Subject: Translation versus tunneling document

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Thu, 06 Dec 2007 17:44:53 -0800

I've talked with Fred after the v6ops WG meeting this afternoon, and I will
work in a document comparing the applicability of existing tunneling
protocols and a possible translation mechanism in different scenarios.

I think this will be useful to determine if we really need the translation
mechanism for all the cases or just for a small subset, making easier the
development of that translation protocol.

I will try to get this done in the next couple of weeks, at least a first
draft. If some other people is interested in working on this, please let me
know.

Regards,
Jordi

**********************************************
The IPv6 Portal: http://www.ipv6tf.org

Bye 6Bone. Hi, IPv6 !
http://www.ipv6day.org

This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Thu, 6 Dec 2007 18:36:11 -0800

> protocols and a possible translation mechanism in different scenarios.

Would it be possible to evaluate deployment issues, i.e., whether said  
mechanism is already available today in hosts, and if it isn't,  
whether it can easily be implemented in a modular way so it can be  
added by others than the OS vendor?

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Fri, 07 Dec 2007 10:47:12 -0800

Good point. Will take care of that as well.

Regards,
Jordi

> De: Iljitsch van Beijnum <[email-masked]>
> Responder a: <[email-masked]>
> Fecha: Thu, 6 Dec 2007 18:36:11 -0800
> Para: <[email-masked]>
> CC: <[email-masked]>
> Asunto: Re: Translation versus tunneling document
> 

Bye 6Bone. Hi, IPv6 !
http://www.ipv6day.org

---

From: "Templin, Fred L" <[email-masked]>
Date: Fri, 7 Dec 2007 11:28:36 -0800

Jordi,

A small comment on the subject line is that it may not be
an exclusive "either/or" for translation vs. tunneling but
rather "both/and". IMHO, translators belong at the edges
of IPv6 only-sites, but those "sites" may be deeply embedded
within dual-stacked sites. Recursively-nested sites within
sites are an attractive deployment scenario for some use
cases, and they are well-supported by ISATAP.

Thanks - Fred
[email-masked]

> -----Original Message-----
> From: JORDI PALET MARTINEZ [mailto:[email-masked]] 
> Sent: Thursday, December 06, 2007 5:45 PM
> To: [email-masked]
> Subject: Translation versus tunneling document
> 
> This electronic message contains information which may be 
> privileged or confidential. The information is intended to be 
> for the use of the individual(s) named above. If you are not 
> the intended recipient be aware that any disclosure, copying, 
> distribution or use of the contents of this information, 
> including attached files, is prohibited.
> 
> 
> 
> 
> 
>

---

From: Fred Baker <[email-masked]>
Date: Sat, 8 Dec 2007 06:58:15 -0800

Do us a favor; talk with Alain about his network to make sure that  
you are solving the problem he is facing.

The big question is whether the double translation he proposes comes  
up with functionally the same thing as the tunneled packet, and what  
the tunnel goes between. The double translation is probably easier to  
maintain operationally than an NxM set of tunnels if it works  
correctly, and avoids the MTU discussion. Frankly, a massively  
tunneled network is a lot like an MPLS network, and in MPLS there are  
a set of tools for managing the network. Be careful what you ask for;  
you might get it.

On Dec 6, 2007, at 5:44 PM, JORDI PALET MARTINEZ wrote:

> privileged or confidential. The information is intended to be for  
> the use of the individual(s) named above. If you are not the  
> intended recipient be aware that any disclosure, copying,  
> distribution or use of the contents of this information, including  
> attached files, is prohibited.
>
>
>

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 09 Dec 2007 08:34:20 +1300

On 2007-12-07 15:36, Iljitsch van Beijnum wrote:
> mechanism is already available today in hosts, and if it isn't, whether 
> it can easily be implemented in a modular way so it can be added by 
> others than the OS vendor?

I think you also have to consider whether there's something to
tunnel *to* - is there a significantly large class of dual stack
services that will be able to make use of tunnels? And don't forget
the third class of solution: application level proxies. Would
you advise the operator of a large IPv4-only web site to
a) dual-stack the whole site
b) install a dual-stack proxy for IPv6 clients
c) install a layer 3 translator for IPv6 clients?

     Brian

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 10 Dec 2007 21:36:00 +0100

On 8 dec 2007, at 20:34, Brian E Carpenter wrote:

>> Would it be possible to evaluate deployment issues, i.e., whether  
>> said mechanism is already available today in hosts, and if it  
>> isn't, whether it can easily be implemented in a modular way so it  
>> can be added by others than the OS vendor?

> c) install a layer 3 translator for IPv6 clients?

As I said in the second session, dual stack isn't an appropriate  
mechanism for client computers. If we had that kind of address space  
we wouldn't have to have this discussion.

Proxies are good but generally don't address UDP applications and are  
ususally a binary thing: either you proxy pretty much everything or  
you don't proxy at all. However, a mechanism where only sessions  
towards destinations using the unsupported IP version are proxied  
would be very useful, and if everyone who isn't dual stack used one,  
referrals wouldn't have to be a problem, either.

A layer 3 translator is basically a more generic implementation of a  
proxy. It has the advantage that it can support more protocols than  
most proxies and possibly v4-v6-v4 operation, which would be nice in a  
situation where you have IPv4-only legacy devices but an IPv6-only  
network.

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 11 Dec 2007 09:55:23 +1300

On 2007-12-11 09:36, Iljitsch van Beijnum wrote:
>>> said mechanism is already available today in hosts, and if it isn't, 
> mechanism for client computers. If we had that kind of address space we 
> wouldn't have to have this discussion.

I agree. That's why my question was about a server site.

> Proxies are good but generally don't address UDP applications 

My question was specifically about a web site.

> and are 
> ususally a binary thing: either you proxy pretty much everything or you 
> don't proxy at all. However, a mechanism where only sessions towards 
> destinations using the unsupported IP version are proxied would be very 
> useful, and if everyone who isn't dual stack used one, referrals 
> wouldn't have to be a problem, either.
> 
> proxy. 

Well, no; it specifically lacks understanding of the application layer.

> It has the advantage that it can support more protocols than most 
> proxies and possibly v4-v6-v4 operation, which would be nice in a 
> situation where you have IPv4-only legacy devices but an IPv6-only network.

Again I'm confused - are you talking about clients or servers? Why would
anyone be operating IPv4-only servers on an IPv6-only network? (They
may be operating IPv4-only applications, but that's where you might
consider BIS or even DSTM.)

     Brian

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 10 Dec 2007 22:01:49 +0100

> My question was specifically about a web site.

Sorry, I didn't read carefully enough.

>> and are ususally a binary thing: either you proxy pretty much  
>> everything or you don't proxy at all. However, a mechanism where  
>> only sessions towards destinations using the unsupported IP version  
>> are proxied would be very useful, and if everyone who isn't dual  
>> stack used one, referrals wouldn't have to be a problem, either.
>> A layer 3 translator is basically a more generic implementation of  
>> a proxy.

> Well, no; it specifically lacks understanding of the application  

Isn't being generic accomplished by lacking understanding of specifics?

---

From: Fred Baker <[email-masked]>
Date: Mon, 10 Dec 2007 15:12:39 -0800

On Dec 8, 2007, at 11:34 AM, Brian E Carpenter wrote:

> services that will be able to make use of tunnels?

since we're talking about a service provider environment (in Alain's  
case), he can ensure that there is one. Alain chairs Softwires, and  
Softwires is standardizing both provider-provisioned capabilities  
based on MPLS and cpe-provisioned capabilities in which the provider  
might include in the same DHCP message that provisions the hold IPv6  
prefix the address of a party to tunnel IPv4 traffic to.

---

From: Brian Dickson <[email-masked]>
Date: Mon, 10 Dec 2007 19:07:12 -0500

> My question was specifically about a web site.
In the specific case of a web site, there are some interesting observations:
- the site operator is likely to care a great deal about reliable 
access, including all the corner cases
- there is likely willingness to support a *small* number of 
methods/tricks/special support, to cover cases that need such support
- the site operator may know more about which access is likely to be 
"better" (for some meaning of "better") than the client

Also note, that the web server software may have access to information 
(on a connection-by-connection basis) about where/how the client 
connects, e.g. special address space, v4 vs v6, etc.

And web servers have extra/special ways of potentially 
identifying/tracking special situations: cookies.

Suppose, for instance, there were a few well-defined cookies which could 
help refine and/or control which choice of access to use, if more than 
one were available.

The presence of a cookie could trigger HTTP redirects to specific (e.g. 
v4 or v6 or tunnel termination addresses) behavior.

Brian Dickson