Subject: RE: Proposal for site-local clean-up

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 13 Nov 2002 13:18:01 -0800

Tony,

> 
> Michael Thomas wrote:
> > So I have a question for those who support
> > connected site locals: what would prevent a new
> > RFC from updating Brian's wording for site locals
> > (if that's the right thing)?
> > 
> > I say this because it seems to me that there's a
> > lot of issues being conflated in these arguments
> > and what's sort of frightening to me is that they
> > need to be teased apart. In particular, the desire
> > for provider independent addressing seems to
> > factor in here fairly largely too, and I wonder if
> > the better part of valor might not be to get
> > together a BOF which focuses on the actual real
> > life requirements here. It's possible that site
> > locals in the end might make sense here, but it's
> > also possible that it can be done other ways too
> > (or that the entire problem is totally intractable
> > which is the way it looks to me now).
> > 
> 
> Some of the uses for SL would be better served by PI 
> addresses, but not all. 
> 
> Take the case of a 20,000 node network where half are allowed 
> global access and half are not. It is much more complex to 
> sort through a 10,000 node list per packet for access 
> filtering than it would be to have two entries, SL deny & PA 
> allow. Yes the list of which 10,000 nodes are allowed the 
> global prefix has to be maintained, but it can be applied 
> according to allocation policy rather than per packet processing. 
> 
I miss something here. How do you make sure that nodes configure
just site local and not global address on seeing an RA ? Are you keeping
them in separate networks i.e not mixing nodes that require globals and
site locals ? If so, then I can do the same with globals
with appropriate partitioning i.e subnet 1 - 100, is for private use
only.
Then the check is very simple. Could you clarify ?

thanks
mohan

> Yes we need a PI format, and there are a few being batted 
> around on multi-6, but even there we are into engineering 
> trade-offs about allocation efficiency vs. routing table 
> exception handling efficiency. My intent was to bring a PI 
> format proposal to this wg after multi-6 established 
> requirements, but that wg seems to have been derailed into 
> the long running saga of overhauling the entire protocol 
> suite. If there is interest in discussing a PI format to get 
> that off the table for the SL discussion, I will ask the 
> chairs to consider it as a WG doc.
> 
> Tony
> 
> 
> 
> --------------------------------------------------------------------
> IETF IPng Working Group Mailing List
> IPng Home Page:                      http://playground.sun.com/ipng
> FTP archive:                      ftp://playground.sun.com/pub/ipng
> Direct all administrative requests to [email-masked]
> --------------------------------------------------------------------
> 

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Tony Hain" <[email-masked]>
Date: Wed, 13 Nov 2002 13:40:59 -0800

Mohan Parthasarathy wrote:
> > ...
> I miss something here. How do you make sure that nodes 
> configure just site local and not global address on seeing an 
> RA ? Are you keeping them in separate networks i.e not mixing 
> nodes that require globals and site locals ? If so, then I 
> can do the same with globals with appropriate partitioning 
> i.e subnet 1 - 100, is for private use only. Then the check 
> is very simple. Could you clarify ?

Same network, hearing RA's, just local policy on the restricted box to
only configure based on SL prefixes. 

Tony

---

From: Roy Brabson <[email-masked]>
Date: Wed, 13 Nov 2002 17:09:18 -0500

> only configure based on SL prefixes. 

So, instead of filtering global addresses at the firewall, you go to each 
individual box in the network which you want to restricted access to/from 
and configure it to only use restricted (i.e., site-local) addresses? And, 
as a bonus, you get to deal with all the complexity and problems which are 
introduced when using site-locals in a non-isolated environment.  How, 
exactly, does this improve anything?

Roy

---

From: "Tony Hain" <[email-masked]>
Date: Wed, 13 Nov 2002 14:38:32 -0800

> exactly, does this improve anything?

It aligns access policy with the device rather than a difficult to
manage table at every edge of the network. This is much simpler at
scale. The only complexity that SL introduces in the environment is for
apps that do literal rather than name based referrals. If they are
written to preclude that referral when it involves a SL prefix, the
issue becomes one of the network manager deciding if the app should work
(thereby assigning a global), or should be broken by the SL filtering.
The arguments against SL boil down to not liking the fact that network
managers will do filtering.

Tony

---

From: Keith Moore <[email-masked]>
Date: Wed, 13 Nov 2002 19:51:05 -0500

> scale.

neither one scales well, but for many networks (those with only one
border router) you'd rather control the edge than the hosts.

ideally you want to specify this more-or-less centrally and
communicate it to all concerned parties.  that way you get
security in depth. 

but SL is not sufficient for this purpose.  not by a longshot.
and if you develop a mechanism to communicate this policy, then
you don't need to use SLs for this anymore.
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------