Subject: Re: [dhcwg] MTU option for DHCPv6?

From: "Templin, Fred L" <[email-masked]>
Date: Tue, 9 Aug 2016 17:53:27 +0000

Hi,

More on this thread from a couple of weeks ago:

Ø  As for security, basic DHCPv6 doesn't usually provide security either. And if the link is wireless, I would hope it does encryption already?

Here, I was referring to DHCPv6 authentication either using the “old method” in
RFC3315 or the “new method” in ‘draft-ietf-dhc-sedhcpv6’.

DHCPv6 authentication may be necessary on links that do not support link-layer
and/or physical security and even for secured links DHCPv6 authentication may
still be necessary to defeat “insider attacks”.

Thanks – Fred
[email-masked]

From: Lorenzo Colitti [mailto:[email-masked]]
Sent: Thursday, July 28, 2016 8:30 AM
To: Templin, Fred L <[email-masked]>
Cc: Bernie Volz (volz) <[email-masked]>; [email-masked]; Ian Farrer <[email-masked]>; <[email-masked]> <[email-masked]>
Subject: Re: [dhcwg] MTU option for DHCPv6?

On Fri, Jul 29, 2016 at 12:10 AM, Templin, Fred L <[email-masked]<mailto:[email-masked]>> wrote:

RA doesn’t provide nearly the same configuration flexibility as DHCPv6. RA also

doesn’t have Rebind/Renew/Release messags that can be used to manage

mobiole devices. And, RA also does not have DHCPv6 Security.

What does this link look like? Is it a point-to-point link? If so, then RAs are equivalent to DHCPv6 because they are effectively unicasted to a single client. As for security, basic DHCPv6 doesn't usually provide security either. And if the link is wireless, I would hope it does encryption already?

Finally, RA does not have the back-end database management capabilities that are built into common public domain DHCPv6 implementations.
It's perfectly possible to do this with RAs. The Framed-IPv6-prefix option was defined in 2001. When I looked at it as far back as 2010, common implementations (e.g., Juniper) were perfectly capable of create dynamic VLANs and configure RA parameters based on radius attributes.