Subject: fe80::/128

From: "Templin, Fred L" <[email-masked]>
Date: Wed, 26 Mar 2014 21:31:24 +0000

I have a question. I have an IPv6 link on which the interfaces of all
nodes use link-local addresses only. The link has a few routers that
other nodes on the link see as IPv6 default routers. Each node will
associate with at most one default router.

I would like to assign fe80::/128 as the "subnet router anycast"
address configured on the interface of each default router. My
question is, since each node will speak only to exactly one default
router, and since no default routers will speak to other default
routers, is it permissible for default routers to use fe80::/128
as the source address of neighbor discovery messages they send?

Thanks - Fred
[email-masked]

---

From: "Templin, Fred L" <[email-masked]>
Date: Wed, 26 Mar 2014 21:51:05 +0000

I should also say, the link is NBMA so all ND messages are
unicast only (no multicast).

Thanks - Fred

> -----Original Message-----
> From: ipv6 [mailto:[email-masked]] On Behalf Of Templin, Fred L
> Sent: Wednesday, March 26, 2014 2:31 PM
> To: [email-masked]
> Subject: fe80::/128
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Wed, 26 Mar 2014 23:04:18 +0100

Hi Fred,

> I have a question. I have an IPv6 link on which the interfaces of all
nodes use
> link-local addresses only. The link has a few routers that other nodes on
the
> link see as IPv6 default routers. Each node will associate with at most
one
> default router.
> address configured on the interface of each default router. My question
is,
> since each node will speak only to exactly one default router, and since
no
> default routers will speak to other default routers, is it permissible for
default
> routers to use fe80::/128 as the source address of neighbor discovery
> messages they send?

I just answer you based on our practical test at our lab. In IPv6, there is
no *real* default router. So, how the nodes know about what to choose as a
router is frequent receiving of redirect message that gives the node the
information about the first hope router that is closer to network outside.
We had an experience to just do a fake router advertisement by sending a
unicast RA message to our victim node. (We did this because we didn't want
to attack the whole network). It was interesting that the victim node
accepts our fake RA message and chose our node as a router with a fake local
prefix (however we didn't choose 128 bits but I also have experience with
non-standard bits) but this only was valid until the victim node receives
redirect message. Since the redirect message was sent automatically from our
attacker node, we needed to do some changes to iptables to just kill
redirect message. All our test was with local addresses and no global
address.
So, I guess the nodes will exchange this redirect message and I think this
might be a problem. I can test it in our lab if you want and let you know
the result.

Hosnieh

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Wed, 26 Mar 2014 23:27:34 +0100

> 
> I should also say, the link is NBMA so all ND messages are unicast only
(no
> multicast).

Just a question:
How these routers connected together and what about nodes?
If it is isolated networks, then only the problem would be using the reserve
value "fe80" . You might be successful to advertise not 128 bits but
something less but your nodes might always choose 64 bits from the RA prefix
because by default they use either EUI-64 or RFC 4941 (until other RFCs
replace them)
If it is not isolated network then the redirect message might be a problem
for you and again the reserved value as I explained in the example scenario
that do different thing but just to show it will not work well. 

 
> > routers, is it permissible for default routers to use fe80::/128 as
> > the source address of neighbor discovery messages they send?
> >
> > Thanks - Fred

---

From: "Templin, Fred L" <[email-masked]>
Date: Wed, 26 Mar 2014 22:42:58 +0000

Hi Hosnieh,

> From: Hosnieh Rafiee [mailto:[email-masked]]
> Sent: Wednesday, March 26, 2014 3:28 PM
> To: Templin, Fred L
> Cc: [email-masked]
> Subject: RE: fe80::/128
> 
> >

All nodes are "neighbors" on the NBMA link, but the default routers
communicate with each other at L2.

> because by default they use either EUI-64 or RFC 4941 (until other RFCs

I should say there is no RS/RA, and only NS, NA and Redirect. Nodes
that are not default routers have a way of discovering the L2 address
of a default router and can then create a static neighbor cache entry
that uses fe80::0 as the L3 address, since the default routers cannot
configure a link-local address based on SLAAC.

> that do different thing but just to show it will not work well.

In my specific link example, I am taking special care of Redirects
where there will not be a problem. But, your message has given me
some ideas that I will go back and check on...

But, bumping up to the high-level question, should fe80::/128 be
considered as the "subnet router anycast" address for the prefix
fe80::/64?

Thanks - Fred

---

From: Mark ZZZ Smith <[email-masked]>
Date: Thu, 27 Mar 2014 01:30:33 -0700 (PDT)

Hi Fred,

----- Original Message -----
> From: "Templin, Fred L" <[email-masked]>
> To: "[email-masked]" <[email-masked]>
> Cc: 
> Sent: Thursday, 27 March 2014 8:31 AM
> Subject: fe80::/128
> 

I don't really know, I suppose it depends on whether any of the ND etc. related functions assume the link-local source address is unique and is an unicast address and can therefore be used to uniquely identify a router. I'd think that likely.

The comment I would make though is that if it is a requirement that in your scenario the use of fe80::/128 is only in use by one router, then I'd avoid using it. fe80::/128 is a reserved anycast address, and all routers are expected to configure it by default on their interfaces (as per RFC4291, 2.6.1). I think creating a special case exception requiring it to be a unicast address in a specific scenario would be error prone and easy to forget.

So perhaps either make sure it would work if multiple routers on the link were using it as their link-local address, or pick another address to use (is the attraction its typing simplicity?)

(Somewhat related, I've thought it could be useful to statically configure on all links fe80::1, fe80::2 etc., as the routers' interface addresses, so that if you're asking an end-user to perform troubleshooting by pinging the default gateway address(es), it is easy for them to type.)

Regards,
Mark.

---

From: Ole Troan <[email-masked]>
Date: Thu, 27 Mar 2014 11:24:22 +0100

> considered as the "subnet router anycast" address for the prefix

I have always assumed that the subnet-router anycast address was for addresses of scope larger than link-local scope.
that assumption is also supported by text in RFC4291 like "The "subnet prefix" in an anycast address is the prefix that identifies a specific link.". fe80::/10 doesn't identify a particular link of course.

another related question is about the implementation status of the "subnet router anycast address" in general. does implementations support it, is the anycast address serving a purpose?

cheers,
Ole

---

From: Karl Auer <[email-masked]>
Date: Thu, 27 Mar 2014 21:48:36 +1100

On Thu, 2014-03-27 at 11:24 +0100, Ole Troan wrote:
> another related question is about the implementation status of the
> "subnet router anycast address" in general. does implementations
> support it, is the anycast address serving a purpose?

Cisco and MikroTik equipment seems to support it. whether anyone uses it
in an application is another question.

Regards, K.

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Karl Auer ([email-masked])
http://www.biplane.com.au/kauer
http://twitter.com/kauer389

GPG fingerprint: EC67 61E2 C2F6 EB55 884B E129 072B 0AF0 72AA 9882
Old fingerprint: B862 FB15 FE96 4961 BC62 1A40 6239 1208 9865 5F9A

---

From: [email-masked]
Date: Thu, 27 Mar 2014 12:04:10 +0100 (CET)

> in an application is another question.

Never heard of anybody using "subnet router anycast address".

We use traditional IPv6 anycast (same as IPv4) where one prefix is
announced from several different locations, e.g. for DNS.

Steinar Haug, AS 2116

---

From: Alexandru Petrescu <[email-masked]>
Date: Thu, 27 Mar 2014 13:42:50 +0100

> Never heard of anybody using "subnet router anycast address".

Not sure what it means this subnet router anycast address.

The 'Mobile IPv6 Home-Agents anycast' 0x7E is a reserved subnet anycast 
identifier for a subnet anycast address.

That is used by the DHAAD part of the Mobile IPv6 specification

The 'scope' of an anycast address for the HAs, if one can say 'scope' 
for 'anycast', is actually a link, yet the prefix is not fe80, but a 
globally unique prefix.

This anycast address is implemented in a very straightforward manner.

A node in the Internet sends a DHAAD Request to this anycast address and 
it is transmitted as unicast until the last hop.  On the last hop - a 
link - this packet is going to be transmitted to only one HA (among 
several HAs present on the link), depending on the ND resolving that 
address. (each HA has the anycast address assigned on its iface, but 
only one responds to NS, because earlier they have sync'ed themselves 
about who's _the_ HA).

Alex

---

From: "Templin, Fred L" <[email-masked]>
Date: Thu, 27 Mar 2014 16:16:55 +0000

Hi Mark,

> From: Mark ZZZ Smith [mailto:[email-masked]]
> Sent: Thursday, March 27, 2014 1:31 AM
> To: Templin, Fred L; [email-masked]
> Subject: Re: fe80::/128
> 
> Hi Fred,
> 
> 
> I don't really know, I suppose it depends on whether any of the ND etc. related functions assume the
> link-local source address is unique and is an unicast address and can therefore be used to uniquely
> identify a router. I'd think that likely.
> 
> The comment I would make though is that if it is a requirement that in your scenario the use of
> fe80::/128 is only in use by one router, then I'd avoid using it. fe80::/128 is a reserved anycast
> address, and all routers are expected to configure it by default on their interfaces (as per RFC4291,
> 2.6.1). I think creating a special case exception requiring it to be a unicast address in a specific
> scenario would be error prone and easy to forget.

I'm not sure what common router implementations currently do with fe80::/128.
Do they really assign it to their router interfaces, or do they do nothing
with it at all? Is fe80::/128 really a reserved anycast address, or is it
a "nothing" and not specified at all by the specs? Do we need an update to
RFC4291 telling what to do with fe80::/128?

> So perhaps either make sure it would work if multiple routers on the link were using it as their link-
> local address, or pick another address to use (is the attraction its typing simplicity?)
> 
> (Somewhat related, I've thought it could be useful to statically configure on all links fe80::1,
> fe80::2 etc., as the routers' interface addresses, so that if you're asking an end-user to perform
> troubleshooting by pinging the default gateway address(es), it is easy for them to type.)

AERO is currently using fe80::1, but I was contemplating changing that to
fe80::0. But, some of the comments from yourself and other responders have
me wondering whether that would be a good idea.

Thanks - Fred

---

From: "Templin, Fred L" <[email-masked]>
Date: Thu, 27 Mar 2014 16:20:10 +0000

Hi Ole,

> From: Ole Troan [mailto:[email-masked]]
> Sent: Thursday, March 27, 2014 3:24 AM
> To: Templin, Fred L
> Cc: Hosnieh Rafiee; 6man WG
> Subject: Re: fe80::/128
> 
> that assumption is also supported by text in RFC4291 like "The "subnet prefix" in an anycast address
> is the prefix that identifies a specific link.". fe80::/10 doesn't identify a particular link of
> course.

I think I can buy your explanation, but then is fe80::/128 a legitimate
link-local address or is it a "nothing" not to be used for any purposes?
Either way, should there be documentation explaining its use or non-use?
 
> another related question is about the implementation status of the "subnet router anycast address" in
> general. does implementations support it, is the anycast address serving a purpose?

I don't know; maybe others can comment.

Thanks - Fred

---

From: Tandankwa STANLEY Fon <[email-masked]>
Date: Thu, 27 Mar 2014 23:48:08 -0700 (PDT)

Mark,
Just to say that from what i have experinmented, IPv6 nodes are not fixed with particular default gateways. The nodes can use any of the routers as their gateway depending on which router's RA they are acting upon. If i received router X RA first, then i consider the information in his message. So, i would say think of the content of the RA, ND and that of the NS to an extend and this might help to resolve the issue.

Kind Regards
Tandankwa Stanley

On Thursday, March 27, 2014 9:33 AM, "Templin, Fred L" <[email-masked]> wrote:
 
Hi Mark,

Thanks - Fred

---

From: Karl Auer <[email-masked]>
Date: Fri, 28 Mar 2014 19:42:50 +1100

On Thu, 2014-03-27 at 23:48 -0700, Tandankwa STANLEY Fon wrote:
> Just to say that from what i have experinmented, IPv6 nodes are not
> fixed with particular default gateways. The nodes can use any of the
> routers as their gateway depending on which router's RA they are
> acting upon. If i received router X RA first, then i consider the
> information in his message. So, i would say think of the content of
> the RA, ND and that of the NS to an extend and this might help to
> resolve the issue.

I wonder if this discussion is being sent off track by some
misunderstanding about what the subnet router anycast address actually
is.

It's got nothing to do with addresses that are manually configured on
routers, or with how nodes determine what the default router is.

The subnet router anycast address is just an address that IPv6 defines
as being, at all times, that of a router on the subnet. Not all routers
on the subnet, and not any particular router on the subnet, but
definitely one of them, if one exists. From RFC 4291 section 2.6.1:

   "Packets sent to the Subnet-Router anycast address will be
    delivered to one router on the subnet. All routers are
    required to support the Subnet-Router anycast addresses
    for the subnets to which they have interfaces.

    The Subnet-Router anycast address is intended to be used 
    for applications where a node needs to communicate with any
    one of the set of routers."

If a router has multiple subnets on the same link, then it has multiple
subnet router anycast addresses on that link.

I think it works like this: Router interfaces attempt to configure
themselves with the zero address in each of their connected subnets[1].
All routers in the subnet respond to NS probes received for their subnet
router anycast addresses, but they wait a small random amount of time
before doing so. NAs for anycast addresses don't have the override flag
set, so hosts shouldn't flip between different routers unnecessarily
when using the subnet router anycast address. If the subnet router
anycast address they are using becomes unreachable for a host, the host
just does another NS and should get a response from another router.

If anyone has better info on how it is supposed to work in real life, do
please tell!

>From my very limited testing it seems that at least MikroTik and Cisco
routers participate in subnet router anycast (including supporting
fe80::/128 on each link).

Regards, K.

[1] Except for subnets with a /127 prefix, provided they support
RFC6164.

---

From: [email-masked]
Date: Fri, 28 Mar 2014 09:49:04 +0100 (CET)

>     one of the set of routers."

I have never seen this functionality *used* in real life. Anybody?

Steinar Haug, AS 2116

---

From: Tandankwa STANLEY Fon <[email-masked]>
Date: Fri, 28 Mar 2014 02:01:33 -0700 (PDT)

Correct Karl,
Concept understood.

Not yet implemented in real life.

Thanks
Tandankwa S.

Steinar Haug, AS 2116

---

From: Ole Troan <[email-masked]>
Date: Fri, 28 Mar 2014 10:04:21 +0100

Steinar,

> I have never seen this functionality *used* in real life. Anybody?

now you have:
gomlefisk:~ otroan$ ping6 fe80::%en0
PING6(56=40+8+8 bytes) fe80::1610:9fff:feda:aa1b%en0 --> fe80::%en0
16 bytes from fe80::126f:3fff:fe87:ec74%en0, icmp_seq=0 hlim=64 time=290.718 ms
16 bytes from fe80::126f:3fff:fe87:ec74%en0, icmp_seq=1 hlim=64 time=0.958 ms
16 bytes from fe80::126f:3fff:fe87:ec74%en0, icmp_seq=2 hlim=64 time=1.016 ms
16 bytes from fe80::126f:3fff:fe87:ec74%en0, icmp_seq=3 hlim=64 time=0.984 ms
16 bytes from fe80::126f:3fff:fe87:ec74%en0, icmp_seq=4 hlim=64 time=1.042 ms
^C
--- fe80::%en0 ping6 statistics ---
5 packets transmitted, 5 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 0.958/58.944/290.718/115.887 ms

apparently openwrt supports it for the link-local. no idea why.

apart from an attack vector I can't think of any real world use for it.
it is supported for the platform I know best, but require manual configuration as far as I remember.

I think the intention was for it to be used for something like finding your mobile home agent, but then they picked their own application specific anycast address on the link...

cheers,
Ole

---

From: Simon Perreault <[email-masked]>
Date: Fri, 28 Mar 2014 09:49:28 -0400

> it is supported for the platform I know best, but require manual configuration as far as I remember.

Adding to the "facts": on KAME/BSD, you need to manually add the
subnet-router anycast address to the interface for it to work. So, it
can be "supported" if the administrator needs it. Makes total sense IMHO.

Previous discussion about this here:
http://comments.gmane.org/gmane.ietf.ipv6/18602

Simon
-- 
DTN made easy, lean, and smart --> http://postellation.viagenie.ca
NAT64/DNS64 open-source        --> http://ecdysis.viagenie.ca
STUN/TURN server               --> http://numb.viagenie.ca

---

From: [email-masked]
Date: Fri, 28 Mar 2014 15:20:22 +0100 (CET)

> http://comments.gmane.org/gmane.ietf.ipv6/18602

So maybe the relevant questions are:

1. Is there any platform which enables the subnet router anycast
address by default?

2. Does anybody use the subnet router anycast address on a regular
basis? Presumably then for something more useful than Ole Troan's ping
example?

Steinar Haug, AS 2116

---

From: 神明達哉 <[email-masked]>
Date: Fri, 28 Mar 2014 08:03:39 -0700

> 1. Is there any platform which enables the subnet router anycast

Depending on the definition of "by default", FreeBSD still seems to
enable it if you configure a FreeBSD box as a router with specifying
some global prefix.  See ipv6_prefix_hostid_addr_common() of
https://github.com/freebsd/freebsd/blob/master/etc/network.subr

(It "depends on the definition" in that this is not the only of
configuring an IPv6 address for a FreeBSD router).

--
JINMEI, Tatuya

---

From: Karl Auer <[email-masked]>
Date: Sat, 29 Mar 2014 02:20:35 +1100

> 1. Is there any platform which enables the subnet router anycast

MikroTiks are pingable on the SRAA, but do not appear to listen on it
for e.g. ssh connections.

I can ping Cisco SRAAs as well, but can't test whether they are
listening for anythingmore useful.

In both cases no specific steps were taken to enable the SRAA.

> basis? Presumably then for something more useful than Ole Troan's ping

Not me.

Regards, K.

---

From: Simon Perreault <[email-masked]>
Date: Fri, 28 Mar 2014 11:34:09 -0400

> configuring an IPv6 address for a FreeBSD router).

Interesting! OpenBSD's scripts do nothing the sort.

Personally, I have never used or tried to use subnet-router anycast.

Simon

---

From: Harald Terkelsen <[email-masked]>
Date: Fri, 28 Mar 2014 18:25:52 +0100

> 1. Is there any platform which enables the subnet router anycast

Our F5 load balancer replies to NS for the subnet router anycast address 
(SRA). I also believe an A10 device i checked did the same. We have not 
found a way to disable it.

Some HTC (judged by their MAC address) wireless devices appear to enable 
the SRA address if no other device on the subnet responds to DAD 
requests for the SRA. On router interfaces with the SRA enabled, we did 
see many DAD warnings for the SRA in the logs generated by these 
clients. This is devices on students wireless subnets. We haven't had a 
chance to investigate further to see if it is by default or if it is 
enabled only when tethering.

Linux enables the SRA when you enable IPv6 forwarding. At least Ubuntu 
12.04 LTS does.

These devices appear to use both fe80:: and <global prefix>::.

> basis? Presumably then for something more useful than Ole Troan's ping

We actually used to use it as the default gateway for hosts with static 
IPv6 addresses until we discovered other devices than our main router 
also replied to NS for that address.

Harald Terkelsen
Oslo and Akershus University College of Applied Sciences

---

From: Hannes Frederic Sowa <[email-masked]>
Date: Fri, 28 Mar 2014 18:59:18 +0100

> 1. Is there any platform which enables the subnet router anycast

If you enable forwarding in Linux, subnet anycast address will get bound on
all interfaces automatically by the kernel:

$ cat /proc/net/anycast6 
2    p14p1           fe800000000000000000000000000000     1
3    p6p1            fe800000000000000000000000000000     1
...

So any router based on linux will have subnet anycast address bound by
default, so does Mikrotik/RouterOS, OpenWRT etc.

> basis? Presumably then for something more useful than Ole Troan's ping

Linux kernel 3.14 will allow applications to bind datagram sockets to
anycast addresses and use them as source address, too. Thus far, we were not
sure how to deal with TCP. It is needed if you e.g. want to properly support
a DNS server on those anycast addresses because it needs to accept request on
both protocols.

@Fred Templin:
On Linux you correctly bind to an anycast addresses via IPV6_JOIN_ANYCAST
setsockopt and don't simply add the address to an interface.

In Linux we reuse the source of the original packet as source address
for the outgoing neighbour solicitiation. So if you don't have any other
addresses available, I guess neighbour discovery will use this one (but
that will only work with kernel 3.14).

Greetings,

  Hannes

---

From: Karl Auer <[email-masked]>
Date: Sat, 29 Mar 2014 10:21:27 +1100

> 3    p6p1            fe800000000000000000000000000000     1

If those interfaces have other IPv6 prefixes on them (not just the link
local address), those prefixes should also get subnet router anycast
addresses. They do on my Linux box (and, apparently, on Cisco routers).

Regards, K.

---

From: Hannes Frederic Sowa <[email-masked]>
Date: Sat, 29 Mar 2014 09:03:54 +0100

> addresses. They do on my Linux box (and, apparently, on Cisco routers).

Yes, they do. I just deleted them from the output because of privacy
issues. ;)

Bye,

  Hannes

---

From: Hiroki Sato <[email-masked]>
Date: Sun, 30 Mar 2014 20:54:29 +0900 (JST)

[email-masked] wrote
  in <[email-masked]>:

st> > > it is supported for the platform I know best, but require manual configuration as far as I remember.
st> >
st> > Adding to the "facts": on KAME/BSD, you need to manually add the
st> > subnet-router anycast address to the interface for it to work. So, it
st> > can be "supported" if the administrator needs it. Makes total sense IMHO.
st> >
st> > Previous discussion about this here:
st> > http://comments.gmane.org/gmane.ietf.ipv6/18602
st>
st> So maybe the relevant questions are:
st>
st> 1. Is there any platform which enables the subnet router anycast
st> address by default?
st>
st> 2. Does anybody use the subnet router anycast address on a regular
st> basis? Presumably then for something more useful than Ole Troan's ping
st> example?

 I sometimes use subnet router anycast address as the default router
 on BSD when RA cannot be used on that link.  First I used a fixed
 link-local address like fe80::1 for this purpose but subnet router
 anycast address is useful when there are multiple routers on that
 link for fail-over.

-- Hiroki

---

From: Hiroki Sato <[email-masked]>
Date: Sun, 30 Mar 2014 02:24:03 +0900 (JST)

[email-masked] wrote

 I sometimes use subnet router anycast adddress as the default router
 on BSD when RA cannot be used on that link.  First I used a fixed
 link-local address like fe80::1 for this purpose but subnet router
 anycast adddress is useful when there are multiple routers on that
 link for fail-over.

-- Hiroki