Subject: RE: (ngtrans) Last call on draft-ietf-ngtrans-dns-ops-req-02.txt

From: "Michel Py" <[email-masked]>
Date: Sat, 20 Oct 2001 10:09:15 -0700

Pekka,

>> If domain.com has only IPv4-only nameservers, that gives IMO a very
strong
>> implication that there are no IPv6-only subdomains.  IPv4/IPv6
dualstacks
>> sure, but IPv6-only no.  A site couldn't possibly be serious about
IPv6
>> (that is, lots of IPv6-only subdomains) if it's own zone is not
>> IPv6-reachable.

I have to disagree with this. A good example would be my own domain:
arneill-py.sacramento.ca.us. Maybe I want to create
ipv6only.arneill-py.sacramento.ca.us. If I have to wait for people that
resolve .us, .ca.us and .sacramento.ca.us to dual-stack, it might be a
while.

Michel.

---

From: Pekka Savola <[email-masked]>
Date: Sat, 20 Oct 2001 20:12:16 +0300 (EEST)

> resolve .us, .ca.us and .sacramento.ca.us to dual-stack, it might be a

A valid scenario, true.  Getting IPv6 enabled on all those three might 
indeed take a while.

Dual-stacked DNS server save the day... :-)

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Randy Bush <[email-masked]>
Date: Sat, 20 Oct 2001 10:20:58 -0700

the task of this wg is to develop strategies and techniques for
transitioning from a pure v4 internet to a mostly v6 internet over
a period of a long time, i.e. a decade or N.  in the solution
space, it is not reasonable for there to be one or more partitions
where internet hostsand running v4 can not locate and reach
internet hosts running v6 or vice versa.

randy

---

From: Pekka Savola <[email-masked]>
Date: Sun, 21 Oct 2001 15:44:23 +0300 (EEST)

> internet hosts running v6 or vice versa.

Ok.

But the questions (that haven't been answered properly, or asked for that
matter) are, "does this have to be done now?" and "do we know _yet_ that
this approach is the best one in the long run?").

Again, I'd say "no".  For the next very many years (unless something
unexpected happends) we'd be able to manage just fine with dual-stack.

Some additional methods will probably be necessary when the IPv6 usage
nears the majority of the Internet use (and consequently IPv4 sites are
clouds in the Ipv6 Internet), but until then I'm not sure if it is worth
designing complex systems to handle certain issues when they could be
worked around by good design.  Just as ngtrans isn't worrying about "4to6"
or similar scenarios (at least yet) either.

---

From: Randy Bush <[email-masked]>
Date: Sun, 21 Oct 2001 08:29:35 -0700

> this approach is the best one in the long run?").

this is not an 'approach', i.e. solution, tool, ...  it is a requirement.

> unexpected happends) we'd be able to manage just fine with dual-stack.

mandating a dual-stack on all v6-capable hosts might be an approach.  but
i suspect it will not be acceptable in some application/vendor domains.

randy

---

From: Pekka Savola <[email-masked]>
Date: Sun, 21 Oct 2001 18:48:06 +0300 (EEST)

> this is not an 'approach', i.e. solution, tool, ...  it is a requirement.

There seem to be some hints for a certain approach in itself, for example:

--8<--
   The IPv6 resolver MUST have a way to discover the bridging systems.
   This discovery mechanism MUST also have good scaling properties.
--8<--

This seems to require that every IPv6 resolving node must be able to do
the discovery; the discovery cannot be "delegated" to certain (type-of, 
possibly) servers.

Using the word "discover" hints at non-manual configuration (e.g.  
anycast).

--8<--
7. Security considerations

   Any bridging system, acting as open relay, could be misused to create
   denial of service attacks on external DNS servers.  Some provision
   should be made in the design of those relay to deal with this issue.
--8<--

This is nothing new and can be done today with about any DNS server (e.g. 
request recursion).