Subject: [RRG] A Late Response to Questions on Six/One Router

From: Christian Vogt <[email-masked]>
Date: Fri, 11 Jul 2008 15:33:27 +0300

Comrades,

previous discussions around tunneling vs. address rewriting have shown
that some of the concepts of Six/One Router are unclear in the
community.  This is, of course, my fault because the papers that I
have so far published on Six/One Router do not go into sufficient
detail to dispel these unclarities.  I have done my homework now and
would like to point you to the following paper, which motivates and
explains the design of Six/One Router more thoroughly:

http://users.piuha.net/chvogt/pub/2008/vogt-2008-six-one-router-design.pdf

I would like to especially thank Robin Whittle, who has posed a number
of excellent questions that helped me understand what is unclear about
Six/One Router, and thus address these unclarities in the above paper.

Before responding to Robin's question more carefully in a separate
email, let me here just emphasize two main concepts of Six/One Router.
Likely, this will resolve most of the existing vagueness:

- Mapping between edge addresses and the transit addresses from a
   given provider is one-to-one.  This is why no packet encapsulation
   is necessary:  The edge/transit address after rewriting is
   unambiguously determined by the transit/edge address prior to
   rewriting.  This also makes Six/One Router function without
   per-host state, like tunneling, but unlike NAT boxes.

- Six/One Router has two components, which are independent of each
   other even though they both use address rewriting:  The first
   component uses bilateral address rewriting for communications
   between two upgraded edge networks; the second component uses
   unilateral address rewriting on the border of an upgraded edge
   network for communications with a legacy edge network.  Since
   these components are independent, it is possible to replace either
   of them with a corresponding component from tunnel-based
   approaches:  Bilateral address rewriting can be combined with
   proxies for backwards compatibility.  Tunneling can be combined
   with unilateral address rewriting for backwards compatibility.

I will follow up with a more careful response to Robin's previous
questions about Six/One Router.

- Christian

--
to unsubscribe send a message to [email-masked] with the
word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/rrg/> & ftp://psg.com/pub/lists/rrg

---

From: Lixia Zhang <[email-masked]>
Date: Thu, 7 Aug 2008 07:49:39 -0700

> http://users.piuha.net/chvogt/pub/2008/vogt-2008-six-one-router-design.pdf

better later than never: I have 3 questions on this writeup; Robin  
already brought up the first one in his long review comment (dated  
July 30, 2008 10:25:39 AM PDT), but I have not seen the rest been  
asked (or maybe I read Robin's long msg too quickly and missed).

1/ fig-4 in the above pdf file shows an example of backward  
compatibility packet exchanges between an upgraded and a legacy edge  
network, however note that both are single-homed in this example.
If the legacy net L is multihomed, everything still works, as (I  
assume) L still has its prefix injected into the global routing table.
However if the upgraded network U is multihomed, the communication  
with L can only use the address of one of U's providers, right?
(this would be a dis-incentive for U to do upgrading...)

2/ how does six/one handle transient failures?
Take Figure-3 for example: if the link between provider-1 and six/one  
router fails, since the other end sends to the specific address block  
of this six/one router (as explained in fig-2), what causes the other  
end to change the translation to the address belonging to the right- 
side six/one router?
Or there is some "local repair" done between provider-1 and provider-2?
(the latter is hinted by the following pragraph quoted from the paper:

    Six/One Router
    should permit fast re-establishment of packet exchanges in
    Unilateral mode upon failure of the provider via which they
    used to be routed. Six/One Router achieves this by making the
    providers of a multi-homed edge network responsible for
    connectivity to disjoint and complementary subsets of the
    transit address space, while having all of them provide
    connectivity to the complete remote edge address space.
    Providers back up each other’s routes to remote transit
    addresses.

I don't fully understand exactly what it means by "responsible for  
connectivity to disjoint and complementary subsets of the transit  
address space", or
how providers "back up each other’s routes to remote transit  
addresses"..)

3/ the paper shows that six/one deployment is at edge sites--how does  
this help align cost with incentives?

---

From: Lixia Zhang <[email-masked]>
Date: Thu, 7 Aug 2008 08:10:00 -0700

sorry folks, this msg went out by mistake, as I had not finished  
typing yet :(

> (this would be a dis-incentive for U to do upgrading...)

I replace the original question 2/ with the following:

The paper touched this issue in a super brief way:) in the following 2  
paragraphs:

for bilateral case (= both ends are upgraded):

    Active
    packet exchanges can therefore be redirected between the
    providers of a multi-homed edge network only if the resulting
    change in transit addresses is handled in a manner transparent
    to hosts. Bilateral mode achieves this because the rewriting of a
    host’s multiple transit addresses into a single edge address
    hides transit address changes from the host.

I agree that rewriting is easily done (this is equivalent to say that,  
with an encap solution, one can easily encap packets with a different  
ETR address)
the hard question is how a six/one router at the source site border  
learn about the failure promptly to do the redirection.

For unilateral case (i.e. one end upgraded, one end not)

    Six/One Router

> 3/ the paper shows that six/one deployment is at edge sites--how  
> does this help align cost with incentives?

---

From: Christian Vogt <[email-masked]>
Date: Fri, 15 Aug 2008 11:14:59 -0700

On Aug 7, 2008, Lixia Zhang wrote:

> network, however note that both are single-homed in this example. If
> the legacy net L is multihomed, everything still works, as (I assume)
> L still has its prefix injected into the global routing table. However
> if the upgraded network U is multihomed, the communication with L can
> only use the address of one of U's providers, right? (this would be a
> dis-incentive for U to do upgrading...)

Hi Lixia,

you are right in that a multi-homed upgraded edge network is reachable
from a given legacy edge networks only via a single provider.  That
provider may differ depending on the legacy edge network, so all
providers can still be used.  Also, the provider may change over time,
e.g., for fail-over.  But such a fail-over requires that affected
packet exchanges (with legacy edge networks) are re-established.

> 2/ how does six/one handle transient failures? Take Figure-3 for
> example: if the link between provider-1 and six/one router fails,
> since the other end sends to the specific address block of this
> six/one router (as explained in fig-2), what causes the other end to
> change the translation to the address belonging to the right-side
> six/one router? Or there is some "local repair" done between
> provider-1 and provider-2?

The paper describes a secure method with which edge networks can
communicate reachability information to other edge networks.  This is
the Mapping Preferences message plus its accompanying validation
protocol (section 2.5.2 in the paper).  This method can be used for
recovery from an edge network attachment failure as long as there
exists an entity that (a) knows about the attachment failure, and (b)
knows about remote Six/One routers sending packets to the failed
attachment.

For failure recovery when such an entity does not exist, additional
mechanisms are necessary.  What I was thinking of (but what the paper
does not describe) is mechanisms executed by the sending Six/One
router:  probing of destination Six/One routers, monitoring of ICMP
Destination Unreachable messages, or monitoring of locator prefix
withdrawals in BGP.  (These mechanisms are not novel, of course; they
have been described elsewhere.)

> this help align cost with incentives?

It's not a must to deploy Six/One Router in edge networks.  You can
deploy it on the provider side as well.  I tried to write the paper in
a way that is independent of which side on a border link Six/One
routers are placed.

As a matter of fact, I personally prefer the option where the
providers deploy Six/One Router because they are the ones who benefit
from the improved routing scalability.  But again, it doesn't matter.
Different deployment schemes could be used for different edge
networks.

- Christian

---

From: Christian Vogt <[email-masked]>
Date: Fri, 15 Aug 2008 11:24:52 -0700

> packet exchanges (with legacy edge networks) are re-established.

Lixia, elaborating on this a bit more...:

The reason why only a single provider can be used for a given legacy
edge network (at a given time) is this:  For packets sent from the
multi-homed upgraded edge network U to a legacy edge network L, the
transit address that is seen by the recipient host in L must be
uniquely determinable based on the corresponding edge address used
within U.  Provided that we want Six/One routers to be stateless, this
is possible only with a one-to-one mapping between the PI prefixes
used within U and the transit address prefixes that L can use.
Consequently, if we use a single PI prefix within U, then only one
transit address prefix can be reachable by L.

OTOH, if upgraded edge networks use a separate PI prefix per provider,
all providers can be used even for packet exchanges with legacy edge
networks.  Advantage:  Better multi-homing capabilities for upgraded
edge networks.  Disadvantage:  Multiple PI prefixes must be managed
within upgraded edge networks.

- Christian