Subject: draft-chown-6man-tokenised-ipv6-identifiers-02

From: Tim Chown <[email-masked]>
Date: Mon, 5 Nov 2012 16:18:10 +0000

Hi,

I forgot to ask for a 5 min slot for this in Atlanta.

http://tools.ietf.org/html/draft-chown-6man-tokenised-ipv6-identifiers-02

The draft describes a way to simplify (a little!) server renumbering in SLAAC networks.  Rather than manually configuring a 128-bit address on servers, you configure the 64-bit interface identifier, and rely on the RA to learn the prefix.

There was an implementation for Solaris, and a patch for Linux many years ago,

Is there interest in promoting this idea further, and importantly any IPR preventing doing so?  Or is there reluctance from admins to rely on RAs to configure a full server IPv6 address?

Tim

---

From: Bob Hinden <[email-masked]>
Date: Mon, 5 Nov 2012 13:35:35 -0500

Tim,

> http://tools.ietf.org/html/draft-chown-6man-tokenised-ipv6-identifiers-02

I think this is a good idea.  Some comments on the draft.

I think the draft is recommending that all (server) implementations allow static Interface ID to be configured on an interface.  Section 2 mentions two examples of systems that do this today, but I find a clear statement of this except for a singe sentence:

  The important point is that such identifier configuration should be supported.

I think this should be expanded.  Do you think it should discuss any considerations about how to choose these IIDs?  

Also, I think the draft should reference RFC 4291 and mention that the configured IID have to be compliant.

Thanks,
Bob

---

From: Arturo Servin <[email-masked]>
Date: Mon, 05 Nov 2012 13:38:46 -0500

Tim

	I have mixing feelings about. I like the option, but I am not sure if I
would deploy it for my production services, perhaps only for training
labs and some other no critical infrastructure. Definitely I would not
want a rogue RA injecting the wrong prefix for my servers.

	Also, I wonder why you didn't add all the issues of rogue RA in the
security considerations? At least for me, security would be one of the
major drawbacks to use it.

Regards,
as

On 05/11/2012 11:18, Tim Chown wrote:
> The draft describes a way to simplify (a little!) server renumbering in
> SLAAC networks.  Rather than manually configuring a 128-bit address on
> servers, you configure the 64-bit interface identifier, and rely on the
> RA to learn the prefix.
> 
> Is there interest in promoting this idea further, and importantly any
> IPR preventing doing so?  Or is there reluctance from admins to rely on
> RAs to configure a full server IPv6 address?
> 
> Tim
> 
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>

---

From: Fernando Gont <[email-masked]>
Date: Mon, 05 Nov 2012 16:56:50 -0500

Hi, Tim,

> RAs to configure a full server IPv6 address?

I've gone through the I-D, and found it valuable. Here are some
comments/questions:

* It looks like the ultimate goal of these tokenized addresses is that
of renumbering? Am I right? This is pointed out in the abstract, but
doesn't seem to be so clear form the Intro.

* When it comes to servers, I guess they'd nevertheless need to update
the corresponding DNS entries... So this proposal seems to be more
targetted at, e.g., ACLs?

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 06 Nov 2012 02:05:47 +0000

> doesn't seem to be so clear form the Intro.

As Fred Baker has pointed out in the 6renum context, there is only a small
difference between "renumbering" and "numbering", and every network gets
numbered at least once in its life, and more often if powered off and on again.

> targetted at, e.g., ACLs?

If dynamic DNS update is in use, there would be no manual action needed.

Indeed, a configuration system could know that <prefix-N><token-M> is
the address for a given server, and everything including the AAAA record
could be parameterised on that basis.

    Brian

---

From: Fernando Gont <[email-masked]>
Date: Tue, 06 Nov 2012 03:15:16 -0500

> numbered at least once in its life, and more often if powered off and on again.

Huh? :-)

If you generate your addresses according to traditional SLAAC, and the
advertised autoconf pprefix is always the same, where's the renumbering?

> If dynamic DNS update is in use, there would be no manual action needed.

The point is, if you're updating the DNS entiries anyway, why would you
care about the special magic (i.e., tokenized IIDS)? -- the meat seems
to the in the renumbering case.

> could be parameterised on that basis.

I'd set the DNS aside -- at least this I-D doesn't mention any mechanism
to notify the DNS of the updated *prefix* (and you probably wouldn't
want that, anyway).

Cheers,

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 06 Nov 2012 11:45:27 +0000

> advertised autoconf pprefix is always the same, where's the renumbering?

At least for a homenet or small office buying basic service,
there's no guarantee you will get the same prefix back if you
power cycle your CPE.

> to the in the renumbering case.

Site managers of enterprise networks like predictability, and
they don't want things to change in the case of a swap of the
physical server, and of course they don't want to manually
configure an IPv6 address on the new box.

However, I agree: we need renumbering to become a routine
operation, so that is a main driver for parameterising address
config as much as possible.

> to notify the DNS of the updated *prefix* (and you probably wouldn't

It's a separate problem, but yes, I would want it automated (and
secure, of course). We should aim at typing in hexadecimal
numbers as little as possible. Tokenised IDs are a tool for
that, and so are parameterised prefixes.

    Brian

---

From: Fernando Gont <[email-masked]>
Date: Tue, 06 Nov 2012 16:52:15 -0500

> there's no guarantee you will get the same prefix back if you

For a home net, do you really want to use IPv6 addresse, or wuld you
rather use DNS/mDNS?

> configure an IPv6 address on the new box.

They will have to configure the tokenized IIDs, anyway. - again, I think
the meat is in the renumbering case.

> secure, of course). 

So far there's no support for that in the DNS, is it?

Cheers,

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 06 Nov 2012 22:27:40 +0000

> For a home net, do you really want to use IPv6 addresse, or wuld you

I don't think that's relevant. Yes of course names should be used
in configurations whenever possible, but the hosts and network elements
tend to use addresses under the covers.

> the meat is in the renumbering case.

It's because all networks need to be renumbered some day that it matters, yes.

> So far there's no support for that in the DNS, is it?

No, but listen to Fred's talk in 6renum, and/or read
draft-baker-6renum-oss-renumbering.

   Brian

---

From: John Mann <[email-masked]>
Date: Wed, 7 Nov 2012 14:41:17 +1100

Hi,

On 6 November 2012 03:18, Tim Chown <[email-masked]> wrote:

> servers, you configure the 64-bit interface identifier, and rely on the RA
> to learn the prefix.
>
...

A similar scheme can be used for configuring Cisco routers, and can be used
for configuring subnet-part as well as host-part of the IPv6 address.

http://www.cisco.com/en/US/docs/ios/ipv6/command/reference/ipv6_05.html#wp2320102
===
...

Addresses may also be defined using the general prefix mechanism, which
separates the aggregated IPv6 prefix bits from the subprefix and host bits.
In this case, the leading bits of the address are defined in a general
prefix, which is globally configured or learned (for example, through use
of Dynamic Host Configuration Protocol-Prefix Delegation (DHCP-PD)), and
then applied using the *prefix-name* argument. The subprefix bits and host
bits are defined using the *sub-bits* argument.
...
Examples

The following example shows how to enable IPv6 processing on the interface
and configure an address based on the general prefix called my-prefix and
the directly specified bits:

Router(config-if) *ipv6 address my-prefix 0:0:0:7272::72/64*

Assuming the general prefix named my-prefix has the value of
2001:DB8:2222::/48, then the interface would be configured with the global
address 2001:DB8:2222:7272::72/64.
===

I have used this on my home Cisco 877W ADSL router.  Config snips are at
http://www.internode.on.net/support/guides/internet_access/ipv6/cisco_routers/
===
ipv6 dhcp client pd NODE-PD rapid-commit
...
ipv6 address NODE-PD ::1/64
===

    John