhile to mention that while in the inter-domain context express ingress anti-spoofing policies may be difficult, operators should apply ingress infrastructure ACLs to limit access to infrastructure from external source address spoofing of internal address space. I.e., allow no packet into the perimeter of the network that has a source address of internal prefixes. Of course, iACLs and GTSM might well be a new section to this document, or a document entirely themselves. From warren@kumari.net Tue Mar 30 09:31:17 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 528CB3A67CF for ; Tue, 30 Mar 2010 09:31:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.131 X-Spam-Level: * X-Spam-Status: No, score=1.131 tagged_above=-999 required=5 tests=[BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2JxJbA1GviAf for ; Tue, 30 Mar 2010 09:31:16 -0700 (PDT) Received: from lisa.kumari.net (smtp.kumari.net [216.177.58.220]) by core3.amsl.com (Postfix) with ESMTP id 0C7A73A6A79 for ; Tue, 30 Mar 2010 09:31:16 -0700 (PDT) Received: by lisa.kumari.net (Postfix, from userid 5001) id C82482284615; Tue, 30 Mar 2010 12:30:29 -0400 (EDT) Received: from dot.her.corp.google.com (unknown [74.202.225.33]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by lisa.kumari.net (Postfix) with ESMTPSA id 7CA5B2284121 for ; Tue, 30 Mar 2010 12:30:28 -0400 (EDT) Message-Id: From: Warren Kumari To: opsec wg mailing list In-Reply-To: Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Date: Tue, 30 Mar 2010 12:31:43 -0400 References: X-Mailer: Apple Mail (2.936) Subject: Re: [OPSEC] Comments on draft-dugal-opsec-protect-control-plane-02 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Mar 2010 16:31:17 -0000 Is there an official "Last call" mail we should be replying to? On Mar 30, 2010, at 8:18 AM, Danny McPherson wrote: > > I support this document becoming an OPSEC WG item. +1 Already submitted comments off list. > A few > mostly trivial comments below. I do believe the document > would benefit from an overwrite for readability, but it > seems to be in pretty good shape (and that's the purpose of > making it a WG item). > > One substantive item is that I believe it needs to be a lot > more detailed on IPv6 examples, in particular as they relate > to ICMP. This is where lots of operators really need extra > guidance today. > > Also, it should be clear about how transit traffic with TTL > expiry isn't necessarily addressed to the device, but might get > punted to the control plane. There is some text that touches > on this, but this issue is not clear from the text. > > Finally, after giving RFC 1812 another read (phew), my comments > at the microphone about references to that document aren't > really useful. I had thought it had more detailed information > on what it terms "in-band" access, however, the guidance there > isn't particular useful in this context. > > -danny > > > --- > S 1. > > s/as as/as/ > > s/traffic unwanted traffic/unwanted traffic/ > > --- > S 2. > > I think the document would benefit from IPv6 examples as well, and > should reference that use case here and provide it further along in > parallel to IPv6 examples. > > --- > S 3. > > s/sample router introduced/sample router is introduced/ > > --- > S 3.1. > > While I realize it's for example only, it might well be useful to > add some sort of authentication packets to that example, so that > folks can login if they have non-local auth models. > > Also, does anyone have recent rates of ICMP traffic destined to the > control plane of high-end routers? 2 Mbps of ICMP seems pretty > high to me.. > > --- > S 3.2 > > It might be useful for the document, or the appendices to recommend > allowing all traffic initially and auditing what hits the control > plane before applying explicit filters or rate limits. Additionally, > use of flow-based behavioral analysis or even CLI functions to > identify what client/server functions a given control plane handles > would be very useful during initial policy development phases (and > certainly for forensics afterwards). Perhaps this belongs at the > end of S 3.3, in the last graf where you touch on some of this. > > --- > S 3.3 > > I'm not sure what "sub-traffic" is.. > > It might be worth expanding this a bit to say that an astute operator > would likely define varying rate limits for ICMP such than internal > traffic (i.e., from internal address blocks) obtains uninhibited > access to the control plane, while traffic from external blocks is > rate limited. I think you meant to allude to this, but don't really > make it clear in the current text. > > > --- > S 4. > > I believe it'd be worthwhile to mention that while in the inter-domain > context express ingress anti-spoofing policies may be difficult, > operators should apply ingress infrastructure ACLs to limit access to > infrastructure from external source address spoofing of internal > address > space. I.e., allow no packet into the perimeter of the network that > has a source address of internal prefixes. Of course, iACLs and GTSM > might well be a new section to this document, or a document entirely > themselves. > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec -- Consider orang-utans. In all the worlds graced by their presence, it is suspected that they can talk but choose not to do so in case humans put them to work, possibly in the television industry. In fact they can talk. It's just that they talk in Orang-utan. Humans are only capable of listening in Bewilderment. -- Terry Practhett From joelja@bogus.com Wed Mar 31 22:29:34 2010 Return-Path: X-Original-To: opsec@core3.amsl.com Delivered-To: opsec@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CD5C13A693A for ; Wed, 31 Mar 2010 22:29:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.131 X-Spam-Level: * X-Spam-Status: No, score=1.131 tagged_above=-999 required=5 tests=[BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1PHi3l3tdBBv for ; Wed, 31 Mar 2010 22:29:34 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [147.28.0.81]) by core3.amsl.com (Postfix) with ESMTP id 329A53A6950 for ; Wed, 31 Mar 2010 22:26:35 -0700 (PDT) Received: from [192.168.1.151] (c-98-234-104-156.hsd1.ca.comcast.net [98.234.104.156]) (authenticated bits=0) by nagasaki.bogus.com (8.14.3/8.14.3) with ESMTP id o315R4LA038104 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Thu, 1 Apr 2010 05:27:05 GMT (envelope-from joelja@bogus.com) Message-ID: <4BB42EA7.6010807@bogus.com> Date: Wed, 31 Mar 2010 22:27:03 -0700 From: Joel Jaeggli User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.8) Gecko/20100322 Lightning/1.0b1 Thunderbird/3.0.3 MIME-Version: 1.0 To: Danny McPherson References: In-Reply-To: X-Enigmail-Version: 1.0.1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.2 (nagasaki.bogus.com [147.28.0.81]); Thu, 01 Apr 2010 05:27:06 +0000 (UTC) Cc: opsec wg mailing list Subject: Re: [OPSEC] Comments on draft-dugal-opsec-protect-control-plane-02 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Apr 2010 05:29:34 -0000 Thanks Danny, test for inclusion will likely follow the publishing of the minutes. joel On 03/30/2010 05:18 AM, Danny McPherson wrote: > > I support this document becoming an OPSEC WG item. A few > mostly trivial comments below. I do believe the document > would benefit from an overwrite for readability, but it > seems to be in pretty good shape (and that's the purpose of > making it a WG item). > > One substantive item is that I believe it needs to be a lot > more detailed on IPv6 examples, in particular as they relate > to ICMP. This is where lots of operators really need extra > guidance today. > > Also, it should be clear about how transit traffic with TTL > expiry isn't necessarily addressed to the device, but might get > punted to the control plane. There is some text that touches > on this, but this issue is not clear from the text. > > Finally, after giving RFC 1812 another read (phew), my comments > at the microphone about references to that document aren't > really useful. I had thought it had more detailed information > on what it terms "in-band" access, however, the guidance there > isn't particular useful in this context. > > -danny > > > --- > S 1. > > s/as as/as/ > > s/traffic unwanted traffic/unwanted traffic/ > > --- > S 2. > > I think the document would benefit from IPv6 examples as well, and > should reference that use case here and provide it further along in > parallel to IPv6 examples. > > --- > S 3. > > s/sample router introduced/sample router is introduced/ > > --- > S 3.1. > > While I realize it's for example only, it might well be useful to > add some sort of authentication packets to that example, so that > folks can login if they have non-local auth models. > > Also, does anyone have recent rates of ICMP traffic destined to the > control plane of high-end routers? 2 Mbps of ICMP seems pretty > high to me.. > > --- > S 3.2 > > It might be useful for the document, or the appendices to recommend > allowing all traffic initially and auditing what hits the control > plane before applying explicit filters or rate limits. Additionally, > use of flow-based behavioral analysis or even CLI functions to > identify what client/server functions a given control plane handles > would be very useful during initial policy development phases (and > certainly for forensics afterwards). Perhaps this belongs at the > end of S 3.3, in the last graf where you touch on some of this. > > --- > S 3.3 > > I'm not sure what "sub-traffic" is.. > > It might be worth expanding this a bit to say that an astute operator > would likely define varying rate limits for ICMP such than internal > traffic (i.e., from internal address blocks) obtains uninhibited > access to the control plane, while traffic from external blocks is > rate limited. I think you meant to allude to this, but don't really > make it clear in the current text. > > > --- > S 4. > > I believe it'd be worthwhile to mention that while in the inter-domain > context express ingress anti-spoofing policies may be difficult, > operators should apply ingress infrastructure ACLs to limit access to > infrastructure from external source address spoofing of internal address > space. I.e., allow no packet into the perimeter of the network that > has a source address of internal prefixes. Of course, iACLs and GTSM > might well be a new section to this document, or a document entirely > themselves. > > > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec >