Subject: RE: Node Requirements Issue 3

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Thu, 24 Oct 2002 22:57:00 +0200

> 
  > I think that we should keep site-local addresses in the
  > addressing architecture, but limit their use to non-globally-
  > connected IPv6 networks.
  > 

=> Agreed. Another useful use is that long lived
connections within a site can survive renumbering. 

Hesham
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Bound, Jim" <[email-masked]>
Date: Fri, 25 Oct 2002 14:18:11 -0400

Brian,

This would be like real valuable to hear real ops/implementation
experience.

/jim

> -----Original Message-----
> From: Brian Haberman [mailto:[email-masked]] 
> Sent: Thursday, October 24, 2002 3:18 PM
> To: Roy Brabson
> Cc: Richard Draves; [email-masked]; Keith Moore; 
> Margaret Wasserman
> Subject: Re: Node Requirements Issue 3
> 
> 
> Hi Roy,
> 
> Roy Brabson wrote:
> >>This is craziness. We (I don't mean just MS) have shipping 
> >>implementations that support site-locals. We have operational 
> >>deployments using site-locals. We have applications that work just 
> >>fine with site-locals.
> > 
> > 
> > Could you (or someone else who has this working) publish an ID which
> > describes how site-locals work?  I've seen many postings on various 
> > aspects of site-locals which do not work as currently 
> defined, from DNS to 
> > routing to applications using site-locals in referrals.  
> There have been 
> > some proposals on how to address some of these issues, such 
> as updates to 
> > dynamic routing protocols, but others (like DNS) don't seem 
> to have any 
> > agreed upon solutions in multi-sited configurations and, 
> arguably in the 
> > case of DNS, single-sited configurations.  Without 
> standards, or at least 
> > standards-track IDs, its hard to see how site-locals can be 
> viewed as 
> > useful beyond a single-site configuration, with anything 
> beyond that being 
> > experimental and/or proprietary.
> 
> I have been meaning to write a draft on what I had to do to 
> routing and forwarding in order to get site-border 
> functionality.  But, I don't think that would address the 
> bigger issues that have been discussed. The routing and 
> forwarding is complex, but it doesn't compare to some of the 
> other issues.
> 
> If anyone wants to hear about what it took to get RIPng to do 
> site border functionality, let me know and I will put 
> something together.
> 
> Brian
>

---

From: "Bound, Jim" <[email-masked]>
Date: Sat, 26 Oct 2002 12:58:41 -0400

> > But in routing code I would as
> > implementor check if a site came in at me and if globally connected
> > drop the packet and not let thru default route.
>
> This would be relatively easy to do, I suppose

Yes but I believe we need this in products quickly if we support
Margarets rule which I do and can it be done as download rule upgrade to
existing routers or will it have to be put in slow path.

>
> But note that there is (currently) more than that:
> site-border routers
> must also check source addresses of packets and drop them.  
> This may get
> difficult as you have to have a way of configuring the fact
> that this is
> indeed a site border.  This can't really be solved by adding a route..

It is a compare and XOR operation on the address at the ingress point.
If we apply Margarets rule-set which I support a site border router
would only be dealing with site locals if it had no connectivity to
non-site communications. So I don't see that problem per compliance. But
to prevent errors the site routers could do the fix I state above as
easily as ingress/egress border routers to a site from a public or
private ISP.

>
> (Note I meant site/global border with site border above, not two
> different sites)

This is a good point to question. My read of Margarets rule is that the
border router would not be configured to see a site on any interface?
The only reason to do what I say above is insurance for the network
operations community in the product implementation.

/jim

---

From: "Bound, Jim" <[email-masked]>
Date: Mon, 28 Oct 2002 12:38:11 -0500

I agree Keith but just want a logic check for my own sanity. I am with
you on all mail.
Just want to check.  I think they are far more trouble than any benefit
I can see for users and I fear greatly it causing a NAT problem which is
just not good.

/jim
[Have you ever seen the rain coming down on a sunny day]

> From: Keith Moore [mailto:[email-masked]] 
> Sent: Monday, October 28, 2002 12:25 PM
> To: Bound, Jim
> Cc: Keith Moore; Pekka Savola; Margaret Wasserman; Richard 
> Draves; [email-masked]
> > Richard has stated he has implemented this and has customers.  Lets 
> > here him out.
> 
> by all means, if there are good reasons to impose this 
> considerable burden on applications, let's hear them.  
> 
> of course, just because there are implementations of SL and 
> that customers 
> have bought those implementations doesn't mean that 
> widespread use of SLs 
> is something that IETF should endorse.
> 
> Keith
>

---

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Fri, 1 Nov 2002 01:09:22 +0100

> > => Why is it gone ? Not everyone wants NATs and for those who
  > > do, deprecating SL addresses will not help. It will just make
  > > their (Network admins) behaviour less predictable.
  > 
  > Maybe, but from a operator point of view, the advantage of 
  > being early 
  > on IPv6 is to enable your users to do peer-to-peer 
  > services. There are 
  > no new services I can launch just because I give out IPv6 
  > address, on 
  > the contrary. There is most likely a higher cost involved.

=> I don't disagree with that, but I don't 
see the relevance to my statement.

  > > => Yes there is. The address size itself allows to do things
  > > that you can't do with v4. Check out the SEND WG for example
  > > or MIPv6, or address autoconf....
  > 
  > This are all services / functions I could do in IPv4 as 
  > well. Perhaps 
  > not with the IPv4 address header though.

=> I'll be very interested in seeing a proposal on 
secure ARP, MIPv4 RO or the final Zeroconf solution
for IPv4 autoconf....

  > > If you choose to use SL with globally routable addresses
  > > in the same network, you can get P2P.
  > 
  > If I have globally routeable addresses in the first place 
  > to identify 
  > my network devices, why would I want SL? 

=> If you don't want it, don't use it. No one is 
suggesting that every site must use them.

If you give people 
  > a tool - 
  > they will use it, and eventually someone will hurt 
  > themselves with it.

=> I don't think so. People will do what they want 
with whatever addresses they invent. Network admins
are not kids. They are convinced  that (in some cases)
they need certain features. They will get there one 
way or another. You might disagree with their reasons
or arguments, but there is no decision we take here 
that will change their minds immediately.

  > I am not resisting facts. I am trying to argue that we should learn 
  > from mistakes. There are people who are using RFC1918 space 
  > today and 
  > are happy with it. There also a number of large 
  > organizations that have 
  > it and are very limited by it. I don't want us to give out 
  > tools with 
  > instructions for people with warnings on them. If they are 
  > dangerous we 
  > should not give them out at all.

=> Anything can be used in a dangerous way if people 
don't know what they're doing. So it is best to
inform people, instead of giving them meaningless
(to them) restrictions.

  > 
  > I have still to see an argument as to what there is with SLs that I 
  > can't do with globaladdresses?

=> Well, if after reading all the mails you still
think so, don't expect one from me :)

Hesham

---

From: [email-masked]
Date: Fri, 1 Nov 2002 06:27:00 +0200

Hi Margaret,

>          - Transport Protocols (particularly the voice/session stuff)

I think Randy Stewart has some draft out on IPv6 and SCTP, which talks
about some scoping that SCTP needs, due to the support of multiple
addresses.  I think it is 'IPv6 and SCTP' - that might be a useful
read for this topic.

John