Skip to content

Update to accommodate Jeff Haas's comment #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ksriram25 wants to merge 2 commits into
base: master
Choose a base branch
from
+13 −2
Open

Update to accommodate Jeff Haas's comment #40

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
101a573
Update to accommodate Jeff Haas's comment
ksriram25 Jun 6, 2026
23d7ed7
Update to accommodate Jeff Haas's comment
ksriram25 Jun 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions draft-ietf-sidrops-aspa-verification.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
<?rfc subcompact="no" ?>

<rfc category="std"
docName="draft-ietf-sidrops-aspa-verification-25"
docName="draft-ietf-sidrops-aspa-verification-26"
submissionType="IETF"
consensus="true"
ipr="trust200902">
Expand Down Expand Up @@ -234,7 +234,7 @@

<section title="Principles" anchor="principles">
<t>
Let the sequence COMPRESSED_AS_PATH {AS(N), AS(N-1),..., AS(2), AS(1)} represent the AS_PATH in terms of unique ASNs, where AS(1) is the origin AS and AS(N) is the most recently added AS and neighbor of the receiving/verifying AS.
Let the sequence COMPRESSED_AS_PATH = {AS(N), AS(N-1),..., AS(2), AS(1)} represent the AS_PATH after collapsing consecutive duplicate ASNs, where AS(1) is the origin AS, AS(N) is the most recently added AS (and a neighbor of the receiving/verifying AS), and no two consecutive ASNs are equal.

@mitradir mitradir Jun 16, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm fine with the first change of the sentence, but the last part of the phrase looks like an overkill for me

@jhaas-pfrc jhaas-pfrc Jun 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps:
Let the sequence COMPRESSED_AS_PATH = {AS(N), AS(N-1),..., AS(2), AS(1)} represent the AS_PATH after removing consecutive duplicate ASNs, where AS(1) is the origin AS, AS(N) is the most recently added AS, and a neighbor of the receiving/verifying AS.

@mitradir mitradir Jun 17, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good for me

AS(N+1) represents the local (receiving/verifying) AS; it does not explicitly appear in the description of the AS_PATH verification procedures.
</t>
<t>
Expand Down Expand Up @@ -477,6 +477,17 @@ authorized(AS x, AS y) = / Else, "Provider+" if the U-SPAS entry
The AS operator MUST notify its customer ASes and advise them to update ASPA records to include both the globally configured ASN and the legacy ASN in their SPAS.
</t>
</section>
<section title="Partitioned AS" anchor="AS-part">
<t>
In rare scenarios where an AS becomes internally partitioned, for example, due to a physical link failure, operators may temporarily onboard a pre-designated emergency transit provider to bridge the isolated segments.
To achieve this, the AS must override standard eBGP loop detection to accept its own routes via the emergency provider and it may propagate the routes (with loops) to its downstream customers.

@mitradir mitradir Jun 16, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there an assumption that there is a specific provider between two parts of the same network? I have seen such a scenario before in the wild, and to my understanding, there may be multiple ASs in the middle. If loop detection is turned off or relaxed, they just accept their own routes from other sources.

But the ASPA will also work in this case, no actions are needed except for registering providers, including emergency ones, and this was already stated in the document.

I can work on the wording of this section, but do we really need it if there is no specific processing and second thoughts?

@jhaas-pfrc jhaas-pfrc Jun 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There can definitely be more than one provider involved.

@ksriram25 ksriram25 Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mitradir @jhaas-pfrc
In the example in Section 6.6, there are two providers -- one regular (say Provider AS A) and another that is for emergency/backup (say Provider AS B). When the AS X in question is not partitioned, AS A serves all of AS X. When partitioned, AS X breaks into two disconnected parts -- Parts 1 and 2. Part 1 is still connected to and served by Provider AS A. The emergency Provider AS B is on-boarded to serve Part 2. So, when an ASBR in Part 2 receives Part 1's customers' routes from AS B, the routes contain both AS A and AS B in the path.

@mitradir mitradir Jun 17, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It may be still be a regular provider, or a backup provider, or ASA ASB ASC ASA, where ASB and ASC are both providers of ASA, it doesn't change the situation. And doesn't require any additional guidance in terms of ASPA registration process.

@jhaas-pfrc jhaas-pfrc Jun 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The sole necessary guidance is "if you're going to use loops as a feature, ASPA can break it if you don't have the necessary objects registered".

This operational workaround results in an AS_PATH containing a non-consecutive AS loop as seen by the customers (where the partitioned AS's ASN appears twice, separated by the upstream providers).
The AS_PATH verification procedures (<xref target="verif"/>) work fine for such routes.
To ensure these routes remain globally reachable and are not flagged as ASPA-Invalid, operators must plan for these contingencies in advance.
Any backup or emergency upstream provider AS intended for partition recovery must be explicitly included in the customer AS's ASPA registration.
Pre-registering these emergency providers in the ASPA record ensures that the resulting paths pass verification even when emergency topology-bridging is active.
</t>
</section>

<section title="Logging" anchor="logging">
<t>
Expand Down