Subject: [mobile-ip] IPv6 ingress filtering early access

From: Francis Dupont <[email-masked]>
Date: Wed, 26 Dec 2001 19:25:16 +0100

I have written a draft about IPv6 ingress filtering (with home address
option considerations). It is not finished (some editing is needed) but
I have put it for early access on (sorry for the long line):

ftp://ftp.ipv6.rennes.enst-bretagne.fr/pub/draft-dupont-ipv6-ingress-filtering-00.txt

I'll collect comment(s) in one week because me, the I-D editor and perhaps
my co-author are on holidays.

Happy new year!

[email-masked]

---

From: "Jari Arkko" <[email-masked]>
Date: Wed, 26 Dec 2001 21:38:53 +0200

> ftp://ftp.ipv6.rennes.enst-bretagne.fr/pub/draft-dupont-ipv6-ingress-filtering-00.txt

Nice draft, thanks for taking the time to write down the problems and
their alternative solutions. Hope you still had time for Christmas ;-)

I have a few comments.

First, it seems that the main alternatives we have is (a) restrict MIPv6
functionality by removing intermediate alternatives between bidirectional
tunneling and route optimisation, or (b) deploy AAA to help visited networks
figure out what are legal home addresses. 

It is interesting to note the different actors in these two alternatives. In the
first alternative, it is the CN who is taking the responsibility, and requiring
no help whatsoever from the firewalls in between. In the second alternative,
we put all the trust on the firewalls/routers of sites, and none of the CNs do
any worrying over this anymore. Both solutions work if applied allover, and
the second solution allows the current MIPv6 flexibility, being therefore the
preferred solution if seen feasible.

However, I'm concerned about the "applied allover" part. Specifically - while
I'm very much fond of the AAA solutions - I'm concerned whether we can expect
all parts of the Internet to have an infrastructure that really can figure out the
home addresses. What if there's a coin-operated (or Visa-) airport WLAN?
With no connection to a global roaming association of who owns what addresses.
What kind of filtering should that do? Prohibit everything else expect bidirectional
tunneling, or allow home addresses to be used? If latter, then the trusting
CNs don't have a clue that they could be used as reflectors...

Finally, I seem to remember there was a discussion a long time ago whether
we could somehow provide automatic, mandatory, ingress filtering in IPv6.
If such a feature were possible, it would really make setting up networks easier
and denial of service attacks easier to trace. Do you think this would be
feasible? If yes, perhaps it should also be discussed in the draft. Currently,
we are headed towards the same situation as in IPv4 where ingress filtering
is only partially applied, and we keep coming up with "patch" solutions such
as I-trace to help the situation. Interestingly, these solutions typically need
changes to a large fraction of the routers in the Internet which we already are
doing anyway to move to IPv6...

Jari

---

From: Pekka Savola <[email-masked]>
Date: Thu, 27 Dec 2001 14:38:10 +0200 (EET)

> ftp://ftp.ipv6.rennes.enst-bretagne.fr/pub/draft-dupont-ipv6-ingress-filtering-00.txt

Looks rather good .. even though we may not agree on the AAA issues, this 
seems to bring them up rather nicely :-).

About section 2 on Correspondent Nodes; could you elaborate in the 
document why exactly solution is too drastic?  Note that BCE check is not 
the only way to ensure legitimity of HAO: if it's secured by AH, it's ok;  
if some SUCV/.. weak authentication method is used, it's probably also ok; 
the same might even apply to return routability.  It's too early to crush 
CN solutions.

(I think the solution for HAO should most likely consist of two separate, 
"strong-enough" layers, one mandated at CN, one possible at firewalls, but 
that's not the topic of this draft).

Note: it seems every site, even if it had only a few MN's, will have to
have AAA infrastructure, so that it could interact, certify etc. home
address use for remote AAA systems when MN goes roaming and there's a need
to punch a hole in ingress filtering of remote sites.

(If this is the approach for security, it should be required in the main
MIPv6 draft).

Or have I missed something?  This seems unnecessary in many environments,
e.g. university campus area WLAN or company's internal network.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Markku Savela <[email-masked]>
Date: Thu, 27 Dec 2001 14:52:32 +0200

I may have missed some discussion due to high volume on this topic,
but I like to inject one scenario of Home Address option use...

  If MN and CN have IPSEC session between them, then I
  suppose HAO within such session is safe. (I leave it open for now,
  whether the session should be between care of addresses or home
  addresses of MN and CN, but either should work?).

-- 
Markku Savela <[email-masked]>