Subject: [Softwires] draft-toutain-softwire-point6box-00.txt

From: Laurent Toutain <[email-masked]>
Date: Fri, 27 Jan 2006 14:45:46 +0100

Hi,

I submitted yesterday our draft describing Point6box architecture,  
but I don't see it on
IETF database. Nevertheless you can find the draft on my web page :

http://www.rennes.enst-bretagne.fr/~toutain/draft-toutain-softwire- 
point6box-00.txt

Laurent

_______________________________________________
Softwires mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/softwires

---

From: Bruno STEVANT <[email-masked]>
Date: Mon, 30 Jan 2006 11:39:38 +0100

The draft is now available on the ietf website :
http://www.ietf.org/internet-drafts/draft-toutain-softwire- 
point6box-00.txt

-- 
Bruno STEVANT - Point6

---

From: Pekka Savola <[email-masked]>
Date: Tue, 31 Jan 2006 11:00:01 +0200 (EET)

On Mon, 30 Jan 2006, Bruno STEVANT wrote:
> http://www.ietf.org/internet-drafts/draft-toutain-softwire-point6box-00.txt

Here are my comments on it.

Philosophical:

  - it might be useful to describe (e.g., in an appendix) the most important
    design choices you made; e.g., why L2TP?  would some other mechanism have
    been acceptable as well, or did you require some specific L2TP features?

  - while the approach could be workable, I'm having difficulty seeing practical
    deployment.  I doubt many users want to add (yet another) box to their
    network for the sole purpose of IPv6.  Many users would probably be happy
    by having a host act as a v6 router.  That wouldn't require getting and
    installing a new box that's going to be retired (hopefully) as soon as
    possible in any case, while the prefix could still be stable.

biggest issues
--------------

1) Section 2 already provides rather detailed description of the approach. 
Therefore section 3 is largely overlapping and redundant.  The points that
are made in section 3 should be merged in section 2 and Sect 3 removed.

2) Section 2 should be organized to a couple of subsections, for example:

  - very short overview and service architecture (max 1 page), if the
    overview is even needed.  Watch out for text duplication with
    "Motivations" section!
  - Tunnel set-up and teardown
  - Poin6box router ("CPEv6") configuration
  - propagating information on the LAN, and/or other routers

3) section 5 could possibly be moved to an appendix; it seems irrelevant for
the main spec.

4) Security considerations section is inadequate.  You should analyze 
how/whether the manner in which you use the existing protocols exposes 
you to security issues (for example, you don't seem to have any server 
authentication, I guess someone on the wire could steal the user 
credentials?)

5) how do you discover the point6box v4 address?  you probably assume manual
config, but this should be stated explicitly.

mainly semi-editorial
---------------------
              The IETF and some companies have defined and/or
    developed transitions tools like: 6to4, Tunnel Broker or Teredo, but
    these tools concern either experimented users or do not offer all the
    IPv6 benefits (always-on, machine to machine communications,...) to
    build applications.  Furthermore, some of these solutions may also
    lead to some security threat.

==> this description/"problem statement" is inaccurate.  I'm not sure if one
is even needed right now.  I'd remove and/or reword this.

2.  Technical description

    Technically, the Point6Box can be viewed as an IPv6 router with only
    one Ethernet port plugged into an IPv4 router.  Through this port,
    the Point6Box will establish connectivity to an IPv6 Provider Edge.

==> "one Ethernet port plugged into an IPv4 router" appears to be a loaded
statement.  If the point6box has only one ethernet interface, there can't be
router connected to it, it must be a switch (or router/switch), right?  This
should be described better.

    The tunnel is made over L2TP, which provides three main
    characteristics:
    o  L2TP messages are carried over UDP to offer NAT-traversal
       capabilities,
    o  PPP is used to carry IPv6 frames, so we can rely on built-in
       authentication and configuration mechanisms, and have very easy
       interaction with AAA servers.

==> you should also mention the address/prefix assignment/delegation
mechanisms used.

    The Point6Box removes the L2TP encapsulation and forwards incoming
    IPv6 packets on the link.  Generally SME or Home routers interfaces
    are bridged with an IEEE 802.11 network, so every equipment connected
    to that network will receive Router Advertisements.  IPv6 traffic
    generated by these equipments will be routed through the Point6Box.

==> the assumption about IEEE 802.11 bridging is unacceptable, but I don't
think it's necessary at all -- make this more general.
==> s/routed/forwarded/ ?

    During the initialization part, the Point6Box establishes a PPP
    peering with the PEv6 through the IPv4 Internet.  Parameters required
    for the configuration of the Point6Box are the IPv4 address of this
    PE and a login/password.  The PEv6 replies with a PPP/CHAP challenge
    and the Point6Box authenticates itself.  The PEv6 queries an AAA
    server to validate the user authorization.

==> you describe a PPP session setup, but don't describe (to similar detail)
the L2TP session setup and how PPP session setup relates to the L2TP
session.  It might make sense to have an L2TP paragraph just before this
one.

   o  DNS service: It is used in the traditional way to find the address
       from name and vice-versa.
    o  DNS domain: In this domain the user can register some equipments
       through DNS Dynamic Update.  The default name could be something
       like user-login.provider.net.

==> you don't describe how you delegate/configure these
==> that kind of default naming could have privacy implications.  If the
user doesn't have its own domain or want something special, a
non-identifying name would be better.

    Both ends of the IPv6 tunnel are configured with link-local
    addresses, and global addresses (for administration purposes).

==> link-locals are configured with PPP (I guess?), but what about global
addresses?

    The Point6Box includes a DHCPv6 server to answer the requests inside
    the domain.  The static parameters such as DNS resolver and the DNS
    domain are given to other routers and a pool of /64 prefixes is a
    constructed based on the prefix received from the provider.  An
    internal router will execute the following algorithm, when one of its
    interface gets configured through the Neighbor Discovery (ND)
    [RFC2461] [RFC2462] protocol:
    o  The router sends DHCPv6 requests for a /64 prefix (the interaction
       with ND as explained in [AINA2005] is used to detect loops or dual
       prefixes allocation),
    o  The router waits for answers from the Point6Box containing the
       prefix and other parameters,
    o  The router assigns prefixes to interfaces.  It starts unicast and
       multicast routing and a DHCPv6 relay.  The relay functionality is
       used to allow downstream routers to talk with the DHCPv6 server.

==> this is terribly unclear.  It's not clear what you refer to by "router". 
"given to other routers"?  Do you assume there are other v6 routers at the
home network?  What about DHCPv6 usage by hosts?  What do you mean by "The
router waits for answers from the Point6Box containing the
prefix and other parameters"?  Why can you assume the routers request
exactly /64?

    [ID.delegated]
               "RADIUS Delegated-IPv6-Prefix Attribute".

==> better reference, please

    [RFC4057]  Bound, J., "IPv6 Enterprise Network Scenarios", RFC 4057,
               June 2005.

==> not referred to in the draft, can be removed?  (are there others like
this?)

editorial
---------

    o  LPC sub-protocol may be used to detect when a tunnel is down, for
       instance due to an IPv4 address renumbering

==> s/LPC/LCP/ ? (add ref?)

    The Point6 Provider Edge is connected to the IPv6 backbone.  It
    includes the server part and can be connected to an AAA database to
    allow authorization and monitoring.

==> what is "the server part" ?  I guess you refer to the tunnel server
(concentrator)...

   |          +--------------+ |    DHVPv6              +-----+

==> s/DHVP/DHCP/

    During the initialization part, the Point6Box establishes a PPP
    peering with the PEv6 through the IPv4 Internet.

==> s/peering/session/ ?

4.  Transition

    As stated before, the goal of the Point6Box is not to install IPv6
    services on a new equipment.  The goal of the Point6Box is to
    disappear when full connectivity will be established.

==> the first sentence is poorly worderd, because Point6box is doing exactly
that: installing IPv6 services on new equipment!  You should reword this by
stating this the other way around, for example,

    While Point6box typically results in adding a new equipment to offer
    IPv6 service, it is only intended to be a temporary measure until the
    full connectivity is established.

......

    o  deploy the IPv6 in a private network.  A company specialized in
       digital signages has to install display devices in hotels, shops
       and supermarkets.

==>"signages" ?

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Laurent Toutain <[email-masked]>
Date: Tue, 31 Jan 2006 16:47:05 +0100

>    been acceptable as well, or did you require some specific L2TP  

you're right, but our first goal was not to produce a "standard"  
document, just to describe
what we have done, if the group want us to go further we can go on  
that direction.

Chapter 2 gives some details on our choice. As Alain Baudot stated in  
a previous
message providers will require authentication of users.   
Authentication is also useful
if you want to give the same parameters (eg prefix) when you start  
again a new connection.
As L2TP is a support to PPP, it is very easy to use its authentication.

L2TP has also some nice NAT traversal property since it is on UDP.

Last point, we didn't want to develop new protocols (even if we have  
spent a lot of time
to debug and improve some capabilities). All the things we have  
described relies on
RFC or drafts already published.

>    possible in any case, while the prefix could still be stable.

You are perfectly right, we don't want to create a new kind of box.  
The transition
chapter tries to explain this. The .6box is just an intermediary  
stage where you
want to have IPv6 on your network, but your router cannot manage  
IPv6. The .6box can
be useful to deploy very easily IPv6 on that kind of network.

The next step is to include these functionalities in the access  
router. We can
imagine a scenario where the ISP network is only IPv4, so IPv6 is  
still tunneled
in its network but CPE includes v4 and v6.  The effort done to  
develop the .6box
will not be lost, but include in the "commercial" CPE.

The last step is to provide a dual stack network, in that case L2TP  
disappear,
but we will have learned a lot on AAA management that will be very  
useful at this
time.

>
> biggest issues
> --------------
>
> 1) Section 2 already provides rather detailed description of the  
> approach. Therefore section 3 is largely overlapping and  
> redundant.  The points that

we will work on this, to improve the quality of the document, if the  
group juges
that we have to study this kind of solutions.

>
> 4) Security considerations section is inadequate.  You should  
> analyze how/whether the manner in which you use the existing  
> protocols exposes you to security issues (for example, you don't  
> seem to have any server authentication, I guess someone on the wire  
> could steal the user credentials?)

I think it is the same as PPP, you have a challenge so no password  
are sent on the wire, and
the challenge changes at every connection.

> config, but this should be stated explicitly.

It is said at the end of page 4 : parameters required are IPv4  
address and login/password
We don't think that manual configuration is a main drawback (at least  
if only one PE is
on the network). But we can imagine an IPv4 anycast address for PE in  
the provider
network to go to the closest PE. There is some impact on IPv6 prefix  
stability on that case
so we need to discuss of it on the mailing list.

if you talk of the CPE itself, the address is learned by normal mean  
such as DHCPv4.
The address can be private and NATed.

> mainly semi-editorial

I agree it is a little bit provocative :-)

> should be described better.

You're right, we should have written IPv4 switch/router

> ==> you should also mention the address/prefix assignment/delegation

yes and no, with PPP you can only configure Link Local addresses.

> think it's necessary at all -- make this more general.

I agree

> ==> s/routed/forwarded/ ?

yes

> session.  It might make sense to have an L2TP paragraph just before  

ok

> non-identifying name would be better.

these things have to be discussed by the group.

> ==> link-locals are configured with PPP (I guess?), but what about  

no, we have to use ND

> ==> this is terribly unclear.  It's not clear what you refer to by  
> "router". "given to other routers"?  Do you assume there are other  
> v6 routers at the
> home network?

These parts are, I think, out of the scope of Softwires, it is  
related to research
work we are doing. We put it here, to show on what kind of direction  
we want
to go (that's one reason we delagate a /60). Yes in our model, we have
other routers in the home network and they are automatically configured
with a /64 prefix derived from the prefix allocated by the provider.

> What about DHCPv6 usage by hosts?

Just for static parameter (DNS resolver, ...)

> What do you mean by "The

One possibility to do automatic prefix allocation is to have a flat  
home network
(without any aggregation). So the CPE receives a /x (x <=64, creates  
a pool
of /64 and allocate them to inside routers using DHCPv6 PD.

> ==> not referred to in the draft, can be removed?  (are there  

Ok

> ==> s/LPC/LCP/ ? (add ref?)

sorry : LCP (Link Control Protocol)

>    peering with the PEv6 through the IPv4 Internet.

ok

>    full connectivity is established.

you're right

>       digital signages has to install display devices in hotels, shops

i've learned also this word :-)
(see for instance http://dss.rell.com/what.asp)