Speaking as regular ol' member
On Fri, 30 Sep 2011, Jakob Heitz wrote:
On Friday, September 30, 2011 1:24 PM, Randy Bush <mailto:[email protected]> wrote:
If my customer does not support SIDR
then create the subsidiary cert, ee cert, and roa for them. you will
then have two certs,
10.0.0.0/16-16
10.0.66.0/24-24
i call this the lazy customer. they probably pay me to one or more of
provision the circuit, configure their cpe, ... i might as well
provision their certs and roa.
Will you sign his announcement too?
If he doesn't implement sidr on all his routers yet,
he will not sign his announcements.
In origin authorization phase, no signing of announcements is done.
In path validation phase (bgpsec), you are creating his ROAs - so make
yourself the valid origin - and then yes, sign the originating (your)
announcement. Or if you create the cert, then you hold the key, so yes,
you could sign his announcement. (Holding the keys gives you ultimate
power.)
--Sandy, speaking as regular ol' member
--
Jakob Heitz.
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
