Subject: RE: Limiting the Use of Site-Local

From: Margaret Wasserman <[email-masked]>
Date: Wed, 30 Oct 2002 17:20:53 -0500

>
>I don't understand this. In your proposal, every site will be filtering
>a different global prefix. Routers in the internet backbone will not be
>filtering any global prefix. Where is the comparable defense in the
>depth?

I think it depends what you mean by "filtering a prefix"...

If you use a global prefix to number a private site, you wouldn't
necessarily advertise that prefix in global routing tables.  In
fact, it would be best not to.  So, it wouldn't be any more
"routable" on the Internet than a site-local prefix.  Routers
wouldn't have any path to it, so they'd drop it...

Also, I am under the impression that ISPs do some filtering at the
customer bounday -- only allowing traffic from a customers' global
prefix(es) out, and only letting traffic to the customers' global
prefix(es) in...  How common is this?

Margaret

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Mark Smith <[email-masked]>
Date: 31 Oct 2002 09:55:49 +1100

> prefix(es) in...  How common is this?

Quite common.

I think the motivation for doing this is to prevent traffic holding any
private addressing or unauthorised public addressing from leaking from
the site. 

On a related topic, if I was to stuff up my site local filters at the
edge of my site, would my network then become part of my ISPs site local
network ? In the proposed site-local models, are sites adjacent, or are
they separated by segments that only have a global address assignments
(eg the BGP AS model vs the OSPF area model) ?

Regards,
Mark.

---

From: "Tony Hain" <[email-masked]>
Date: Wed, 30 Oct 2002 15:09:37 -0800

Mark Smith wrote:
> ...
> On a related topic, if I was to stuff up my site local 
> filters at the edge of my site, would my network then become 
> part of my ISPs site local network ? 

You would both have to make an error to get the two IGPs tied together. 

> In the proposed 
> site-local models, are sites adjacent, or are they separated 
> by segments that only have a global address assignments (eg 
> the BGP AS model vs the OSPF area model) ?

I remember this discussion a few months back, but I don't remember the
conclusion. Maybe Ole does. 

Tony

---

From: "Tony Hain" <[email-masked]>
Date: Wed, 30 Oct 2002 15:05:14 -0800

Margaret Wasserman wrote:
> If you use a global prefix to number a private site, you 
> wouldn't necessarily advertise that prefix in global routing 
> tables. 

Yes you would, because that private site is most likely part of a larger
enterprise, so the parts that get advertised will be a /48 or shorter,
while the parts that want to stay disconnected would be a /56 or longer.

> In fact, it would be best not to.  So, it wouldn't 
> be any more "routable" on the Internet than a site-local 
> prefix.  Routers wouldn't have any path to it, so they'd drop it...

This is only true if the site trying to stay out of the table was
represented by a /48 or shorter. If not, the ISP filter will simply drop
the longer advertisements and the part of the enterprise that didn't
want to be globally accessable would suddenly find that they were
reachable. 

> 
> Also, I am under the impression that ISPs do some filtering 
> at the customer bounday -- only allowing traffic from a 
> customers' global

Not as common as it needs to be (see nanog discussion today on this
topic), but even if it did happen everywhere, it does not mean that
parts of a /48 can be globally routed while other parts are not.

Tony

---

From: Mark Smith <[email-masked]>
Date: 31 Oct 2002 11:04:25 +1100

Thanks Tony, Margaret.

On Thu, 2002-10-31 at 10:19, Margaret Wasserman wrote:
> Adjacent, with the border running through the router.
> 

If this is the case, as a customer of a provider who wants to own and
configure my own router, I'm individually responsible for ensuring my
site local traffic doesn't leak into my provider's site local network,
and vice versa. While my security is certainly my primary concern,
surely my provider is not going to trust me to hold their internal site
local security as a primary concern as well ? Its likely that don't even
want me to see their site local routes at all.

Also, Tony suggested that if I stuffed up my site local filtering, both
myself and my provider would have to make an error with our IGP
configuration for our sites to be joined. However, if the site boundary
falls across a single router, then only one party has to make an EGP /
IGP route distribution configuration error, and in my above example that
could be me. I don't think my provider is going to like (and accept) 
that at all.

> Also, all interfaces are considered to be in exactly one scope of
> each zone, so all interface are in exactly one site.
> 
I'm guessing you mean an interface can only be in only one site at a
time, but not necessarily all members of the same site.

Thanks,
Mark.

---

From: Margaret Wasserman <[email-masked]>
Date: Wed, 30 Oct 2002 18:19:48 -0500

Margaret

---

From: Brian Haberman <[email-masked]>
Date: Wed, 30 Oct 2002 21:13:37 -0500

> conclusion. Maybe Ole does. 

The following is a proposal that was discussed amongst the
scoped addr arch authors and the ADs.  This model would address
the issue of having adjacent sites quite nicely.

                            --             --
                         --|  |-----------|  |--
                            --             --

                 <--site 1--> <-dummy site-> <-- site 2 -->

Brian

---

From: Mark Smith <[email-masked]>
Date: 31 Oct 2002 13:52:30 +1100

> the issue of having adjacent sites quite nicely.

Thanks Brian, that make sense, and clears up my concerns about a single router being the site-local security device for both the provider and the customer.

Sorry if I'm asking dumb questions, I'm just thinking about how I might
use site local addressing if I was to build an Australia wide IPv6 based
enterprise network, interconnecting the main capital cities.

As an example, I can see three different ways I could site-local address
the 8 capital cities we have down here (for those who may not be aware,
we have something like at least 500 kilometers between capital cities
down here) :

* site-local boundary at the edge of each city. wan links between cities
would be treated as dummy sites as per your example above.

* delete the dummy sites in the previous model, and extend the
site-local boundary of one of the main sites out to the edge of all the
other sites eg the Sydney site local addressing would finish at the edge
of the Melbourne, Adelaide etc site local boundary

* with 54 bits of subnet address space available in the site-local
fec0::/10 address space, it would be very tempting to just treat the
whole of Australia as one big site, and avoid site boundary routing
configuration issues completely. 

Obviously my last two models don't really fit the idea that site-local
addressing is to cover a single geographical site.

Are there any documents / drafts / email threads that discuss various
possible site local addressing / boundary models I can have a read of ?

Thanks,
Mark.

---

From: Brian Haberman <[email-masked]>
Date: Thu, 31 Oct 2002 08:28:12 -0500

> possible site local addressing / boundary models I can have a read of ?

In your scenario, I would seriously consider Tony's proposal that
site borders be the same as IGP/EGP boundaries.  You could very easily
run each capital city as an IGP/site and interconnect them via BGP.
The BGP connectivity would be the "dummy site" described above.

Brian