Subject: Re: [Anima] eckert-anima-stable-connectivity

From: Michael Richardson <[email-masked]>
Date: Mon, 01 Dec 2014 08:46:18 -0500

Brian E Carpenter <[email-masked]> wrote:
    >> (I will claim: more than you many people),  but I do not think the upper
    >> 64-bits of an address can be private.   Remember: the traffic isn't going
    >> anywhere: BCP38 filtering at some point will kill it outbound, and there can
    >> never be any inbound traffic responding.  

    > Exactly, and site egresses should stop it even before it hits any BCP38 filters.
    > So I have never had any real level of concern about ULA leakage; I don't
    > really see why it's going to happen more than say Net 10 leakage does
    > today.

I agree that it's on the same scale as net 10 leakage, but I expect it to be
slightly worse scale if systems are auto-generating ULAs a lot.   

net 10 leakage is already a big deal in some places: IPv6 ULAs have the
advantage that when that winXP box bridges two "net 10" zones unintentionally,
the odds of overlap are very low.  This kind of event seems to happen essentially
daily on the university campus where the CREDIL office lives... 

    >> A BCP38-related question about Anima Control Plane would be: what kind of
    >> filtering is appropriate.  Consider two networks which merge... does one
    >> renumber? 

    > Yes, both splits and merges are an issue. In the "professionally managed"
    > networks that anima is scoped for, hopefully there will not be unplanned
    > merges, but we do need to consider these issues.

I'm thinking about an ISP who connects to IXs.  The actual hour/minute when
the fiber gets plugged in is often not known.  If ANIMA is going to be able
to manage equipment at the far end of one of those links, my understanding is
that the ACP network might come "up" even when the link is administratively
"down".
In ISP networks I'm familiar with, IX connects/disconnects/fiber-moves occur
several times a week.

    >> I propose that we adopt some terminology from chemistry for our networks.
    >> 
    >> Individual ANIMA entites are atoms... they can form bonds to other atoms to
    >> form molecules.  Molecules may coalese to form bigger molecules.
    >> 
    >> A molecule (can become)/is "grounded" (a RPL term) to a substrate
    >> (i.e. a NOC).   We may have a use for the various kinds of bonds (covalent,
    >> ionic, hydrogen, van-der-Walls)...   I would claim that molecules that
    >> spontaneously form should use ULA-R until such time as they become grounded,
    >> at which point they would adopt the numbering from the NOC (which I suggest
    >> should be NCN or ULA-C).  

    > But there's no such thing as ULA-C. Also, the way enterprise networks
    > are extended is a bit different from IoT or homenets in this respect. I think
    > the model needs to be flexible on what kind of prefix is used. I do agree
    > with your implication that renumbering of the ACP needs to be regarded
    > as a routine event (e.g., assume renumbering might happen after every
    > significant outage and again after the outage is fixed). Node identities
    > should matter a lot more than node addresses.

a) I think that perhaps defining ULA-C could be in scope.  
   (If we are using RPL with /128 routes, we might need a single /64 for the ACP)
   I really want a stable, identifiable numbering space for the ACP, and I
   really think it should be distinct from the enterprise/ISP 's GUA.  
   Being distinct just makes ACLs, etc. SO MUCH easier for humans to understand.

b) what do you think of the atom/molecule and bond terminology?

c) I don't think renumbering might occur due to outages; I think that is
   probably wrong.  Okay, the machine that was off might generate a new ULA
   when it turns back on and hasn't got connectivity... but I'm suggesting
   that it would renumber again as soon as it forms a bond.  Since the NOC
   would never renumber, once things connect to the NOC, the original
   numbering would resume.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 02 Dec 2014 08:31:26 +1300

Hi Michael,

> In ISP networks I'm familiar with, IX connects/disconnects/fiber-moves occur

That's an interesting use case, indeed. I assume the ISP's device would
have a secure identity (as far as the ISP is concerned), but would it come
up with a link local address first? If so, it would need to be bootstrapped
into the ACP using that address.

>    Being distinct just makes ACLs, etc. SO MUCH easier for humans to understand.

Well yes. But you haven't persuaded me about ULA-C.

> b) what do you think of the atom/molecule and bond terminology?

It's a nice analogy. Whether we actually need the terminology is
a bit less clear to me. Maybe the ACP/stable connectivity authors
have an opinion...
>    would never renumber, once things connect to the NOC, the original

You could make it a matter of definition that the NOC never renumbers, but
after a power fail, every device that lost all its state will be effectively
renumbered anyway. I think that's why Fred Baker says from time to time
that the real problem is numbering, not re-numbering. But you're right,
if there is a regional failure, the region will probably reboot itself
until it succeeds in rejoining the ACP and NOC, and will then have to
renumber.

    Brian

---

From: Michael Richardson <[email-masked]>
Date: Mon, 01 Dec 2014 17:23:12 -0500

> into the ACP using that address.

(Just be clear: a single fiber doesn't move several times a week, I'm saying
 that some fiber in some IX goes up/down each time.  Perhaps root operators
 have more connects/disconnects than others though)

The ISP's device might already be secure and connected via another path, and
so yet, it would already have a local identity.  Or it could be a totally
fresh device just shipped from the factory.  And also remember that in these
days of SDN, it isn't brand-name dedicated router equipment that does
routing.. the target device could be a 1U box with an ILOM...

    > Well yes. But you haven't persuaded me about ULA-C.

It's not ULA-C per-se, that I care about.  
(Vixie has a draft, long expired)
It's using a /64 which is not part of the enterprise GUA that I care about.

Do we agree on that?

-- 
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 02 Dec 2014 11:33:59 +1300

> routing.. the target device could be a 1U box with an ILOM...

Of course. But in any case, the question of how a new box gets its secure
identity is a separate one that may turn out to have several solutions.
(Not so different from the problem of how software SIMs will become
trusted.)

> It's using a /64 which is not part of the enterprise GUA that I care about.

I think that would be what I would choose to do, but I'm not convinced
we need to make it a MUST.

   Brian