Subject: RE: Multiple DRs on a link

From: "Soliman Hesham" <[email-masked]>
Date: Wed, 17 Mar 2004 03:37:46 -0500

> > => There are many different reasons. I sent a verly long
 > > email about this to nemo (monet back then). One simple
 > > scenario is that you might be walking around with a PAN
 > > that happens to have 2 MRs on a single link (e.g. a laptop
 > > and a mobile phone). The two MRs could share the same ingress
 > > link and have different egress links. For instance your laptop
 > > might have a WLAN card and your mobile might have a cellular
 > > interface. Once you walk into an airport lounge or starbucks
 > > you'll suddenly have a multihomed PAN. By definition, each MR
 > > must have a separate home prefix. So each will advertise
 > > a different prefix on the ingress side.
 > 
 > Hi Hesham:
 > 
 > I fail to understand the "by definition" here. Nemo does not 
 > prevent 2
 > different MRs from registering the same MNP. It's like 
 > multiple parallel
 > routes. What's not duplicated is the Home address... In 
 > fact, I proposed
 > a test to check that both registrations actually end up in a 
 > same link,
 > otherwise there's a problem equivalent to the DAD problem in 
 > MIP6. Not
 > much success on that proposal, though

=> Hmm, that's interesting. I must have missed that in the
spec. So, my concern is similar to yours, how does the HA
check whether the MRs are in the same place?? Seems like
a dangerous feature to have. I'm surprised this wasn't discussed
during LC.

Hesham 

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: "Pascal Thubert \(pthubert\)" <[email-masked]>
Date: Wed, 17 Mar 2004 12:43:37 -0000

> 
> -----Original Message-----
> From: Soliman Hesham [mailto:[email-masked]]
> Sent: mercredi 17 mars 2004 09:38
> To: Pascal Thubert (pthubert); Jari Arkko
> Cc: [email-masked]
> Subject: RE: Multiple DRs on a link
>
>
Well, Nemo requires that some authorization be run, that's not described
in the spec. Such a test could take place there, or the authorization
could bar a second registration for a same prefix, I guess.

Pascal

---

From: "Pascal Thubert \(pthubert\)" <[email-masked]>
Date: Wed, 17 Mar 2004 08:32:29 -0000

MRs on different links?

Hi Hesham:

I fail to understand the "by definition" here. Nemo does not prevent 2
different MRs from registering the same MNP. It's like multiple parallel
routes. What's not duplicated is the Home address... In fact, I proposed
a test to check that both registrations actually end up in a same link,
otherwise there's a problem equivalent to the DAD problem in MIP6. Not
much success on that proposal, though

Pascal

---

From: "Pascal Thubert \(pthubert\)" <[email-masked]>
Date: Wed, 17 Mar 2004 08:26:31 -0000

Hi Hesham:

In case that helps, we've found practical in some experimentations to
allow a MR to autoconf addresses on its ingress interfaces, and install
the associated connected routes. Note that if a MR listens to itself
from a different interface, it will not install the prefix.

Anyway, once the router has installed autoconf'ed address, the result is
that source addresses are always topologically correct. But of course
there comes a new set of problems:
- potential attacks by rogue routers
- redistribution: if such a connected route is redistributed over MIP
explicit prefix, then an attack may be propagated. If not, then ingress
filtering at the HA will discard the packet. 
- multiple ingress interfaces Xconnected via wireless. Only one installs
the connected route so the trick fails for other interfaces.

Note that Nemo is a bit unclear about that ingress filtering at HA and I
proposed some text recently that's not in draft 02. 

Pascal

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
Soliman Hesham
> Sent: jeudi 11 mars 2004 08:08
> To: Jari Arkko; Tim Chown; Mattias Pettersson L (KI/EAB)
> Cc: [email-masked]
>  > Right. In addition, the SEND WG had an issue about this as well,
when
>  > they debated the semantics of prefixes in router certificates.
(They
>  > decided to stick with the IPv6 RA semantics. That is, SEND hopes
>  > someone else, maybe multi6, will make it clearer what the rules
are.)
>  >
>  > I have also seen the RFC 3484 rules, and I agree with others that
>  > they are somewhat vague. In any case, multi6 is already discussing
>  > this so eventually there will be a spec that will guide us.
However,
>  > in any case when there are multiple routers with different prefixes
>  > on the same link, currently implemented IPv6 hosts may make the
>  > wrong decision. Certainly at least those nodes that predate RFC
3484.
> 
> => I think even the nodes that implement 3484 may make the
> wrong decision. The text that Alper sent is not "standards text"
> and I suspect there are implementations (e.g. BSD) that don't
> follow this.
> 
>  >
>  > But I have a question about the NEMO case. I had assumed that
mobile
>  > routers move around and attach their egress interface to various
>  > place in the internet. And that their ingress interface serves
>  > a number of hosts, unaware of the movements. I don't see the
>  > default router selection as an issue in this scenario, as the
>  > hosts will stick to the same mobile router all the time, and
>  > the mobile router acts like a host on its egress interface. So
>  > if the visited link works for hosts, it should work for mobile
>  > routers.
> 
> => The problem is when you have 2 MRs, each advertising a different
> prefix (i.e. different home prefix).
> 
> Hesham
> 
>  >
>  > But perhaps you are considering a situation where the ingress
>  > interface of two mobile routers may be shared, or that a mobile
>  > router's ingress interface may suddenly appear on some stationary
>  > network. If we allow this, there could be problems. Do we really
>  > need it?
>  >
>  > --Jari
>  >
>  >
>  >
>  > Administrative Requests:
https://www1.ietf.org/mailman/listinfo/ipv6

---

From: "Soliman Hesham" <[email-masked]>
Date: Tue, 9 Mar 2004 19:17:57 -0500

> So the question is: am I correct to regard this scenario as 
 > broken and 
 > say it should not be encouraged? 

=> Apparently, yes. We had this discussion in nemo some time 
ago. It's unfortunate that this situation is not made clear
in the current specs.

   I also think that nobody 
 > plans to build 
 > fixed networks like this, just for these reasons. However, 
 > people may 
 > want to build NEMO-type of networks just like this, as it is 
 > convenient 
 > when mobile routers are rather independent, they come and 
 > go, and each 
 > connects to one ISP and each only advertises a prefix from its ISP. 

=> Even if they connect to the same ISP, each MR is likely
to advertise a different home prefix.

 > Awkwardly, then it is more important than ever that the 
 > mobile routers 
 > are cooperating otherwise legacy IPv6 hosts won't be able to 
 > get plain 
 > connectivity.

=> It might be better to require the MRs to be aware
of each others' existence and forward traffic with
Pa as a src to Ra and vice versa.

Hesham
 > 
 > /Mattias
 > 
 > 
 > 
 > 
 > 
 > This communication is confidential and intended solely for 
 > the addressee(s). Any unauthorized review, use, disclosure 
 > or distribution is prohibited. If you believe this message 
 > has been sent to you in error, please notify the sender by 
 > replying to this transmission and delete the message without 
 > disclosing it. Thank you.
 > 
 > E-mail including attachments is susceptible to data 
 > corruption, interruption, unauthorized amendment, tampering 
 > and viruses, and we only send and receive e-mails on the 
 > basis that we are not liable for any such corruption, 
 > interception, amendment, tampering or viruses or any 
 > consequences thereof.
 > 
 >