Subject: Re: [trill] Review of draft-ietf-trill-oam-framework-01.txt

From: Donald Eastlake <[email-masked]>
Date: Wed, 3 Apr 2013 17:06:28 -0400

Hi Gayle,

On Mon, Apr 1, 2013 at 1:13 AM, gayle noble <[email-masked]> wrote:
>  In reading some of the drafts it occurred to me that something should be
> specified as to how one should handle OAM messages that might be sent from
> outside the TRILL campus in the draft that talks about this.
>
> Currently in draft draft-ietf-trill-oam-framework-01.txt, in the Security
> Considerations Section it says:
> "Optionally authenticate communicating endpoints (MEPs and MIPs)"
>
> To be real clear I think it should read something like::
>
> "Optionally authenticate at communicating endpoints (MEPs and MIPs)
> that an OAM message has originated at a communicating endpoint."

Thanks for the comment...
Maybe it should even say "... has originated at an appropriate
communicating endpoint."

> Perhaps even add in that if the OAM message fails authentication, the switch
> should log the attempt and notify the sys admin. Or maybe that is obvious?

I don't think the IETF is complete consistent on this point but
generally IETF specifications concentrate on the bits on the wire and
the state machines at the end points so they frequently omit saying
anything explicit about logging...

Thanks,
Donald
=============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 155 Beaver Street, Milford, MA 01757 USA
 [email-masked]

> gayle

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Thu, 4 Apr 2013 09:46:45 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Donald Eastlake
> Sent: Thursday, April 04, 2013 12:06 AM
> To: gayle noble
> Cc: [email-masked]
> Subject: Re: [trill] Review of draft-ietf-trill-oam-framework-01.txt

> 
> > Perhaps even add in that if the OAM message fails authentication, the
> > switch should log the attempt and notify the sys admin. Or maybe that
> is obvious?
> 

[[DR]] As Donald says (politely) the IETF is not completely consistent on this point. My preference is for an Operational and Manageability Considerations section (as recommended by RFC 5706) which would among other list the recommended tools to be  implemented in the routers or hosts for administration purposes. Logging security incidents would be such a function. See also my review of the same document, a few more items may be included in such a section. There is no need to define all the details here, but to list the issues to the attention of implementers and operators, and as subject for future work. 

Regards,

Dan