The MPLS WG Archive

[Mark Seery <mark@mseery.com>]

Hi Michael,

Given the statement in 5.1 "...security mechanisms
discussed here assume correct configuration..." my
comments may not apply, but FYI for consideration in
future drafts.

label swapping forwarding elements introduce the
possibility of label swap/merge faults; either through
misconfiguration or through label distribution bugs.

the traditional way that label swap networks have
dealt with this problem is through continuity tests
(verifying correct end point addresses). Such
mechanisms are being discussed in PWE/MPLS WGs, and
hence when/if applied would provide for a way to
recognise a misconfiguration and reduce the amount of
time the security leak is present for.

When such mechanisms are implemented in MPLS VPN 
networks, then such a network could be considered as
secure as an ATM-based network (for example a Frame
over ATM core network).

Mark