Subject: Re: [v6ops] Weekly Review: draft-ietf-v6ops-transition-ipv4aas

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Thu, 09 Aug 2018 10:39:13 -0500

Hi Alejandro,

I think this may sort out your requirement:

   TRANS-6:  The IPv6 Transition CE Router MAY have multiple IPv4

             prefixes to be used in different customer-facing

             interfaces, and the IPv6 Transition CE Router MUST support

             multiple instances of the relevant transition mechanism

             code, to allow configuring them.

Do you agree?

Regards,

Jordi

-----Mensaje original-----

De: Alejandro D'Egidio <[email-masked]>

Fecha: martes, 31 de julio de 2018, 15:55

Para: JORDI PALET MARTINEZ <[email-masked]>

CC: Ron Bonica <[email-masked]>, "[email-masked] list" <[email-masked]>

Asunto: Re: [v6ops] Weekly Review: draft-ietf-v6ops-transition-ipv4aas

    Hello Jordi,

      My notes in lines.

    Regards,

    Alejandro

    ----- Mensaje original -----

    > De: "JORDI PALET MARTINEZ" <[email-masked]>

    > Para: "Alejandro Degidio" <[email-masked]>, "Ron Bonica" <[email-masked]>

    > CC: "[email-masked] list" <[email-masked]>

    > Enviados: Lunes, 30 de Julio 2018 20:58:52

    > Asunto: Re: [v6ops] Weekly Review: draft-ietf-v6ops-transition-ipv4aas

    > Hi Alejandro,

    > Thanks for the input!

    > I think it is easy to understand:

    > "This document covers a set of IP transition techniques required when

    >   ISPs have an IPv6-only access network."

    > even if the ISP already have an IPv6-only access network, or want to have it.

    > But this may be something that a native English speaker could tell us how better

    > to say it. May be:

    > "This document covers a set of IP transition techniques required when

    >   ISPs have or want to move to an IPv6-only access network."

    Yes, it's great.

    > I'd some text in earlier versions about the reasons to have an IPv6-only access

    > network, but it was suggested to move it to the Annex A ... not sure if you

    > read them also. I'm happy to add some more text, if needed to the annex A to

    > describe several possible reasons.

    Yes, I've read all the document included the Annexes.

    > The case for having multiple IPv4 subnets (one for each interface), is feasible,

    > as you say, by having multiple instances of the NAT46, which I think is not a

    > problem.

    > However, open question is valid also for any other IPv4aaS mechanism.

    > I'm not sure if we want to have that case considered as something that MUST be

    > supported as one more requirement, and if this is the case, it will be a

    > "general" transition requirement, and no need to go in the details for each

    > transition mechanism, or we really want to go to describe a specific new

    > requirement for this for each transition mechanism ...

    Just knowing that a CPE can have different LAN IPv4 prefixes I was thinking that maybe it could be considered in General transition requirements with something like:

    "TRANS-6: The IPv6 Transition CE Router MAY have different IPv4 prefixes on each Customer-Facing interfaces and the transition mechanisms MUST have options to be compatible with it."

    > What others think?

    > Regards,

    > Jordi

    >-----Mensaje original-----

    > De: v6ops <[email-masked]> en nombre de Alejandro D'Egidio

    > <[email-masked]>

    > Fecha: lunes, 30 de julio de 2018, 10:39

    > Para: Ron Bonica <[email-masked]>

    > CC: "[email-masked] list" <[email-masked]>

    > Asunto: Re: [v6ops] Weekly Review: draft-ietf-v6ops-transition-ipv4aas

    >    Hello Ron,

    >    I really like this draft!

    >    Just a simple comment.

    >    Where says:

    >    This document covers a set of IP transition techniques required when

    >    ISPs have an IPv6-only access network.

    >    Maybe could say:

    >    This document covers a set of IP transition techniques required when

    >    ISPs wants to have an IPv6-only access network.

    >    Maybe you can include some example of why ISPs wants to have an IPv6 only access

    >    network.

    >    For example, in my case, as we don't have more public IPv4 addresses and we have

    >    IPv6 developed, why should I need to continue managing IPv4 addresses?

    >    Maybe some kind of this scenario could be included.

    >    Regarding 3.2.1.  464XLAT:

    >    Cablelabs defines that the CableModem must subnet the IPv6 Prefix received from

    >    ISP to use different subnets on each LAN Interface. The size of IPv6 "sub"

    >    prefix on each LAN depends on is ISP configured the CM to use either favor

    >    depth or favor width. If ISP provides just a /64 IPv6 prefix (which is not

    >    recommended) CM must share it with all LAN interfaces.

    >    For IPv4, by the same private IPv4 prefix is shared between all LAN interfaces

    >    (customer-facing interfaces). For this case I think it "3.2.1.  464XLAT" is ok.

    >    There are some cases where CM could have different private IPv4 prefixes to each

    >    customer-facing interfaces. So I think, this is another scenario that should be

    >    covered where CLAT will need to work with all the IPv4 LAN prefixes. Maybe

    >    running multiple instances of its NAT46 (one for each LAN interface) or one

    >    instance supporting multiple IPv4 addresses.

    >    All this is in:

    >    https://apps.cablelabs.com/specification/ipv4-and-ipv6-erouter-specification/

    >    Regards,

    >    ALEJANDRO D'EGIDIO

    >    Jefe de Ingeniería de Backbone | Dirección de Ingeniería

    >    M: [ callto:+54 911 5794-1589 | +54 911 5794-1589 ] | F: [ callto:+54 11

    >    3977-1025 | +54 11 3977-1025 ] | [ mailto:[email-masked] |

    >    [email-masked] ]

    >    Pje. Lavardén 157. Piso 3. CABA (C1437FBC)

    >    ----- Mensaje original -----

    >    De: "Ron Bonica" <[email-masked]>

    >    Para: "[email-masked] list" <[email-masked]>

    >    Enviados: Lunes, 30 de Julio 2018 10:12:50

    >    Asunto: [v6ops] Weekly Review: draft-ietf-v6ops-transition-ipv4aas

    >    Folks,

    >    Each week between now and IETF 103, we will review and discuss one draft with an

    >    eye towards progressing it.

    >    This week, please review and comment on draft-ietf-v6ops-transition-ipv4aas.

    >                                                    Fred and Ron

    >    _______________________________________________

    >    v6ops mailing list

    >    [email-masked]

    >    https://www.ietf.org/mailman/listinfo/v6ops

    >    _______________________________________________

    >    v6ops mailing list

    >    [email-masked]

    >    https://www.ietf.org/mailman/listinfo/v6ops

    > **********************************************

    > IPv4 is over

    > Are you ready for the new Internet ?

    > http://www.consulintel.es

    > The IPv6 Company

    > This electronic message contains information which may be privileged or

    > confidential. The information is intended to be for the exclusive use of the

    > individual(s) named above and further non-explicilty authorized disclosure,

    > copying, distribution or use of the contents of this information, even if

    > partially, including attached files, is strictly prohibited and will be

    > considered a criminal offense. If you are not the intended recipient be aware

    > that any disclosure, copying, distribution or use of the contents of this

    > information, even if partially, including attached files, is strictly

    > prohibited, will be considered a criminal offense, so you must reply to the

    > original sender to inform about this communication and delete it.

**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.consulintel.es
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

---

From: Alejandro D'Egidio <[email-masked]>
Date: Thu, 9 Aug 2018 15:07:14 -0300 (ART)

Hello Jordi,
  Yes, I agree.
  Thanks for considering that.

Regards,
Alejandro

----- Mensaje original -----
De: "JORDI PALET MARTINEZ" <[email-masked]>
Para: "Alejandro Degidio" <[email-masked]>
CC: "Ron Bonica" <[email-masked]>, "[email-masked] list" <[email-masked]>
Enviados: Jueves, 9 de Agosto 2018 12:39:13
Asunto: Re: [v6ops] Weekly Review: draft-ietf-v6ops-transition-ipv4aas

Hi Alejandro,

Do you agree?

Regards,

Jordi

-----Mensaje original-----

    Hello Jordi,

      My notes in lines.

    Regards,

    Alejandro

    ----- Mensaje original -----

    Yes, it's great.

---

From: "STARK, BARBARA H" <[email-masked]>
Date: Thu, 9 Aug 2018 19:29:52 +0000

>              code, to allow configuring them.

This proposed sentence structure logically resolves to *always* requiring support for multiple instances. I don't think this is appropriate (e.g., for a simple router that only supports a single LAN IPv4 interface and single WAN IPv4 interface), and perhaps it's not what's intended. The sentence is also very difficult to parse and I'm not at all sure I understand what it's trying to say.

Is this saying that if the CE router has, for example, a Guest Wi-Fi IPv4 subnet and a "home" Wi-Fi IPv4 subnet (both to the LAN), that it must instantiate 2 instances of (for example) DS-Lite? What if the ISP doesn't allow more than one instance? How is the ISP supposed to signal whether more than one is allowed? Why would 2 instances be required? 
Would this apply to the case where the router simply supports 2 LAN segments as different subnets? 
I'm sorry, but I'm really not understanding what condition is being described.

As for resolving the logical sentence structure, I would suggest wording the requirement as "If <condition related to multiple IPv4 LAN prefixes>, then the IPv6 Transition CE Router MUST <whatever must be done>." If you want to explain why this requirement exists, make that a separate sentence, such as "This will allow separate configuration of the transition mechanism instances."
Barbara

> De: Alejandro D'Egidio <[email-masked]>
.... snipping relevant text.....
>     > as you say, by having multiple instances of the NAT46, which I think is not
> a problem.
>     > I'm not sure if we want to have that case considered as something that
> MUST be supported as one more requirement, and if this is the case, it will be a
>     > "general" transition requirement, and no need to go in the details for
> each transition mechanism, or we really want to go to describe a specific new
>     Just knowing that a CPE can have different LAN IPv4 prefixes I was thinking
> that maybe it could be considered in General transition requirements with
> something like: 
> 
>     "TRANS-6: The IPv6 Transition CE Router MAY have different IPv4 prefixes
> on each Customer-Facing interfaces and the transition mechanisms MUST
> have options to be compatible with it."

---

From: Alejandro D'Egidio <[email-masked]>
Date: Thu, 9 Aug 2018 16:44:43 -0300 (ART)

Hi Barbara,

Maybe the text could say "and the IPv6 Transition CE Router MUST support it to allow configuring them."

The truth is that CPE, at least Cablemodems, could have different subnets on each customer-facing interface. The idea is that Transition Mechanism supports that (many IPv4 addresses of differents LAN interfaces).

Regards,
Alejandro

----- Mensaje original -----
> De: "STARK, BARBARA H" <[email-masked]>
> Para: "JORDI PALET MARTINEZ" <jordi.palet=[email-masked]>, "Alejandro Degidio"
> Enviados: Jueves, 9 de Agosto 2018 16:29:52
> Asunto: RE: [v6ops] Weekly Review: draft-ietf-v6ops-transition-ipv4aas

> This proposed sentence structure logically resolves to *always* requiring
> support for multiple instances. I don't think this is appropriate (e.g., for a
> simple router that only supports a single LAN IPv4 interface and single WAN
> IPv4 interface), and perhaps it's not what's intended. The sentence is also
> very difficult to parse and I'm not at all sure I understand what it's trying
> to say.
> 
> Is this saying that if the CE router has, for example, a Guest Wi-Fi IPv4 subnet
> and a "home" Wi-Fi IPv4 subnet (both to the LAN), that it must instantiate 2
> instances of (for example) DS-Lite? What if the ISP doesn't allow more than one
> instance? How is the ISP supposed to signal whether more than one is allowed?
> Why would 2 instances be required?
> As for resolving the logical sentence structure, I would suggest wording the
> requirement as "If <condition related to multiple IPv4 LAN prefixes>, then the
> IPv6 Transition CE Router MUST <whatever must be done>." If you want to explain
> why this requirement exists, make that a separate sentence, such as "This will
> allow separate configuration of the transition mechanism instances."
> Barbara
>

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Thu, 09 Aug 2018 14:59:24 -0500

Hi Barbara,

Your SSID example is the perfect one about the need for this and I don't think anything is needed in the ISP side.

Fred suggested a small change, and I'm trying to figure out how to combine that with your comment as well. I think this can make it:

The IPv6 Transition CE Router MAY support multiple IPv4 prefixes 

on its various customer-facing interfaces. In that case, it MUST 

support configuration of multiple instances of the relevant code 

of the transition mechanism and/or appropriate subnetting 

on each such interface.

For example, if the ISP provides a 192.168.0.0/16 to the CE (section 4.2 of DS-Lite, RFC6333), each interface will get different subnet mask, as the user don't need 16 bits for each interface ...

In the case of lw4o6, the CE it is running its own NAT, so no issues.

In the case of 464XLAT, you just need multiple instances of the NAT46 (so is equivalent to the case of the lw4o6).

Etc.

So, basically it is either a different instance and/or subnet mask configuration.

Regards,

Jordi

-----Mensaje original-----

De: v6ops <[email-masked]> en nombre de "STARK, BARBARA H" <[email-masked]>

Fecha: jueves, 9 de agosto de 2018, 14:31

Para: 'JORDI PALET MARTINEZ' <jordi.palet=[email-masked]>, Alejandro D'Egidio <[email-masked]>

    Barbara

    >     > The case for having multiple IPv4 subnets (one for each interface), is

    > feasible,

    v6ops mailing list

    [email-masked]

---

From: Fred Baker <[email-masked]>
Date: Thu, 9 Aug 2018 13:23:40 -0700

I sent this to Jordi privately. Would you agree with my construction?
————————————————/

English is your second language, and you do very well in it. However, as a native speaker, may I offer a friendly amendment?

TRANS-6:
The IPv6 Transitional Router MAY be configured with multiple IPv4 prefixes on its various customer-facing interfaces.
When so configured, it MUST support configuration of different transition mechanisms on each such interface.

> On Aug 9, 2018, at 8:39 AM, JORDI PALET MARTINEZ <jordi.palet=[email-masked]> wrote:
> 
> Hi Alejandro,
> 
> 
> 

--------------------------------------------------------------------------------
The fact that there is a highway to hell and a stairway to heaven is an interesting comment on projected traffic volume...

---

From: "STARK, BARBARA H" <[email-masked]>
Date: Thu, 9 Aug 2018 20:32:47 +0000

> The truth is that CPE, at least Cablemodems, could have different subnets on
> each customer-facing interface. The idea is that Transition Mechanism
> supports that (many IPv4 addresses of differents LAN interfaces). 

Hi Alejandro,
Yes, there are many simple CE routers that support multiple LAN subnets, today. The multiple LAN IPv4 interfaces today may be supported by a single "native" WAN IPv4 interface, or potentially they could each have their own "native" WAN IPv4 interface (e.g., by using separate VLANs). Note that this second case tends to occur mainly when the  ISP is supplying a specialized CE router for use with their service. It is uncommon in "generic" CE routers. Where multiple LAN segments all share the same "native" WAN IPv4 connection today, I would expect them to continue to do so when the IPv4 connection is tunneled. This should not be prohibited. We should not be requiring all routers that support more than one subnet to support multiple WAN IPv4 interfaces. If a Cablemodem does, that's fine. If a retail Linksys router supports multiple LAN subnets but just a single WAN IPv4 interface, that should be fine, too. 

The proposed requirement seems to be saying the CE router MUST maintain a separate WAN IPv4 tunneled interface for each distinct LAN subnet. If that is what it is saying, then I disagree this is a requirement for all routers. If that is not what it is saying, then the words need to be changed.
Barbara
 
> > Para: "JORDI PALET MARTINEZ"
> <jordi.palet=[email-masked]>, "Alejandro Degidio"
> > This proposed sentence structure logically resolves to *always*
> > requiring support for multiple instances. I don't think this is
> > appropriate (e.g., for a simple router that only supports a single LAN
> > IPv4 interface and single WAN
> > IPv4 interface), and perhaps it's not what's intended. The sentence is
> > also very difficult to parse and I'm not at all sure I understand what
> > it's trying to say.
> >
> > Is this saying that if the CE router has, for example, a Guest Wi-Fi
> > IPv4 subnet and a "home" Wi-Fi IPv4 subnet (both to the LAN), that it
> > must instantiate 2 instances of (for example) DS-Lite? What if the ISP
> > doesn't allow more than one instance? How is the ISP supposed to signal
> whether more than one is allowed?
> > As for resolving the logical sentence structure, I would suggest
> > wording the requirement as "If <condition related to multiple IPv4 LAN
> > prefixes>, then the
> > IPv6 Transition CE Router MUST <whatever must be done>." If you want
> > to explain why this requirement exists, make that a separate sentence,
> > such as "This will allow separate configuration of the transition mechanism
> instances."
> > Barbara
> >
> >>     > as you say, by having multiple instances of the NAT46, which I
> >> think is not a problem.
> >>     > I'm not sure if we want to have that case considered as
> >> something that MUST be supported as one more requirement, and if this
> is the case, it will be a
> >>     > "general" transition requirement, and no need to go in the
> >> details for each transition mechanism, or we really want to go to describe
> a specific new
> >>     Just knowing that a CPE can have different LAN IPv4 prefixes I
> >> was thinking that maybe it could be considered in General transition
> >> requirements with something like:
> >>
> >>     "TRANS-6: The IPv6 Transition CE Router MAY have different IPv4
> >> prefixes on each Customer-Facing interfaces and the transition
> >> mechanisms MUST have options to be compatible with it."

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Thu, 09 Aug 2018 15:33:17 -0500

Hi Fred,

After responding to you and reading Barbara comment I realized, that your 2nd part doesn't work ...

It is not about "multiple" transition mechanisms, it is about, it is about multiple IPv4 ranges, so subnetting (and may be several NAT or NAT46 instances).

We explicitly decided not to consider that a single CE will simultaneously run several transition mechanisms, because that may create a number of conflicts, that doesn't make sense to take into consideration.

(section 3.2)

  This document takes no position on simultaneous operation of one or

   several transition mechanisms and/or native IPv4.

An ISP may want to have different customers in different "transition stages" (from dual stack to IPv4aaS, or from one IPv4aaS to another), but simultaneously the same CE ?

So that's why I proposed this:

on each such interface.

Regards,

Jordi

-----Mensaje original-----

De: v6ops <[email-masked]> en nombre de Fred Baker <[email-masked]>

Fecha: jueves, 9 de agosto de 2018, 15:24

Para: <[email-masked]>, <[email-masked]>

    ————————————————/

    TRANS-6:

    v6ops mailing list

    [email-masked]

---

From: Fred Baker <[email-masked]>
Date: Thu, 9 Aug 2018 13:39:00 -0700

No problem. Massage it appropriately. That goes to the clarity of the language I was trying to restate ;-)

Sent using a machine that autocorrects in interesting ways...

> On Aug 9, 2018, at 1:33 PM, JORDI PALET MARTINEZ <[email-masked]> wrote:
> 
> Hi Fred,
> 
> 
>

---

From: Fred Baker <[email-masked]>
Date: Thu, 9 Aug 2018 13:50:01 -0700

I tend to think a lot of this resolved to “what is the configured attribute an attribute of?”. If you’re doing Nat44, I would expect that is almost always an attribute of the upstream interface - it translates from an “inside” address to an “outside” address, which is an address the upstream network can route to. In a CLAT, I would think the CLAT is functionally upstream, as it translates to the IPv6 network, which is from that perspective upstream. So potentially many IPv4 subnets feed into the translator, which results in messages within a single IPv6 prefix that is routed upstream. 

What makes me crazy is making it an attribute of the router. I could imagine a scenario in which the router serves multiple upstreams, and therefore translates to multiple upstream prefixes.

And yes, configuring it on the downstream interface would be cumbersome.

> On Aug 9, 2018, at 1:39 PM, Fred Baker <[email-masked]> wrote:
>

---

From: "STARK, BARBARA H" <[email-masked]>
Date: Thu, 9 Aug 2018 20:59:00 +0000

> It is not about "multiple" transition mechanisms, it is about, it is about
> multiple IPv4 ranges, so subnetting (and may be several NAT or NAT46
> instances).
> 
> We explicitly decided not to consider that a single CE will simultaneously run
> several transition mechanisms, because that may create a number of
> conflicts, that doesn't make sense to take into consideration.
> 
> (section 3.2)
> 
> An ISP may want to have different customers in different "transition stages"
> (from dual stack to IPv4aaS, or from one IPv4aaS to another), but
> simultaneously the same CE ?
> 

Oh, I think maybe I understand where you're trying to go with this. Let me see if I can paraphrase:

If an IPv6 Transition CE Router supports more than one LAN subnet, and the IPv4aas mechanism does not require NAPT, the IPv6 Transition CE Router MUST either appropriately subnet the assigned address space or disable support for multiple subnets. If subnetting of the assigned address space is supported, it SHOULD allow configuration of the address space assigned to each subnet.
If an IPv6 Transition CE Router supports more than one LAN subnet, and the IPv4aas mechanism requires NAPT, the IPv6 Transition CE Router MUST support the IPv4aas NAPT to each subnet.

Did I get that right?

Barbara

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Thu, 09 Aug 2018 16:44:09 -0500

In fact, I just realized that is simpler than that, because, you don't even need multiple instances and there are several possible ways to actually implement that (maybe single instance, but multiple tables, or even a single table with a field to correlate each entry to a specific interface, etc.), even for the same transition mechanism, so starting from Barbara text, I think we are almost there:

"If an IPv6 Transition CE Router supports more than one LAN subnet, the IPv6 Transition CE Router MUST allow appropriately subnetting and configuring the address space (which may depend on each transition mechanism) among the several interfaces. In some transition mechanisms, this MAY require differentiating mappings/translations per interfaces."

If we just say "the address space" I think it is quite obvious that it depends on what is the transition mechanism, so may be the () is not needed.

If we allow this part "or disable support for multiple subnets", then we aren't fulfilling the requirement as per Alejandro request.

It is not NAPT (because it may be NAT46).

Regards,

Jordi

-----Mensaje original-----

Fecha: jueves, 9 de agosto de 2018, 15:59

Para: 'JORDI PALET MARTINEZ' <[email-masked]>, Fred Baker <[email-masked]>, "[email-masked]" <[email-masked]>

    > After responding to you and reading Barbara comment I realized, that your

    > 2nd part doesn't work ...

    Did I get that right?

    Barbara

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Fri, 10 Aug 2018 07:30:34 -0500

Hi Barbara,

See my last proposal on this, I think already follows the IF ... THEN ... (I don't think a "then" is needed before the ", the", but it may be an English grammar issue):

I'm convinced that this is irrelevant to "what" the ISP is providing, so no need for any signaling.

Regards,

Jordi

-----Mensaje original-----

Fecha: viernes, 10 de agosto de 2018, 0:59

Para: 'JORDI PALET MARTINEZ' <[email-masked]>

    Barbara

---

From: "STARK, BARBARA H" <[email-masked]>
Date: Fri, 10 Aug 2018 12:58:23 +0000

> "If an IPv6 Transition CE Router supports more than one LAN subnet, the IPv6
> Transition CE Router MUST allow appropriately subnetting and configuring
> the address space (which may depend on each transition mechanism) among
> the several interfaces. In some transition mechanisms, this MAY require
> differentiating mappings/translations per interfaces."

I would suggest changing "MAY" to "may" (the last sentence reads more to me as something that simply could be true, rather than something this document is explicitly permitting).
As a nit: I would suggest changing "appropriately" to "appropriate".
I can live with this. Thx.
Barbara

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Fri, 10 Aug 2018 08:23:39 -0500

Thanks and agree with your points.

Not sure if you say this in English "sold out" :-)

Regards,

Jordi

-----Mensaje original-----

Fecha: viernes, 10 de agosto de 2018, 7:58

    Barbara