Subject: Enforcing unreachability of site local addresses

From: "Christian Huitema" <[email-masked]>
Date: Sat, 23 Nov 2002 10:37:14 -0800

One of the point in the discussion of the "globally unique" site local addresses has been the discussion of their usage. In particular, if the new addresses are globally unique, how do we prevent them from being globally routed and creating a mess in the global routing tables; and, on a related note, how do we make sure that they are actually local?
 
The issue is clearly complex. There are legitimate scenarios in which two sites might want to create some kind of backdoor connection independent of any ISP connection, in a way similar to the various "extranet" scenarios that are common today; it could also be used in a merger situation. There are also illegitimate scenarios in which a powerful customer would pressure an ISP to simply advertize their globally unique /48.
 
I believe that Bob Hinden provided the beginning of the answer when he proposed that all routers would have a default black-hole for the site local prefix. The implementation would be the following:
 
1) In a local site, advertise the subnet routes in the IGP, possibly a default route for the site, and a black-hole for the site local prefix. This guarantees internal connectivity to the valid subnets, and unreachability for all other sites.
 
2) In an extranet scenario, import in the IGP an explicit route for the "friendly" sites, and point it to the specific backdoor connecctions to these sites. This will override the blackhole.
 
3) At a border router, discard all BGP route that point to the site local prefix or subsets of it.
 
4) At a site border router or firewall, perform ingress filtering and discard all externally sourced packets in which the source address pretends to belong to the internal site.
 
The combination of 1 and 3 presents a powerful disencentive against the "leakage of routes" risk: a powerful customer might pressure a local ISP, but that would be to no avail since the packets would be dropped by the next hop. I believe that the combination of the four rules will provide the desired locality benefits without having to resort to ambiguity as an enforcement mechanism.
 
-- Christian Huitema

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Dan Lanciani <[email-masked]>
Date: Sat, 23 Nov 2002 21:17:51 -0500 (EST)

Margaret Wasserman <[email-masked]> wrote:

|I think that we should stop calling these addresses "site-local",
|as that is prone to confusion.  We would create a separate set
|of globally-unique/provider-independent (GUPI?  Pronounced
|"guppy" or "goopy", depending on how much you like them?  :-))
|addresses for use as local addresses in Internet connected sites.
|
|We could still have site-local addresses (FECO::/10), which can be
|used for disconnected networks (and perhaps other cases -- we
|haven't really decided how widely to use them yet).  If we limit
|them to disconnected sites, they could be treated exactly like
|global addresses by all nodes.  If we also allow them to be
|used on connected networks (for intermittently attached networks,
|for example), we probably want to change the default address
|selection rules to prefer globals (of both sorts) over SLs.

I trust that it goes without saying that these GUPIs will have to
actually be available *before* this change to the default address
selection rules is made.

				Dan Lanciani
				ddl@danlan.*com

---

From: "Michel Py" <[email-masked]>
Date: Sat, 23 Nov 2002 18:22:39 -0800

Margaret,

> Margaret Wasserman wrote:
> The IPv6 WG putting a "MUST" in a spec does not put
> code in a router.

That is an interesting point of view, for sure. It has worked so far,
why would this change?

> There are already implementations of IPv6 that do
> not "black-hole" this set of TBD globally-unique,
> provider-independent addresses, so our solution must
> not depend on all routers black-holing packets
> to/from these addresses.

Fortunately these will have their software updated many times in the
next few years, and the solution does not depend on _all_ routers. The
success of the solution depends on the comfort level of network
administrators in assessing that the _majority_ of routers implement the
recommendation.

> In order to be useful, globally-unique/provider-independent
> addresses need to be routable.  To be maximally useful, the
> routing boundaries for these addresses need to be set by
> administrators, not automatically enforced at specific
> routing protocol (or other) boundaries.

I used *default* in my posting, obviously I should have used DEFAULT
instead.

The subject of this thread is "Enforcing unreachability of site local
addresses", not creating a new PI space.

Michel.

---

From: Steven Blake <[email-masked]>
Date: 25 Nov 2002 09:38:46 -0500

On Sat, 2002-11-23 at 13:37, Christian Huitema wrote:

> One of the point in the discussion of the "globally unique" site local 
> addresses has been the discussion of their usage. In particular, if the new 
> addresses are globally unique, how do we prevent them from being
> globally routed and creating a mess in the global routing tables; and,
> on a related note, how do we make sure that they are actually local?
>  
> The issue is clearly complex. There are legitimate scenarios in which
> two sites might want to create some kind of backdoor connection
> independent of any ISP connection, in a way similar to the various
> "extranet" scenarios that are common today; it could also be used in a
> merger situation. There are also illegitimate scenarios in which a 
> powerful customer would pressure an ISP to simply advertize their
> globally unique /48.

Why is this scenario "illegitimate"?

It is certainly not scalable to millions of sites (with current routing
technology), but on the other hand private jets are not scalable either,
and yet there seems to be a healthy market for them.

I'm having a hard time understanding why any of the thousands of
institutions with IPv4 PI address prefixes would ever migrate to IPv6 if
they had to give up PI addressing.

Regards,

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Steven L. Blake               <[email-masked]>
Ericsson IP Infrastructure                +1 919-472-9913

---

From: "Michel Py" <[email-masked]>
Date: Mon, 25 Nov 2002 09:17:15 -0800

Steven,

> Steven Blake wrote:
> I'm having a hard time understanding why any of the
> thousands of institutions with IPv4 PI address prefixes
> would ever migrate to IPv6 if they had to give up PI
> addressing.

They would not, but the way of providing them PI addresses is not to
punch holes in PA space that would lead us directly in the same swamp
than IPv4.

Michel.

---

From: "Michel Py" <[email-masked]>
Date: Wed, 27 Nov 2002 09:39:01 -0800

> Kurt Erik Lindqvist wrote:
> ....but how on earth did we end up in this discussion?
> From what I remember of the voting in Atlanta we had
> consensus for a limited version of site-locals...not
> creating a separate address structure?
 
Thank you.

Michel.