Subject: RE: 6to4 and 2002:PRIV:ATE [RE: A use for site local addresses?]

From: "Michel Py" <[email-masked]>
Date: Thu, 27 Mar 2003 09:09:45 -0800

>> Michel Py wrote:
>> Well, yes but these nodes are only routers. Hosts MUST NOT
>> have any 6to4 pseudo-interfaces (or have it deactivated).

> Pekka Savola wrote:
> There is no such statement anywhere that I know of. Please
> correct me if I'm wrong.  Hosts indeed have 6to4 pseudo-interfaces.

> Brian Carpenter wrote:
> I'm confused. When one is inside the border at which an RFC
> 3056 router is placed, 6to4 addresses are exactly like any
> other native IPv6 address. No host inside that border should
> have a 6to4 pseudo-interface.

Exactly. So the requirements for a site to use 2002:0A00::/24 as a
"private" address are no different than those for 6to4 site to use the
border router's v4 address as the 6to4 address. In other words, a site
that would want to use 2002:0A00::/24 as a private addressing scheme is
just like any regular 6to4 site except that it does not have the 6to4
gateway.

>> No host inside that border should have a 6to4
>> pseudo-interface.

> But in reality, they do.  Some implementations even
> enable it automatically.

Again, this is my very point: using 2002:0A00::/24 as a "private"
address will _enforce_ the need to disable these interfaces (because if
they're enabled they blackhole the traffic and nothing works), which is
a feature not a bug for a private network.

Michel.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Christian Huitema" <[email-masked]>
Date: Thu, 27 Mar 2003 09:11:15 -0800

> > You're making an assumption that all nodes implementing 6to4
> > pseudo-intefarce take part in the IGP to get the more specific
> > 2002:FOO routes,
> 
> Well, yes but these nodes are only routers. Hosts MUST NOT have any
6to4
> pseudo-interfaces (or have it deactivated).

Making rules as we speak, uh? At most, you are saying that a node that
has a 6to4 interface should be called a router. Fine. What have you
achieved? You only get control if you can convince a specific node to
not activate a particular function, i.e. if you had control over the
node in the first place.

It is reasonable to expect nodes who receive an RA for 2002:F00::, or
for that matter 2002:DEAD:BEEF::, to route packets bound to that
specific prefix towards the interface over which they received the RA.
But it is also not unreasonable to expect nodes to drop packets bound to
illegal 2002:: addresses, and possibly ignore advertisements of illegal
prefixes.

-- Christian Huitema

---

From: "Michel Py" <[email-masked]>
Date: Thu, 27 Mar 2003 09:13:03 -0800

> Christian Huitema wrote:
> Making rules as we speak, uh? 

Nope, see Brian's post. Nothing new in this.

Michel.

---

From: "Michel Py" <[email-masked]>
Date: Thu, 27 Mar 2003 12:13:30 -0800

> Ole Troan wrote:
> a host connected to a native link should not
> automatically enable a 6to4 pseudo interface.

Agree, and especially not if this native link RAses a prefix within
2002::/16.

> Brian Carpenter wrote:
> Some hosts can support such a pseudo-interface, but having
> it on by default is a problem IMHO.
> RFC 3056 mainly talks about routers and strongly implies
> what Michel says, but that MUST NOT is not in any RFC.

It should be, but is implied anyway because that's the only way it can
work.

Example: My IPv4 prefix is x.y.z.0/24
I have four subnets:
- x.y.z.0/26
- x.y.z.64/26
- x.y.z.128/26
- x.y.z.192/26

My router is x.y.z.1 and x.y.z.65 and x.y.z.129 and x.y.z.193
host1 is x.y.z.66
host2 is x.y.z.67

I migrate to IPv6 using 6to4. I decide that my IPv6 prefix is
2002:xxyy:zz01::/48. Makes sense as the router is going to be the 6to4
gateway for the site.

I will dual-stack. My subnets now are:

                 Routing prefix|Site|IID
                               |topo|
- x.y.z.0/26     2002:xxyy:zz01:0000::/64
- x.y.z.64/26    2002:xxyy:zz01:0001::/64
- x.y.z.128/26   2002:xxyy:zz01:0002::/64
- x.y.z.192/26   2002:xxyy:zz01:0003::/64
                               |    |

My hosts IPv6 addresses should be:

       Routing prefix|Site|IID
                     |topo|
host1: 2002:xxyy:zz01:0001:HST1:I:I:D/64
host2: 2002:xxyy:zz01:0001:HST2:I:I:D/64
                     |    |

However, if there is a 6to4 interface enabled on the hosts, it breaks
thinks as the hosts might decide to use:

       Routing prefix|Site|IID
                     |topo|
host1: 2002:xxyy:zz66:????:HST1:I:I:D/64
host2: 2002:xxyy:zz67:????:HST2:I:I:D/64
                   ^^|    |
                   ||
                   ??

Not only this is not what I want but it does break things as these two
hosts are not even in the same IPv6 logical subnet with the 6to4 address
they pick. If these two hosts need to talk together they need to transit
by the router, no good.

In other words: the fact that the RFC does not mention that hosts must
not have a 6to4 pseudo-interface enabled if the link has a native prefix
including those within 2002::/16 does not change the reality that 6to4
interfaces on hosts break things so using them is not an option unless
there is only one host per site.

Michel.