Subject: (ngtrans) ISATAP-04 comments/questions

From: Jason Goldschmidt <[email-masked]>
Date: Wed, 12 Jun 2002 16:52:10 -0700 (PDT)

Hello all,

I have some comments pertaining to the most recent revision of the ISATAP draft 
(version 4).  These comments and questions come from my perspective as an ISATAP 
implementor.

In Section 5.2.1, the authors discuss initialization and updating of the PRL by 
ISATAP nodes.  As an implementor, it is not clear how an ISATAP node is to know 
what naming convention used by the site administrator for the ISATAP routers. 
Site administrators might be "encouraged" to use "isatap.domainname", though if 
they choose something different how should this information be conveyed to 
ISATAP nodes?  It appears that manual configuration should always win out, but 
what lookups, by ISATAP nodes, should be attempted when no other configuration 
is provided?

I wonder if an alternative method, then the one proposed in Section 5.2.1, is to 
make use of IPv4 anycast to find an ISATAP router (similar to 6to4 Relay Router 
discovery)?  Has this already been discussed?

In Section 8, it concerns me that the authors do not talk about efforts to 
secure the PRL or, even point out, that if the PRL is compromised, many 
different attacks are possible.  It seems an analogy can be made between a rouge 
DHCP server being deployed on a network and a compromised PRL being propagated 
to an ISATAP node.  This same section states that the PRL provides the policy 
for trusting Router Advertisements.  I don't believe this policy can be 
implemented if PRL itself can't be trusted (or rather, there is no model 
presented in this draft for trusting the mechanism used for PRL initialization).

Have the authors thought about possible issues that might arise if both ISATAP 
and 6to4 are used in the same network or even the same router?  It appears that 
the security considerations, mentioned in Section 8, might prevent the use of 
6to4 in the same network as ISATAP.  It doesn't seem improbable that an ISATAP 
router might make use of 6to4 for its IPv6 connectivity.

Thanks,

-Jason

**********************************
Jason Goldschmidt                *
Sun Microsystems		 *
SNT Engineer: IPv6 Project Team  *
(650)-786-3502                   *
[email-masked]             *
**********************************

---

From: "Fred L. Templin" <[email-masked]>
Date: Wed, 12 Jun 2002 17:50:07 -0700

Hello Jason,

>what lookups, by ISATAP nodes, should be attempted when no other configuration 
ISATAP nodes are expected to lookup the name "isatap.domainname" when
no other configuration information is provided (assuming the node configures
a DNS resolver). 

>discovery)?  Has this already been discussed?
This has been discussed at length over the past several IETF meetings. The
NGTRANS meeting minutes give a good synopsis of the discussions.

>presented in this draft for trusting the mechanism used for PRL initialization).

This issue seems to be one and the same as that of being able to trust 
the DNS
service within the managed/enterprise network in the general sense. That is,
nodes implicitly trust resource records they receive from their site's DNS
service even though this trust could potentally be compromised by "insider"
attacks. Do you feel that we need to say anything more or less about this
implicit trust in the case of ISATAP?

>router might make use of 6to4 for its IPv6 connectivity.
We expect ISATAP routers to have at least one link with (non-ISATAP)
IPv6 connectivity, be it a native IPv6 link or something like 6to4. One
might in fact expect ISATAP and 6to4 coexistence in the same router to
be a relatively common case. Can you be more specific as to how you
feel this might be prevented?

Regards,

Fred Templin
[email-masked]

P.S. Please note my new e-mail address above...

---

From: Alain Durand <[email-masked]>
Date: Wed, 12 Jun 2002 21:50:48 -0700

> no other configuration information is provided (assuming the node 

How do you know that the information about 'domainame' that may
have been configured in the stub resolver is really the name of the 
domain you
are physically attached to?

Example: in my laptop, I have domainname that is always configured to my 
home domain,
even when I'm at SUN or at IETF.
Does this mean that when I'm at IETF, my laptop will try connect to my 
home ISATAP router?

	- Alain.

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 13 Jun 2002 17:30:11 -0700

> Does this mean that when I'm at IETF, my laptop will try

Not unless it can resolve the address. Even if it can resolve it, ISATAP
is not a first choice prefix, so using that prefix should only happen
when you are talking to another SUN ISATAP node. If your ISATAP router
were half-way intellegent, it would not allow use of embedded IPv4
addresses that are not routed within the SUN network, and any reasonable
site border router should block ISATAP as a source since this is defined
as an INTRA-SITE protocol.

Tony

---

From: "Fred L. Templin" <[email-masked]>
Date: Thu, 13 Jun 2002 17:51:45 -0700

> Example: in my laptop, I have domainname that is always configured to 
> my home domain,

I don't think so. Isn't it true that, when at IETF, the DNS configuration
info you get through DHCP will override the static configuration relative
to your home network? I think this would cause your laptop to resolve the
name within the visited domain - unless I'm missing something?

Fred
[email-masked]

---

From: [email-masked]
Date: Fri, 14 Jun 2002 09:56:23 +0900

>name within the visited domain - unless I'm missing something?

	not everyone let DHCP client overwrite the search list.
	in fact, I never let DHCP client overwrite the search list.
	I would always like to reach "foo.itojun.org" when I type "ping foo".

itojun

---

From: Randy Bush <[email-masked]>
Date: Thu, 13 Jun 2002 17:56:49 -0700

> name within the visited domain - unless I'm missing something?

what you're missing is http://ops.ietf.org/dns/dynupd/secure-ddns-howto.html

randy