[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

IGP protocol

Subject: IGP protocol
From: saku at ytti.fi (Saku Ytti)
Date: Sun, 18 Nov 2018 21:24:22 +0200
In-reply-to: <[email protected]>
References: <CAH_tYHKhrwW3hXAig5KpzsDp+TvPwPc6dWdNeukxP=3XDv0qHA@mail.gmail.com> <[email protected]> <[email protected]> <CAAeewD_HFoupchpi_HR3ax6g6LJUif8AVp=O9S8SRP5EYmhhNQ@mail.gmail.com> <[email protected]> <CAAeewD_sdx_jB=8mGyop=kWyKSbZ+VUrw=mWkSnZ6N_aDhvOLg@mail.gmail.com> <1542535947.1541447.1580774296.7826FFBD@webmail.messagingengine.com> <CAAeewD-SUwuFVQ6Zv9Ue-4KrsRZ6Hb1UC9n4w_F=QExHfy6Vcg@mail.gmail.com> <[email protected]>

On Sun, 18 Nov 2018 at 21:07, Grant Taylor via NANOG <nanog at nanog.org> wrote:

> Is it not possible to protect (just) the eBGP with IPsec?

Not on all gears SPs are deploying. But people doing this.

> I would think that IPsec would provide the desired protection and that
> tuning filters to the proper ports would reduce the overhead that MACsec
> might incur with all traffic being encrypted.

Correct and more important being control-plane only feature, it's
significantly cheaper.

Personally I do trust HMAC-MD5 to offer sufficient security today.

-- 
  ++ytti

References:
- IGP protocol
  - From: nanog at netfront.jp (im)
- IGP protocol
  - From: mark.tinka at seacom.mu (Mark Tinka)
- IGP protocol
  - From: ahebert at pubnix.net (Alain Hebert)
- IGP protocol
  - From: saku at ytti.fi (Saku Ytti)
- IGP protocol
  - From: mark.tinka at seacom.mu (Mark Tinka)
- IGP protocol
  - From: saku at ytti.fi (Saku Ytti)
- IGP protocol
  - From: alfie at fdx.services (Alfie Pates)
- IGP protocol
  - From: saku at ytti.fi (Saku Ytti)
- IGP protocol
  - From: gtaylor at tnetconsulting.net (Grant Taylor)

Prev by Date: IGP protocol
Next by Date: IGP protocol
Previous by thread: IGP protocol
Next by thread: IGP protocol
Index(es):
- Date
- Thread