Subject: RE: [Softwires] applicability of softwires inside ISP's *own* network

From: "Durand, Alain" <[email-masked]>
Date: Wed, 7 Sep 2005 12:59:31 -0400

The important keyward in your description is "dynamic".

Imho, there is a wide range between full manual config and full
automatic, dynamic config of tunnels.
In between those two extremes, there are "assisted" configured tunnels,
where the softwire protocol could be used to help setting up the tunnels
in a process that would be less error-prone than manual config and that
will garantee that the configuration is correct both ways.
I have seen too many tunnel that were half set-up, half down that were
creating nightmares...

   - Alain.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Pekka Savola
> Sent: Wednesday, September 07, 2005 12:47 PM
> To: [email-masked]
> Subject: [Softwires] applicability of softwires inside ISP's 
> *own* network
> 
> Hi,
> 
> During the meeting, Sprint seemed to present the need to be 
> able to use the tunnel broker for their v6-in-v4 tunnels.  I 
> was not sure, but similar but for v4-in-v6 might have been 
> there for CERNET.
> 
> If I understood these requirements correctly (please correct 
> me if wrong), both Sprint and CERNET were looking for a 
> dynamic mechanism to be used within a single ISP's backbone 
> (within an autonomous system, in relatively stable topology).
> 
> In other words, a mechanism to automatically set huge 
> vX-in-vY tunnel meshes between their backbone routers using a 
> dynamic protocol.
> 
> I specifically don't see the need for the softwire protocol 
> in this kind of "tunnel mesh" context.
> 
> Specifically, I think the creation of tunnel meshes is undesirable
> because:
> 
>   1) mesh creation is no different than the typical operational
>      practises today e.g., wrt the set-up of iBGP sessions.  The same
>      techniques apply.  No protocol is needed here.
>   2) dynamic set-up is more failure-prone than manual 
> configuration; as
>      an ISP, I definitely want to configure the tunnels between my own
>      routers manually so I know that they will always work as 
> expected.
>   3) a broker setting up tunnels between all the routers also has
>      significant securiy implications.
> 
> So, I don't see the applicability of softwires for tunnels 
> set up inside an ISP's own network.  I suggest that this 
> scenario be explicitly stated to be out of scope.
> 
> On the other hand, yes, I think a softwire protocol is useful 
> between an ISP and a dynamic customer (typically a single 
> user, home, or SOHO but not large customers because these are 
> more static) where manually configured tunnels are not feasible.
> 
> -- 
> Pekka Savola                 "You each name yourselves king, yet the
> Netcore Oy                    kingdom bleeds."
> Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
> 
> _______________________________________________
> Softwires mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/softwires
> 

_______________________________________________
Softwires mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/softwires

---

From: Pekka Savola <[email-masked]>
Date: Wed, 7 Sep 2005 21:49:44 +0300 (EEST)

> I have seen too many tunnel that were half set-up, half down that were

I think I'd need to see a more detailed case of "assisted" configured 
tunnels to see if I agree or not.

Right now, I can see two cases where this might give some benefit.  Do 
you have some others in mind?

   1) if the encapsulation included some automatic keepalive, so that 
the operators would automatically get "interface oper up/down" 
notifications, preventing some misconfigurations.

Personally, I don't buy this as a convincing argument, as the 
operators want to have even better OAM capabilities -- an assurance 
that traffic actually works, not just that interface is up/down. (We 
do that by running pings and traceroutes across all the links on our 
network, and I'd suspect any serious ISP would do the same in any 
case.)

   2) if each router would have a "tunnel service" open to the ISP or 
even the whole world, which would allow setting up a tunnel from 
arbitrary router A to such a router just by adding configuration at 
router A (and not at the tunnel service router).

I think such a service for ISP-internal tunnels is a bad idea from 
security and management perspective, and I would not encourage this 
solution for this purpose.

...

And I think solutions for 1) and 2) already exist, called [GRE 
keepalives for 1)] and L2TP.  No need to target the softwire protocol 
for this market.