Subject: Re: [dhcwg] Question re. RECONFIG in DHCPv6

From: "Mudric, Dusan (Dusan)" <[email-masked]>
Date: Thu, 14 May 2015 18:45:15 +0000

Resending to dhcwg. Thanks for the recommendation.

Dusan

From: Bernie Volz (volz) [mailto:[email-masked]]
Sent: Tuesday, May 12, 2015 6:29 PM
To: Mudric, Dusan (Dusan); Lorenzo Colitti; STARK, BARBARA H
Cc: Lin, Ping (Ping); [email-masked]; Steven B.
Subject: RE: Question re. RECONFIG in DHCPv6

I am not sure why you are sending these kinds of questions and to ipv6 (6man) wg when RFC 3315 is a product of the dhc wg.

There is no hard requirement in RFC 3315 to implement Reconfigure from a client or server perspective.

Sure, there could be networks where a server may enforce the requirement that Reconfigure is supported by a client (i.e., Reconfigure Accept option must be sent by client) and a client that does not support it would thus not be serviced (since the server’s policy says to ignore such clients). But such a restriction, except for specific environments where it may be mandated, would not likely be wise since it may prevent many clients from obtaining an address.

As I already mentioned in another threads, the DHC WG is working on a RFC 3315bis document and we are discussing removing much related to Authentication; though the Reconfigure Key Authentication Protocol would remain. And devices that want to support Reconfigure should use that form of authentication. See Section 21.5 of RFC 3315.

-          Bernie

From: Mudric, Dusan (Dusan) [mailto:[email-masked]]
Sent: Tuesday, May 12, 2015 2:14 PM
To: Lorenzo Colitti; STARK, BARBARA H
Cc: Bernie Volz (volz); Lin, Ping (Ping); [email-masked]<mailto:[email-masked]>; Steven B.
Subject: RE: Question re. RECONFIG in DHCPv6

Changing configuration attributes on DHCPv6 server and pushing to clients using RECONFIGURE

Based on RFC 3315, there are three reasons to support RECONFIGURE:

-          The need for the immediate configuration updates

-          Server might respond only to the clients willing to accept RECONFIGURE message

-          Server can require that the client supports RECONFIGURE

A detailed analysis is below.

Based on these criteria, does it mean it is mandatory to support dynamic updates of stateful configuration attributes using RECONFIGRE and, consequently, DHCPv6 authentication?

RFC 3315 – RECONFIGURE

====================

When the configuration is changed on DHCPv6 server, the server initiates the update, rfc3315#section-19 "DHCP Server-Initiated Configuration Exchange"<https://urldefense.proofpoint.com/v2/url?u=http-3A__tools.ietf.org_html_rfc3315-23section-2D19&d=AwMGaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=3QBEh21lvnR4xQ_3jGakXsiIdQWItxrMTZgMRMmA_SY&s=5ukSCAMfjqmkvV5i8SNcvHBif3Frp_LfRBIJy0-fGXk&e=>:

   A server sends a Reconfigure message to cause a client to initiate

   immediately a Renew/Reply or Information-request/Reply message

   exchange with the server.

Pushing new configurations from DHCPv6 server using RECONFIGURE is important. Without RECONFGIURE the client can get the configuration only after T1 timeout, when it sends SOLICIT.

In addition, RFC3315 allows servers to reject SOLICIT msgs if the clients don’t support RECONFIGURE:

rfc3315#section-17.2.1 "Receipt of Solicit Messages"<https://urldefense.proofpoint.com/v2/url?u=http-3A__tools.ietf.org_html_rfc3315-23section-2D17.2.1&d=AwMGaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=3QBEh21lvnR4xQ_3jGakXsiIdQWItxrMTZgMRMmA_SY&s=H7PYtOB8Y0csamW8ibH-uFUKn_K4PdydMdn2ZT78J8w&e=>

   The server determines the information about the client and its

   location as described in section 11<https://urldefense.proofpoint.com/v2/url?u=http-3A__tools.ietf.org_html_rfc3315-23section-2D11&d=AwMGaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=3QBEh21lvnR4xQ_3jGakXsiIdQWItxrMTZgMRMmA_SY&s=8SyyT53qlExQ30HNzhu2_3OFdtgqOPnDcQCl9tJddxs&e=> and checks its administrative

   policy about responding to the client.  If the server is not

   permitted to respond to the client, the server discards the Solicit

   message.  For example, if the administrative policy for the server is

   that it may only respond to a client that is willing to accept a

   Reconfigure message, if the client indicates with a Reconfigure

   Accept option in the Solicit message that it will not accept a

   Reconfigure message, the servers discard the Solicit message.

The client only accepts options it asked for in ORO of SOLICIT msg. The server can send Reconfigure Accept option in ADVERTISE to request the reconfigure support:  rfc3315#section-17.2.2 "Creation and Transmission of Advertise Messages"<https://urldefense.proofpoint.com/v2/url?u=http-3A__tools.ietf.org_html_rfc3315-23section-2D17.2.2&d=AwMGaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=3QBEh21lvnR4xQ_3jGakXsiIdQWItxrMTZgMRMmA_SY&s=BlRiB8G9mdBNH0H357iMPqrxlyd4k-nK8gyojUAyPyA&e=>

   The server includes a Reconfigure Accept option if the server wants

   to require that the client accept Reconfigure messages.

It is not clear in the RFC what the behavior is in this case . Shall the client ignore Reconfigure Accept option sent by DHCPv6 server or it shall support RECONFIGURE message?

Dusan

From: Lorenzo Colitti [mailto:[email-masked]]
Sent: Monday, May 11, 2015 10:19 AM
To: STARK, BARBARA H
Cc: Bernie Volz (volz); Lin, Ping (Ping); Mudric, Dusan (Dusan); [email-masked]<mailto:[email-masked]>; Steven B.
Subject: Re: Question re. RECONFIG in DHCPv6

The best characterization of this situation I've heard is from Steven: CPE routers "are supposed to must" implement reconfigure. :-)

I don't know that it would be wise for an operator to rely on reconfigure support in CPEs unless they had stringent acceptance testing and certified the CPEs themselves.

On Mon, May 11, 2015 at 9:20 PM, STARK, BARBARA H <[email-masked]<mailto:[email-masked]>> wrote:
It’s required for pretty much every CE router that wants to connect to a “standard” ISP access network. Not just DOCSIS. It’s required in BBF TR-124 and RFC 7084. But according to conversations I’ve had with various telco ISPs, it is about having the capability there just in case it’s needed to forcibly renumber (IA_PD or IA_NA) the CE router. I’m also not aware of any cases where it’s actually been used. But unless there is widespread unhappiness or very vocal singular unhappiness over a renumbering incident, I would never expect to hear of such cases.
Barbara

From: ipv6 [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Bernie Volz (volz)
Sent: Sunday, May 10, 2015 10:01 AM
To: Lin, Ping (Ping)
Cc: Mudric, Dusan (Dusan); [email-masked]<mailto:[email-masked]>
Subject: Re: Question re. RECONFIG in DHCPv6

For stateless DHCPv6, the Information Refresh Time (see RFC 4242) is usually used to cause periodic client refreshes. Reconfigure requires authentication and so only applies to the cases that can use authentication - and use of authentication with Information-Request only is unclear from RFC 3315. The RFC 3315 bis work will remove much of the authentication support (except for Reconfigure Key Auth. Protocol (RKAP)) - this requires stateful.

The RFC 3736 document is really not something I would recommend following - see full RFC 3315 and implement those features you need (such as only Information-Request and Reply). 3736 was written to demonstrate that stateless dhcpv6 was rather simple to implement.

Technically if a client has done Solicit/... and then later the server's configuration has changed, a Reconfigure message specifying the client should send Information-Request is allowed (if only "other congifuration" options have changed).

I don't have any good data as to how important Reconfigure is and it is optional for client and server to implement/support - client specifies whether it can support it when RKAP is used. There are some uses where it is required, such as for CableLabs DOCSIS Cable Modems (see the CableLabs standards). But whether this is actually used in the field for DOCSIS (i.e. server providers make use of it) is unclear.

- Bernie (from iPad)

On May 9, 2015, at 9:12 AM, Lin, Ping (Ping) <[email-masked]<mailto:[email-masked]>> wrote:
Hi Everyone,

I was wondering if you could help with a question about RECONFIG in DHCPv6:

RFC 3736 indicates that stateless DHCPv6 does not support the RECONFIGURE message.  If this is the case for stateless DHCPv6, how important is RECONFIGURE support for stateful DHCPv6 and how much is it used in practice?

Thanks very much,
Ping Lin

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]<mailto:[email-masked]>
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_ipv6&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=0jkgXednN3zUusa8-1yTKZFy-6qXZOHJ1TnZUT-wFPw&s=XTrk-0GVD_CkBXNzT78u3iNvRaVFq2vESYf_OGQR4hc&e=>
--------------------------------------------------------------------

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]<mailto:[email-masked]>
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_ipv6&d=AwMFaQ&c=BFpWQw8bsuKpl1SgiZH64Q&r=UT3Bk9cbLeaJxhf3iCrhIoUWB8YLZU23029sMQGQ2kY&m=0jkgXednN3zUusa8-1yTKZFy-6qXZOHJ1TnZUT-wFPw&s=XTrk-0GVD_CkBXNzT78u3iNvRaVFq2vESYf_OGQR4hc&e=>
--------------------------------------------------------------------