Subject: RE: [netlmm] Issue: Prefix allocation and multihomed MNs (Problem Description Take 2)

From: Thomas Narten <[email-masked]>
Date: Tue, 09 Oct 2007 12:01:24 -0400

> I've tried going through this issue with several developers and everyone
> agress that this problem exists for unmodified IP hosts.  Several people
> have acknowledged that on this list as well (as part of this thread and
> also discussions back in early August).

So, there is consensus that the technical issue is real, and one
consequence is that standards-compliant nodes may fail to work
correctly when the NETLMM protocols are in use?

Sounds like a show-stopper to me. I would expect the IESG to put in a
DISCUSS on this and ask the WG to fix it.

Indeed, I would expect the WG chairs to not waste the IESG's time with
a flaw like this. They should not allow the WG to move the document
forward with such a flaw.

Shame on the WG, if it is not resolving this problem properly.

Thomas

_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 09 Oct 2007 11:04:58 -0700

Hi Thomas,

> Shame on the WG, if it is not resolving this problem properly.

I am not sure if you have seen other emails on this subject. We
have had quite a bit of discussion on this topic. You may also
want to take a look at the following emails.

http://www1.ietf.org/mail-archive/web/netlmm/current/msg03677.html
http://www1.ietf.org/mail-archive/web/netlmm/current/msg03645.html
http://www1.ietf.org/mail-archive/web/netlmm/current/msg03563.html
http://www1.ietf.org/mail-archive/web/netlmm/current/msg03756.html

Of course there have been folks who disagreed with the above emails
too.

Vijay

---

From: "Sri Gundavelli" <[email-masked]>
Date: Tue, 9 Oct 2007 11:45:32 -0700

Hi Thomas,

> -----Original Message-----
> From: Thomas Narten [mailto:[email-masked]] 
> Sent: Tuesday, October 09, 2007 9:01 AM
> To: [email-masked]
> Subject: RE: [netlmm] Issue: Prefix allocation and multihomed 
> MNs (ProblemDescription Take 2)
> 

No. Its not as Black or White.  The way this was presented,
we are breaking the host operation ... internet architectures ..
.etc. etc. This comment is valid. But, there is a whole thread
on this topic and the above paragraph does not reflect that.
 
- When some one brings a multi-homed host and connects to PMIP6
domain, some interfaces may be attached to the PMIP6 domain and
some other interfaces to access network outside the domain. The
host connectivity through outside access network is not touched.
NETLMM protocol has no control on that aspect. Connectivity through
the NETLMM domain is at the mercy of the operator. For the host
to obtain connectivity and seamless mobility, there is a requirement
from the host. It needs to connect through a single interface.

If multiple interfaces attach to the PMIP6 domain simultaneously,
its upto to the policy on the LMA on how to handle this. We are
still saying:

- A prefix is still for a single link. LMA authorizes only one
node for hosting that prefix. 

- A prefix is for a MN-NAI. We do not want to tie the prefix 
to an L2 interface. We want the mobile to retain the ability
to use any of its interface and use an address from that
prefix and on any of its access interfaces, as 3GPP likes to
use it.

What we are discussing is a complex configuration error scenario
and the brief connectivity impact. PMIP6 is for a managed network,
the host has to rely on the network for connectivity. I can take
my laptop in starbucks and get an address on my interface. If
the access router on the path drops all my packets, there is nothing
I can do. I'm at the mercy of that access network. However, my laptop
can connect thru a EVDO card and get access. Same thing is valid
in PMIP6 domain. No difference.

If I establish a IPsec session to my corporate and if it prevents
split tunneling, my connectivity is through one path and if my
corporate drops all the packets, I'm at its mercy. My host cant
even use the other interfaces for connectivity. We are not even
breaking that.

Clearly, we can avoid the transient period of time where two
MAG's are contending for the same prefix, by requiring the
pMAG to deregister first and then allowing the nMAG to host that
prefix. We can do that and still not keep the restrictions on
inter-access handoffs. What we offered is a workaround for
the multi-homing access, till a valid solution is developed, by
giving the operator configuration knobs for eliminating this
race condition and still retaining the core functionality.

Sri

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Tue, 9 Oct 2007 13:33:52 -0700

Hi Thomas,
Indeed, subsequent to the problem description email, there have been a
number of emails on this topic. However, I believe the basic issue isn't
any different - a perfectly compliant IPv6 host connecting via multiple
interfaces to a PMIP domain where the LMA and MAG are perfectly
compliant to the PMIP spec (as currently written) may suffer from
unstable or no IP connectivity.  There doesn't need to be a
configuration error on any side to result in this issue. 

As such, there is no way to ensure that an unmodified IP host knows to
connect no more than one interface to the PMIP domain.  The proposed
solution at the moment is to ensure that an interface specific ID be
presented to the LMA, so that the LMA does not assign the same
prefix/address to more than one interface.  This is not much unlike the
fact that DHCP relies on a unique per-interface ID to assign unique
addresses.  Outside the IETF, if deployments have the flexibility to
modify the end hosts, it is feasible to still have the same prefix
assigned to multiple interfaces, even such that the MN knows to not use
more than one interface at a time. 

At present, some of the discussion is about whether such interface
specific address assignment needs to be mandated or if it can be a
policy decision at the LMA.  As Jari wrote earlier, the problem with the
latter is that there is no means for an MN to know anything about the
policy.  Also, if there is a need to support a mix of modified and
unmodified hosts in a PMIP domain, the policy can be unclear.  Hence,
making it an option is a level of ambiguity that still allows the
problem to occur. 

Also, the prefix per interface model follows, keeping inline with the
IPv6 addressing model where a prefix is specific to a link and with the
agreed NETLMM link model of point-to-point links to avoid multi-link
subnet issues. 

Regards,
Vidya

> From: Sri Gundavelli [mailto:[email-masked]] 
> Sent: Tuesday, October 09, 2007 11:46 AM
> To: 'Thomas Narten'; [email-masked]
> MNs(ProblemDescription Take 2)
> 
> Hi Thomas,
>  
> 
> > Subject: RE: [netlmm] Issue: Prefix allocation and multihomed MNs 
> > (ProblemDescription Take 2)
> > 
> .etc. etc. This comment is valid. But, there is a whole 
> thread on this topic and the above paragraph does not reflect that.
>  
> - When some one brings a multi-homed host and connects to 
> PMIP6 domain, some interfaces may be attached to the PMIP6 
> domain and some other interfaces to access network outside 
> the domain. The host connectivity through outside access 
> network is not touched.
> NETLMM protocol has no control on that aspect. Connectivity 
> through the NETLMM domain is at the mercy of the operator. 
> For the host to obtain connectivity and seamless mobility, 
> there is a requirement from the host. It needs to connect 
> through a single interface.
> 
> If multiple interfaces attach to the PMIP6 domain 
> simultaneously, its upto to the policy on the LMA on how to 
> handle this. We are still saying:
> 
> - A prefix is still for a single link. LMA authorizes only 
> one node for hosting that prefix. 
> 
> prefix and on any of its access interfaces, as 3GPP likes to use it.
> 
> What we are discussing is a complex configuration error 
> scenario and the brief connectivity impact. PMIP6 is for a 
> managed network, the host has to rely on the network for 
> connectivity. I can take my laptop in starbucks and get an 
> address on my interface. If the access router on the path 
> drops all my packets, there is nothing I can do. I'm at the 
> mercy of that access network. However, my laptop can connect 
> thru a EVDO card and get access. Same thing is valid in PMIP6 
> domain. No difference.
> 
> If I establish a IPsec session to my corporate and if it 
> prevents split tunneling, my connectivity is through one path 
> and if my corporate drops all the packets, I'm at its mercy. 
> My host cant even use the other interfaces for connectivity. 
> We are not even breaking that.
> 
> pMAG to deregister first and then allowing the nMAG to host 
> that prefix. We can do that and still not keep the 
> restrictions on inter-access handoffs. What we offered is a 
> workaround for the multi-homing access, till a valid solution 
> is developed, by giving the operator configuration knobs for 
> eliminating this race condition and still retaining the core 
> functionality.
> 
> 
> Sri
> 
> 
> 
> 
> 
> 
> >