Subject: Re: Fwd: New Version Notification for draft-ietf-v6ops-v6inixp-02

From: Martin Pels <[email-masked]>
Date: Thu, 1 Oct 2009 13:53:23 +0200

Hi,

On Tue, 8 Sep 2009 23:25:37 -0300
Roque Gagliano <[email-masked]> wrote:

> Hi,
> 
> I issued a new ID of the draft with the changes that came up at the  
> Stockholm meeting. Changes were:
> - I explained why ULA is not a good idea.
> - I added that addressing can use two different /48, one for the
> LANs and the second one for the internal services and not necessarily
> one / 47, as comments at the meeting.

In section 3 you added the following: "IPv6 prefixes for IXP LAN's are
typically publicly well known.".

I suggest changing this to something like: "IPv6 prefixes for IXP LANs
are typically taken from dedicated IPv6 blocks for IXP assignments,
reserved for this purpose by the different RIRs."

Kind regards,
Martin

---

From: MAWATARI Masataka <[email-masked]>
Date: Fri, 02 Oct 2009 18:02:44 +0900

Hi all,

* On Thu, 1 Oct 2009 13:53:23 +0200

> reserved for this purpose by the different RIRs."

Thanks for your effort about IPv6 IXP operation.

If modifying as above, add notions that IXP can select PI address policy
either routed or un-routed in the global table.

(routed)
   pros
   - AS boundry monitoring IXP segment is possible.
   cons
   - Attacking IXP segment from non IXP participants is possible.

(un-routed)
   pros
   - Attacking IXP segment from non IXP participants is impossible.
   cons
   - AS boundry monitoring IXP segment is impossible.

Are there any other pros/cons?

Regards,
Masataka MAWATARI

---

From: Roque Gagliano <[email-masked]>
Date: Mon, 5 Oct 2009 12:07:50 +0100

Dear Martin/ Masataka,

I am proposing the following text for version 03.

----------------
    IPv6 prefixes for IXP LANs are typically publicly well known and
    taken from dedicated IPv6 blocks for IXP assignments reserved for
    this purpose by the different RIRs.The current practice that applies
    to IPv4 about publishing IXP allocations to the DFZ (Default Free
    Zone) should also apply to the IPv6 allocation.  When considering  
the
    routing of the IXP LANs two options are identified:

    o  IXPs may decide that LANs should not to be globally routed in
       order to limit the possible origins of a Distributed Denial of
       Service (DDoS) attack to its particpant' AS boundries.  In this
       configuration participants may route these prefixes inside their
       networks (e. g. using BGP no-export communities or routing the  
IXP
       LANs within the participants' IGP) to perform fault management.
       Using this configuration, the monitoring of the IXP LANs from
       outside of its participants' AS boundaries is not possible.

    o  IXP may decide that LAN should be globally routed.  In this case,
       IXP LANs monitoring from outside its participants' AS boundries  
is
       possible but the IXP LANs will be vulnerable to DDoS from  
outside of
       those boundaries.

    IXP external services (such as dns, web pages, ftp servers) need to
    be globally routed and due to strict prefix length filtering this
    could be the reason to request more than one /48 assignment from a
    RIR (i.e. requesting one /48 for the IXPs LANs that is not globally
    routed and a different /48 for the IXP external services that is
    globally routed).
---------------------

What do you think?

Roque

> Are there any other pros/cons?

-------------------------------------------------------------
Roque Gagliano
LACNIC
[email-masked]
GPG Fingerprint: E929 06F4 D8CD 2AD8 9365  DB72 9E4F 964A 01E9 6CEE

---

From: ALAIN AINA <[email-masked]>
Date: Tue, 6 Oct 2009 00:40:21 +0000

On Sep 9, 2009, at 2:25 AM, Roque Gagliano wrote:

> LANs and the second one for the internal services and not  
> necessarily one /47, as comments at the meeting.
> - I included comments from Nick Hilliar about BGP sessions.
> - I added text about having different participants in different  
> solocited-node multicast group.
> - I mention of RA-Guard based on comments from Nick Hilliar.
>
> I will now request Alain and Bernard to review the doc as they are  
> the WG volunteers.

attached is a .doc version with my comments

hope this helps

--alain

>
> Regards,
>
> Roque.
>
>
>
>
> Begin forwarded message:
>
>> From: IETF I-D Submission Tool <[email-masked]>
>> Date: September 8, 2009 11:00:14 PM GMT-03:00
>> To: [email-masked]
>> Subject: New Version Notification for draft-ietf-v6ops-v6inixp-02
>>
>>
>> A new version of I-D, draft-ietf-v6ops-v6inixp-02.txt has been  
>> successfuly submitted by Roque Gagliano and posted to the IETF  
>> repository.
>>
>> Filename:	 draft-ietf-v6ops-v6inixp
>> Revision:	 02
>> Title:		 IPv6 Deployment in Internet Exchange Points (IXPs)
>> Creation_date:	 2009-09-08
>> WG ID:		 v6ops
>> Number_of_pages: 10
>>
>> Abstract:
>> This document provides a guide for IPv6 deployment in Internet
>> Exchange Points (IXP).  It includes information regarding the switch
>> fabric configuration, the addressing plan and general organizational
>> tasks to be performed.  IXPs are mainly a layer 2 infrastructure and
>> in many case the best recommendations state that the IPv6 data,
>> control and management plane should not be handled differently than
>> in IPv4.
>>
>>
>>
>> The IETF Secretariat.
>>
>

---

From: MAWATARI Masataka <[email-masked]>
Date: Tue, 06 Oct 2009 18:21:38 +0900

Hi Roque,

Thank you very much.

Please excuse the brevity.
Just a few standardizing words.

* On Mon, 5 Oct 2009 12:07:50 +0100

> I am proposing the following text for version 03.
         ^^^^
         IXP

>     o  IXP may decide that LAN should be globally routed.  In this case,
                             ^^^
                             LANs

>     could be the reason to request more than one /48 assignment from a
                                                   ^^^^^^^^^^^^^^
                                                   allocation

>     RIR (i.e. requesting one /48 for the IXPs LANs that is not globally
                                           ^^^^^^^^^
                                           IXP LANs

>     routed and a different /48 for the IXP external services that is
                             ^^^
                             allocation

e.g.
sometimes, /48 (for IXP LANs) and /48 (for external services).
sometimes, /48 (for IXP LANs) and /32 (for external services).
sometimes, something else.

Regards,
Masataka MAWATARI

---

From: Roque Gagliano <[email-masked]>
Date: Wed, 7 Oct 2009 10:16:49 +0100

Dear Masataka,

Thank you for the comments.

> sometimes, something else.

exactly, that is why I was mentioning one example.

Roque.

---

From: Martin Pels <[email-masked]>
Date: Wed, 7 Oct 2009 11:09:02 +0100

Hi,

On Mon, 5 Oct 2009 12:07:50 +0100
Roque Gagliano <[email-masked]> wrote:

> [...] When considering the
>        configuration participants may route these prefixes inside
> their networks (e. g. using BGP no-export communities or routing the  
> IXP
>     o  IXP may decide that LAN should be globally routed.  In this
> case, IXP LANs monitoring from outside its participants' AS
> boundries is

Although I have no problems with the content of this text, we should be
careful to limit this document to options and recommendations for IPv6
deployment in specific.

Since the above options are no different than those for IPv4 I believe
this piece of text does not need to be added.

Kind regards,
Martin

---

From: Roque Gagliano <[email-masked]>
Date: Fri, 23 Oct 2009 11:40:51 -0200

alain,

Thanks for your reviews.

I will correct all the typos that you pointed out.

Also, refering to your comment on the last paragraph of section 3 I am  
introducing the text that we discussed in the list:

- ---------
IPv6 prefixes for IXP LANs are typically publicly well known and taken  
from dedicated IPv6 blocks for IXP assignments reserved for this  
purpose by the different RIRs.The current practice that applies to  
IPv4 about publishing IXP allocations to the DFZ (Default Free Zone)  
should also apply to the IPv6 allocation. When considering the routing  
of the IXP LANs two options are identified:
	
	- IXPs may decide that LANs should not to be globally routed in order  
to limit the possible origins of a Distributed Denial of Service  
(DDoS) attack to its particpant's AS boundries. In this configuration  
participants may route these prefixes inside their networks (e. g.  
using BGP no-export communities or routing the IXP LANs within the  
participants&apos; IGP) to perform fault management. Using this  
configuration, the monitoring of the IXP LANs from outside of its  
participants&apos; AS boundaries is not possible.
	- IXP may decide that LANs should be globally routed. In this case,  
IXP LANs monitoring from outside its participants&apos; AS boundaries  
is possible but the IXP LANs  will be vulnerable to DDoS from outside  
of those broundries.
	
IXP external services (such as dns, web pages, ftp servers) need to be  
globally routed. Strict prefix length filtering could be the reason  
for requesting more than one /48 assignment from a RIR (i.e.  
requesting one /48 assignment for the IXPs LANs that may not be  
globally routed and a different /48 assignment for the IXP external  
services that will be globally routed).
- ---------

Regards,
Roque

On Oct 5, 2009, at 10:40 PM, ALAIN AINA wrote:

> <aina-review-of-draft-ietf-v6ops-v6inixp-02.doc>
>
>>
>> Regards,
>>
>> Roque.
>>
>>
>>
>>
>> Begin forwarded message:
>>

- -------------------------------------------------------------
Roque Gagliano
LACNIC
[email-masked]
GPG Fingerprint: E929 06F4 D8CD 2AD8 9365  DB72 9E4F 964A 01E9 6CEE

---

From: Roque Gagliano <[email-masked]>
Date: Fri, 23 Oct 2009 13:30:38 -0200

Dear WG.

I just issued version 03 that includes all the comments from Alain,  
Bernard, Martin, Fernando and Mawatari.

Changes:

- typos and editorial changes found by reviewers.
- changes in section 3, addressing plan as discussed in the list.

I look forward to hear your comments,

Roque.

A new version of I-D, draft-ietf-v6ops-v6inixp-03.txt has been  
successfuly submitted by Roque Gagliano and posted to the IETF  
repository.

Filename:	 draft-ietf-v6ops-v6inixp
Revision:	 03
Title:		 IPv6 Deployment in Internet Exchange Points (IXPs)
Creation_date:	 2009-10-23
WG ID:		 v6ops
Number_of_pages: 11

Abstract:
This document provides guidance on IPv6 deployment in Internet
Exchange Points (IXP).  It includes information regarding the switch
fabric configuration, the addressing plan and general organizational
tasks that need to be performed.  IXPs are mainly a layer 2
infrastructure and in many cases the best recommendations suggest
that the IPv6 data, control and management plane should not be
handled differently than in IPv4.

The IETF Secretariat.