Subject: RE: comment on unmanaged analysis presentation/doc

From: "Bound, Jim" <[email-masked]>
Date: Thu, 19 Sep 2002 14:10:16 -0400

clearly making the tsp spec (converged marc/fred) is our mission.
and setting up explicit tunnels is required for deployment right now.

the key is if the chairs can bless this work and say lets go and do tsp.  Or if I were marc and fred I would be hard pressed into putting a lot of work into this.

/jim

> -----Original Message-----
> From: Love [mailto:[email-masked]]
> Sent: Thursday, September 19, 2002 1:58 PM
> To: Bound, Jim
> Cc: Pekka Savola; Marc Blanchet; [email-masked];
> [email-masked]; [email-masked]
> Subject: Re: comment on unmanaged analysis presentation/doc
> 
> 
> "Bound, Jim" <[email-masked]> writes:
> 
> > Marc did explicitly ask that TSP be a v6ops mechanism for 
> discussion.
> > 
> > To address that question with my input.
> > 
> > I believe TSP is an important tool for users.  I believe we 
> can begin
> > work on this tool within v6ops and support it being worked 
> on within this
> > list.
> > 
> > Others should respond here with your opinion and this is 
> important per
> > Margarets talk today.  One way or the other.
> 
> There are issues with tsp-draft as it is today, I've sent 
> some comments to
> the authors.
> 
> I think tsp is good tool when you want to set up explicit tunnels.
> 
> Love
>

---

From: Margaret Wasserman <[email-masked]>
Date: Thu, 19 Sep 2002 14:19:38 -0400

Hi Jim,

>the key is if the chairs can bless this work and say lets go and do 
>tsp.  Or if I were marc and fred I would be hard pressed into putting a 
>lot of work into this.

It isn't covered in our charter to "bless" any new transition mechanisms
work unless/until the need for a new mechanism is identified and document
in the scenario/analysis effort.

If we keep pushing on the analysis documents, I hope we will get to a
point in the next few months where we do have consensus to start work
on some of the needed transition mechanisms.  But, we aren't there
yet.

We will also need to make sure that we understand how the existing transition
mechanisms RFCs do/don't fit together, so that we understand the impact
of introducing new mechanisms into the overall architecture.

Margaret

---

From: "Bound, Jim" <[email-masked]>
Date: Thu, 19 Sep 2002 14:30:26 -0400

Margaret,

OK.  So the general Internet community cannot send individual IDs for tools to v6ops?
I view tsp as tool not as transition mechanism?

thanks
/jim

> From: Margaret Wasserman [mailto:[email-masked]]
> Sent: Thursday, September 19, 2002 2:20 PM
> To: Bound, Jim
> Cc: Love; Pekka Savola; Marc Blanchet; [email-masked];
> Subject: RE: comment on unmanaged analysis presentation/doc
> 
> 
> 
> Hi Jim,
>

---

From: Margaret Wasserman <[email-masked]>
Date: Thu, 19 Sep 2002 14:38:00 -0400

Jim,

What do you mean by "send individual IDs for tools to v6ops"?

Anyone can submit an individual ID, but v6ops may not adopt a work
item (i.e. publish a WG ID) that isn't covered in our charter.

Margaret

---

From: "Bound, Jim" <[email-masked]>
Date: Thu, 19 Sep 2002 14:53:52 -0400

Margaret,

draft-privatename-function-00.txt.  

But what I think I am hearing is that we have a potential log jam via the scenarios being done?  I do not believe those will be done till July/August 2003?  Thats too late for current IPv6 deployment if true?

thanks
/jim

> Sent: Thursday, September 19, 2002 2:38 PM
> To: Bound, Jim
> >OK.  So the general Internet community cannot send 
> individual IDs for 
> >tools to v6ops?

---

From: "Fred L. Templin" <[email-masked]>
Date: Fri, 20 Sep 2002 17:34:47 -0700

Erik Nordmark wrote:
 > While I won't comment on TSP vs. some other way of explicitly configuring
 > tunnels, I'll make a more general comment.

I don't know what other ways you have in mind, but as a technologist I must
admit that I do see merits in the TSP approach.

 > I'm very concerned about trying to fully automate tunnel setup (whether
 > over IPv4 NATs or just plain old IPv4) due to the trust and security issues.
 > Thus I think it makes sense to have an authenticated and properly authorizable
 > tunnel establishment method that can work whether or not there is an
 > IPv4 NAT in the path.

I think we will soon need to be careful about how we define the term
"automatic tunnel". Marc Blanchet has introduced a new term "semi-automatic"
tunnel into the discussion to refer to the process of automating configured
tunnel setup (am I representing this properly, Marc?)

I have been struggling with the cumbersome terminology this imparts, i.e.,
we now have "semi-automatic configured tunnels" and we may one day also have
"semi-automatic-automatic tunnels". It might help to look to the characteristics
of the two different mechansims:

"Configured" tunnels, as we know them today, are (in part) defined to
"...behave as virtual point-to-point links" [MECH, 1.1]. "Automatic" tunnels,
as we know them today, are understood to behave as virtual point-to-multi-
point links. But, both point-to-point and point-to-multipoint virtual links
may benefit from "semi-automatic" explicit configuration mechanisms such as
TSP.

 > The operational model for this is that the user establishes a trust
 > relationship with the tunnel provider and uses this to establish and maintain
 > the tunnel automatically.

My individual submission entitled "ISATAP interactions with TSP" explores
possible benefits for using TSP with ISATAP, including exactly the sort of
trust relationship you describe above. It is possible that these same benefits
may extend to the general case of point-to-multipoint virtual links, but I'm
not prepared to make any claims in that regard. The draft can be found at:

   http://www.ietf.org/internet-drafts/draft-templin-interact-00.txt

 > I think this can be made really simple but yet secure.

As above, as a technologist I admit that I do see merits in this approach.

Fred
[email-masked]

---

From: "Bound, Jim" <[email-masked]>
Date: Mon, 23 Sep 2002 10:02:43 -0400

yes they are and this was provided as input to 6to4 from me and others on my team.
/jim

> From: Erik Nordmark [mailto:[email-masked]]
> Sent: Monday, September 23, 2002 9:33 AM
> To: Jun-ichiro itojun Hagino
> Cc: Erik Nordmark; [email-masked]
> > 	in that case, what is your comment to 6to4 routers?  they accept
> > 	tunnelled packet from anyone, with no authentication whatsoever.
> 
> You mean 6to4 relay (routers)?
> 6to4 routers should only accept tunneled packets from their configured
> relay(s).
> 
> I think the relays are quite problematic because of this behavior.
> 
>   Erik
> 
> 
> 
>

---

From: Keith Moore <[email-masked]>
Date: Mon, 23 Sep 2002 15:09:16 -0400

> wow!  keith advocates pure nat!

nope.  keith advocates tunneling of v6 over v4 as an alternative to nat.