Subject: Re: [mobile-ip] Re: IPv6 ingress filtering early access

From: Francis Dupont <[email-masked]>
Date: Tue, 08 Jan 2002 12:10:32 +0100

In your previous mail you wrote:

   > => as multi-homing is a place we could want to use home address options
   > this is a real issue...
   
   I've always thought using Home Address option as a way of getting around
   ingress filtering checks in multihoming is like "if words fail you,
   mumble!" -approach.
   
=> I agree if it is only a way of getting around ingress filtering checks
but there are some situations where to have more than one source address
is very fine. And don't forget the degenerate tunneling argument.

   Much more analysis is needed IMO before HAO is to be used outside of MIPv6 
   context.
   
=> yes and to provide an independent and complete definition of HAO should
be very useful too.

Regards

[email-masked]
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Francis Dupont <[email-masked]>
Date: Tue, 08 Jan 2002 11:28:26 +0100

Also, this would get more difficult in the case of multiple, changing
   paths (multihoming).

---

From: Michael Thomas <[email-masked]>
Date: Tue, 8 Jan 2002 08:39:58 -0800 (PST)

Francis Dupont writes:
 >    > So here's a most-likely crazy idea: why can't we
 >    > treat the ingress filtering router like a CN which
 >    > must first be sent a BU which it verifies in
 >    > whatever manner the CN would? This already has a
 >    > requirement to not be bound to mythical PKI's,
 >    > etc. Given FMIP, the access routers are probably
 >    > going to end up having to process things like BU's
 >    > anyway.
 >    
 >    I was drifting into this direction myself.  But how?
 >    Introduce a new ICMP message saying: send me a BU
 >    if you want to use HAO?
 >    
 > => no, Michael's idea is to look at packets going through
 > access routers in order to find BUs (i.e. this is passive).
 > And if you'd like to use an active scheme, why not the
 > network access control?

   No, actually, it was to have the MN send the
   BU's directly to the access router. On a router
   the BU just has an additional effect of removing
   any restrictions on source addresses it will 
   let through. Hence Pekka's question about use
   of ICMP was correct.

	   Mike

---

From: Pekka Savola <[email-masked]>
Date: Tue, 8 Jan 2002 12:48:35 +0200 (EET)

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Pekka Savola <[email-masked]>
Date: Mon, 7 Jan 2002 22:22:44 +0200 (EET)

On Mon, 7 Jan 2002, Pekka Nikander wrote:
> Michael Thomas wrote:
> > Also: if we have ingress filtering taken care of
> > directly, is there any reason to preserve the HAO
> > at all? I thought its entire raison d'etre was to
> > provide a means of coexisting with ingress
> > filtering -- which we've already proven is just
> > shifting the problem around instead of providing
> > something useful.
> 
> Now THAT sounds like the most reasonable thing that
> I have heard about ingress filtering for a long time!
> 
> To me, it seems like combinding RR and CGA, the
> ingress filtering router can fairly easily determine
> that the MN really "owns" the home address, and
> thereafter pass it.  As an immediate reaction, the
> only problem seems to be that CGA requires fairly
> heavy CPU load.  Could RR be enough in this case,
> since the CoA and HoA are on the different sides
> of the router?

Moreover, ingress filtering is usually performed at more than one router.

The network manager of the LAN might perform it.  The network manager of 
the site should perform it.  The network manager of the ISP should also 
perform it. Etc.

Therefore, this "notification" or "ingress filtering registration" would
have to operate a bit like path MTU discovery or a router alert option.  
Also, this would get more difficult in the case of multiple, changing
paths (multihoming).

Certainly an interesting idea, though.