Re: DHCPv6-PD relay route injection - standard?

2019-05-21 Thread Brandon Martin

On 5/19/19 2:05 AM, Mikael Abrahamsson wrote:
There needs to be interaction between the packet forwarding layer and 
the DHCP layer when doing things like DHCPv6-PD, otherwise it's not of 
any use.


It was implicit to me, anyway, that this type of behavior is only 
relevant when the DHCP-endpoint (customer) subnet default router's 
control plane and the DHCP relay agent are in intimate communication 
i.e. are essentially integrated in some meaningful way.


I guess you could extend the behavior to any situation where the router 
is able to snoop the DHCP relay conversation, but I think that's fraught 
with issues since, if the relay agent isn't on the router itself, who 
knows where it is on the L2, and trying to snoop the relay-server 
communication, rather than the client-relay exchange, may give lots of 
crazy behavior.


If the relay isn't integrated with the router in any meaningful way, I 
guess you have to fall back to some undefined "out of band signaling 
protocol" which I guess we don't have, either.  BGP or OpenFlow seem 
like the most obvious options.


I guess most networks offering this are using heavy-weight subscriber 
management facilities based on RADIUS or some other more-involved AAA 
mechanism?  That's obvious if you're running PPPoE and have highly 
centralized L3 termination but less so if you're running native Ethernet 
(or something that looks like Ethernet) everywhere with semi-distributed 
L3 termination.

--
Brandon Martin


Re: BGP prefix filter list

2019-05-21 Thread Alejandro Acosta



On 5/20/19 7:26 PM, John Kristoff wrote:

On Mon, 20 May 2019 23:09:02 +
Seth Mattinen  wrote:


A good start would be killing any /24 announcement where a covering
aggregate exists.

I wouldn't do this as a general rule.  If an attacker knows networks are
1) not pointing default, 2) dropping /24's, 3) not validating the
aggregates, and 4) no actual legitimate aggregate exists, (all
reasonable assumptions so far for many /24's), then they have a pretty
good opportunity to capture that traffic.



+1 John

Seth approach could be an option _only_ if prefix has an aggregate 
exists && as origin are the same




John