Subject: [secdir] draft-ietf-bess-virtual-subnet-05 SECDIR Review

From: Donald Eastlake <[email-masked]>
Date: Tue, 24 Nov 2015 13:34:17 -0500

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  Document editors and WG chairs should treat these comments just
like any other last call comments.

This Informational document describes a straightforward method using
existing BGP/MPLS VPN technology along with ARP/ND proxying to
interconnect parts of an IP subnet spread across two or more data
centers including support of VM migration between data centers. (It
also suggest that bridging techniques be used if non-iP traffic has to
be supported.)

Security:

The Security Considerations section in its entirety is as follows:

   This document doesn't introduce additional security risk to BGP/MPLS
   IP VPN, nor does it provide any additional security feature for BGP/
   MPLS IP VPN.

While I don't think the Security Considerations section of this
Informational document needs to be particularly large or heavy, I
believe there is more to be said. Perhaps points such as the security
of the L2 or IP addresses used by the hosts/servers in the data
centers or the PE devices seeming like ideal concentration points to
observe traffic metadata and content so systems along the lines of
those described here should take that into account.

Other:

While I understand that many disagree with me, I believe that, except
in special circumstances, front page authors should list a postal
address and/or telephone number in the Authors Addresses section as
well as an email address. In my opinion, the Authors Addresses section
of this draft is an example of schlock corner cutting.

Trivia:

Section 1, page 3, item b: "challenge on the forwarding" -> "challenge
to the forwarding".
    item c: "growing by multiples" -> "multiplying"

Section 1, page 4: "infrastructures and their corresponding
experiences" -> "infrastructure and experience".

Section 3.4: "Acting as an ARP or ND proxies, a PE routers" -> "Acting
as an ARP or ND proxy, a PE router"

I'm not sure what the occurrences of "Infrastructure-as-a-Service
(IaaS)" and "IaaS" add other than buzzword compliance think the draft
would be improved by deleting them.

Thanks,
Donald
=============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [email-masked]

---

From: Xuxiaohu <[email-masked]>
Date: Wed, 25 Nov 2015 02:03:49 +0000

Hi Donald,

Thanks a lot for your review. Please see my response inline.

> -----Original Message-----
> From: Donald Eastlake [mailto:[email-masked]]
> Sent: Wednesday, November 25, 2015 2:34 AM
> To: [email-masked]; [email-masked]
> Cc: [email-masked]
> Subject: draft-ietf-bess-virtual-subnet-05 SECDIR Review
> 
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  Document
> editors and WG chairs should treat these comments just like any other last call
> comments.
> 
> This Informational document describes a straightforward method using existing
> BGP/MPLS VPN technology along with ARP/ND proxying to interconnect parts of
> an IP subnet spread across two or more data centers including support of VM
> migration between data centers. (It also suggest that bridging techniques be
> used if non-iP traffic has to be supported.)
> 
> Security:
> 
> While I don't think the Security Considerations section of this Informational
> document needs to be particularly large or heavy, I believe there is more to be
> said. Perhaps points such as the security of the L2 or IP addresses used by the
> hosts/servers in the data centers or the PE devices seeming like ideal
> concentration points to observe traffic metadata and content so systems along
> the lines of those described here should take that into account.

How about adding the following text to the security consideration section?

"Since the BGP/MPLS IP VPN signaling is reused without any change, those security considerations as described in [RFC4364] are applicable to this document. Meanwhile, since security issues associated with the NDP are inherited due to the use of NDP proxy, those security considerations and recommendations as described in [RFC6583] are applicable to this document as well."

> Other:
> 
> While I understand that many disagree with me, I believe that, except in special
> circumstances, front page authors should list a postal address and/or telephone
> number in the Authors Addresses section as well as an email address. In my
> opinion, the Authors Addresses section of this draft is an example of schlock
> corner cutting.

OK, I will fix it.

> Trivia:
> 
> Section 1, page 3, item b: "challenge on the forwarding" -> "challenge to the
> forwarding".

Will fix it.

> Section 1, page 4: "infrastructures and their corresponding experiences" ->
> "infrastructure and experience".

Will fix it

> Section 3.4: "Acting as an ARP or ND proxies, a PE routers" -> "Acting as an ARP
> or ND proxy, a PE router"

Will fix it.
 
> I'm not sure what the occurrences of "Infrastructure-as-a-Service (IaaS)" and
> "IaaS" add other than buzzword compliance think the draft would be improved
> by deleting them.

Will delete them. Thanks a lot again for your review.

Best regards,
Xiaohu

>  155 Beaver Street, Milford, MA 01757 USA  [email-masked]

---

From: Donald Eastlake <[email-masked]>
Date: Tue, 24 Nov 2015 22:35:45 -0500

Hi Xiaohu,

On Tue, Nov 24, 2015 at 9:03 PM, Xuxiaohu <[email-masked]> wrote:
>>...

Adding that would be a good. I have read the security considerations
referred to above and they cover most of my concerns. So I would be
satisfied if you added that text.

Thanks for offering to fix all the things below.

Donald

---

From: Xuxiaohu <[email-masked]>
Date: Wed, 25 Nov 2015 03:54:46 +0000

Hi Donald,

Thanks for your quick confirmation.

Best regards,
Xiaohu

> Sent: Wednesday, November 25, 2015 11:36 AM
> To: Xuxiaohu
> Cc: [email-masked]; [email-masked]; [email-masked]
> Subject: Re: draft-ietf-bess-virtual-subnet-05 SECDIR Review
> 
> Hi Xiaohu,
> 
> >> observe traffic metadata and content so systems along the lines of those
> described here should take that into account.
> >
> > "Since the BGP/MPLS IP VPN signaling is reused without any change, those
> security considerations as described in [RFC4364] are applicable to this
> document. Meanwhile, since security issues associated with the NDP are
> inherited due to the use of NDP proxy, those security considerations and
> recommendations as described in [RFC6583] are applicable to this document as
> well."
> 
> Adding that would be a good. I have read the security considerations referred to
> above and they cover most of my concerns. So I would be satisfied if you added
> that text.
> 
> >> well as an email address. In my opinion, the Authors Addresses
> >> section of this draft is an example of schlock corner cutting.
> >
> > OK, I will fix it.
> >
> >> Trivia:
> >>
> >> Section 1, page 3, item b: "challenge on the forwarding" ->
> >> "challenge to the forwarding".
> >> Section 3.4: "Acting as an ARP or ND proxies, a PE routers" ->
> >> "Acting as an ARP or ND proxy, a PE router"
> >
> > Will fix it.
> >