GTSM - Do you use it?

Mailman List Mirror (Read Only)
1

Hi,

I would like to know if operators use GTSM techniques with BGP and other routing protocols today? Is any at the perimeter of the routing domain deployed? I would believe that GTSM can provide protection against attacks more than a hop away and thus can save against a lot of potential Dos attacks.

Is anything done by the operators here?

Thanks,
John

2

We'd love to use it but unfortunately the J vendor doesn't support it very well even on T-series (if it supports it at all, not quite sure..).

Enhancement Requests haven't gotten through, but maybe gripes on nanog will :frowning:

3

Then is it fair to assume that operators are not using it?

4

I don't think that's a fair assumption. A few providers I talked to for a security current practiced document I am writing said they were deploying it between BGP peers and I recently asked for more clarification from some individuals to ensure I had correct info with respect to vendors. There is some support in some J boxes and also support in C boxes. I didn't get specific detail how it was deployed, just that is was.

- merike

5

Juniper only suports GTSM on Gibson-based architectues (which is T640,
T320, M320, and M120 today). Cisco only supports GTSM in a meaningful way
on IOS XR on CRS-1. All IOS based platforms still check MD5 before TTL,
and only do TTL checks in software, making it worthless for anything other
than deploying it on sessions today and maybe making it do something
useful tomorrow. I think XR on GSR support is limited too, but nobody runs
that in production anyways. :slight_smile:

And no, nobody seriously deploys GTSM today in any kind of scale. AFAIK no
other vendors support it yet either, so requiring it on sessions is a
non-starter.

6

[...]

Enhancement Requests haven't gotten through, but maybe gripes on nanog will :frowning:

IME, griping about something on a mailing list, while typically getting you an email from a techie at the company concerned (especially if the gripe was ferocious enough to strip paint), rarely actually gets the problem fixed.

It's not unreasonable, I guess. Decision makers aren't likely to be reading operational mailing lists with a low S/N ratio.