Re: [Last-Call] Secdir last call review of draft-ietf-opsawg-l3sm-l3nm-10

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 25/07/2021 21:54, Rifaat Shekh-Yusef via Datatracker wrote:
Reviewer: Rifaat Shekh-Yusef
Review result: Has Issues

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

This document defines an L3VPN Network YANG Model (L3NM) that can be
used for the provisioning of Layer 3 Virtual Private Network (VPN)
services within a service provider network.  The model provides a
network-centric view of L3VPN services.

Issues:

1. The following is a quote from Security Consideration section:
     "Several data nodes defined in the L3NM rely upon [RFC8177] for
      authentication purposes."

I think it would be helpful to elaborate on which nodes need the mechanism
defined in RFC8177 and why?

2. The summary bullets:

    o  Malicious clients attempting to delete or modify VPN services.

Why 'create' and 'read' are not part of the risks in this case?

Rifat

Reading this I-D, I wondered what the secdir view is of recommending the use of MD5 to secure the session as this I-D does for BGP. (Such a use in NTP did generate a comment).

Tom Petch

--
last-call mailing list
last-call@xxxxxxxx
https://www.ietf.org/mailman/listinfo/last-call



[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Mhonarc]     [Fedora Users]

  Powered by Linux