Subject: routers and SADR selection in combination with ULA and GUA

From: Mikael Abrahamsson <[email-masked]>
Date: Wed, 18 Mar 2015 12:00:21 +0100 (CET)

Hi,

I ran into the following case when trying to help a friend with an IPv6 
problem. Friend has a GRE tunnel for IPv6. Over this tunnel he has a 
routed GUA prefix, probably /56 or /48 or something. He has then numbered 
one GUA /64 out of this to a physical inteface on his router.

Now for some reason, the GRE interface had a fd00:-address he had 
configured as directed from his ISP that had set up this tunnel. This was 
the only configured address on the GRE interface.

This means that ICMP PTB messages that happened because his LAN ipv6 mtu 
1350, were sourced from the fd00: address and sent out to the Internet. 
This of course doesn't work very well as the ULA sourced packet is 
rightfully filtered by ISPs that have ingress source filtering.

So obviously, I recommended them to either number the GRE tunnel from GUA 
space, or not number it at all, anyhow, removing the ULA address from the 
tunnel. But then it struck me, do we have a document that recommends that 
RFC6724 SADR selection should be done between interfaces, so that the PTB 
message should have been sourced from the LAN interface with GUA address 
when the PTB packet is sent to a GUA address? I guess that depends on 
whether the router implements the weak or strong host model.

I don't know if this should go to v6ops or to 6man, but I started with 
6man because of the SADR discussion here, and if the above problem has any 
bearing on what's being discussed there. Do we need to have 
recommendations that in case you're sending packets to GUA space, it's 
better to source packets from GUA space from another interface, than to 
source it from ULA space from the outgoing interface? Or is this simply 
too complicated (some cases one doesn't want it to work like this) and we 
should try to write something up in v6ops instead?

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Ole Troan <[email-masked]>
Date: Wed, 18 Mar 2015 12:11:39 +0100

Mikael,

> I ran into the following case when trying to help a friend with an IPv6 problem. Friend has a GRE tunnel for IPv6. Over this tunnel he has a routed GUA prefix, probably /56 or /48 or something. He has then numbered one GUA /64 out of this to a physical inteface on his router.
> 
> Now for some reason, the GRE interface had a fd00:-address he had configured as directed from his ISP that had set up this tunnel. This was the only configured address on the GRE interface.
> 
> This means that ICMP PTB messages that happened because his LAN ipv6 mtu 1350, were sourced from the fd00: address and sent out to the Internet. This of course doesn't work very well as the ULA sourced packet is rightfully filtered by ISPs that have ingress source filtering.
> 
> So obviously, I recommended them to either number the GRE tunnel from GUA space, or not number it at all, anyhow, removing the ULA address from the tunnel. But then it struck me, do we have a document that recommends that RFC6724 SADR selection should be done between interfaces, so that the PTB message should have been sourced from the LAN interface with GUA address when the PTB packet is sent to a GUA address? I guess that depends on whether the router implements the weak or strong host model.
> 
> I don't know if this should go to v6ops or to 6man, but I started with 6man because of the SADR discussion here, and if the above problem has any bearing on what's being discussed there. Do we need to have recommendations that in case you're sending packets to GUA space, it's better to source packets from GUA space from another interface, than to source it from ULA space from the outgoing interface? Or is this simply too complicated (some cases one doesn't want it to work like this) and we should try to write something up in v6ops instead?

http://tools.ietf.org/html/rfc4443#section-2.2

cheers,
Ole

---

From: Behcet Sarikaya <[email-masked]>
Date: Wed, 18 Mar 2015 11:00:24 -0500

Hi Mikael,

On Wed, Mar 18, 2015 at 6:00 AM, Mikael Abrahamsson <[email-masked]> wrote:
> problem. Friend has a GRE tunnel for IPv6. Over this tunnel he has a routed
> GUA prefix, probably /56 or /48 or something. He has then numbered one GUA
> /64 out of this to a physical inteface on his router.
>
> Now for some reason, the GRE interface had a fd00:-address he had configured
> as directed from his ISP that had set up this tunnel. This was the only
> configured address on the GRE interface.
>
> 1350, were sourced from the fd00: address and sent out to the Internet. This
> of course doesn't work very well as the ULA sourced packet is rightfully
> filtered by ISPs that have ingress source filtering.
>
> RFC6724 SADR selection should be done between interfaces,

The relationship between RFC 6724 Rule 5.5 and  SADR

is discussed in detail in

draft-sarikaya-6man-sadr-overview-05

:Section 5.

 Regards,

Behcet
>so that the PTB
> I don't know if this should go to v6ops or to 6man, but I started with 6man
> because of the SADR discussion here, and if the above problem has any
> bearing on what's being discussed there. Do we need to have recommendations
> that in case you're sending packets to GUA space, it's better to source
> packets from GUA space from another interface, than to source it from ULA
> space from the outgoing interface? Or is this simply too complicated (some
> cases one doesn't want it to work like this) and we should try to write
> something up in v6ops instead?
>
> --
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

---

From: Mikael Abrahamsson <[email-masked]>
Date: Thu, 19 Mar 2015 05:32:48 +0100 (CET)

> draft-sarikaya-6man-sadr-overview-05

I don't see how any of section 5 applies to what I wrote in my email. I 
don't see how 6724#5.5 applies either.

These are all talking about hosts with dynamic configuration derived from 
receiving addresses using DHCPv6 or SLAAC. My case has static 
configuration only. One might say 6724#6 should be applied even for 
routers that normally use the strong host model for generating ICMP error 
messages, but I can't find that recommendation anywhere.

---

From: Mark Andrews <[email-masked]>
Date: Thu, 19 Mar 2015 15:42:06 +1100

> messages, but I can't find that recommendation anywhere.

It's a misconfiguration to use ULA + strong host and have GUA
addresses traffic transiting the link the same way as it a
misconfiguration to have RFC 1918 addresses and no IPv4 GUA address
to generate a ICMP message in IPv4 when there is IPv4 GUA address
transiting the link (assuming no IPv4 NAT to map back to GUA).  The
ISP that suggested ULA for the link needs to rethink their advice.

ULA work fine when there is just ULA traffic.  When there is GUA
traffic you also need a GUA address.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Mikael Abrahamsson <[email-masked]>
Date: Thu, 19 Mar 2015 05:56:55 +0100 (CET)

On Thu, 19 Mar 2015, Mark Andrews wrote:

> It's a misconfiguration to use ULA + strong host and have GUA addresses 
> traffic transiting the link the same way as it a misconfiguration to 
> have RFC 1918 addresses and no IPv4 GUA address to generate a ICMP 
> message in IPv4 when there is IPv4 GUA address transiting the link 
> (assuming no IPv4 NAT to map back to GUA).  The ISP that suggested ULA 
> for the link needs to rethink their advice.
>
> ULA work fine when there is just ULA traffic.  When there is GUA traffic 
> you also need a GUA address.

I understand this. Obviously the ISP didn't.

The router has a GUA address, just not on that interface. So it seems the 
router vendor didn't implement 6724, but has kept 3484.

So do we need a document that tells router vendors that even though 
they're implementing the strong host model, they need to implement 6724 
with higher preference? Or should we say that using the strong host model 
for IPv6 routers is bad and it should use the weak host model when 6724 
SADR selection has a label that means an address from a different 
interface than the outgoing packet will use?

Or do I need to bring this to v6ops because this isn't something 6man 
should touch at all?

---

From: Behcet Sarikaya <[email-masked]>
Date: Fri, 20 Mar 2015 03:45:56 -0500

On Wed, Mar 18, 2015 at 11:32 PM, Mikael Abrahamsson <[email-masked]> wrote:
>>> routed
>>> configured
>>> This
> receiving addresses using DHCPv6 or SLAAC. My case has static configuration
> only. One might say 6724#6 should be applied even for routers that normally
> use the strong host model for generating ICMP error messages, but I can't
> find that recommendation anywhere.
>

Mikael, I think you inadvertently confused source address with source
address dependent routing or SADR. I think you are talking about
source address selection in an ICMP message not SADR.

Regards,

Behcet

---

From: Mikael Abrahamsson <[email-masked]>
Date: Sun, 22 Mar 2015 12:29:33 +0100 (CET)

> source address selection in an ICMP message not SADR.

Well, it wasn't my intention to talk about SADR, but with the strong host 
model it's kind of hard to completely disregard SADR. Otoh Ole told me all 
routers use the weak model, so this shouldn't be a problem.