Subject: [arch-d] IP virtualisation: Summary and take 2

From: Pekka Nikander <[email-masked]>
Date: Tue, 8 Nov 2005 10:26:09 -0800

This is my personal, admittedly biased summary of the IP  
virtualisation discussion so far.  My apologies that I started the  
discussion but haven't replied anything until now, but I got a day  
job override around the same time Leslie forwarded the initial messages.

The discussion so far seems to have circulated around tunnelling,  
without really getting to what I consider a more pressing problem:  
what are the real reasons why people do use tunnelling; or, to put it  
differently, what are the requirements that drive people to  
virtualise IP with tunnelling.  In other words, in a way we have been  
rehashing the discussion at the Internet Area mailing list --  
probably because of only partially overlapping audience.

Hence, I would urge people to (re)read the INT area discussion before  
rebashing tunnelling any more, see e.g. the following:

My original posting at INT area (note that my thoughts have since  
evolved):
http://www1.ietf.org/mail-archive/web/int-area/current/msg00005.html

Tony's good summary of how tunnelling is a means of virtualisation:
http://www1.ietf.org/mail-archive/web/int-area/current/msg00008.html

My mid-discussion summary:
http://www1.ietf.org/mail-archive/web/int-area/current/msg00027.html

Tony's excellent questioning of my summary:
http://www1.ietf.org/mail-archive/web/int-area/current/msg00029.html

Brian's note about an alternative, shimming:
http://www1.ietf.org/mail-archive/web/int-area/current/msg00072.html

There were also other good posts by many people, including Joe Touch  
and Jim Bound and many others; the quality of discussion was IMHO  
very high.  I've picked above those that I think are most important  
from the point of view of trying to get this discussion forward.  If  
you are interested in seeing how to really use tunnelling in a good  
way, I also encourage you to read Joe's mails, e.g.
http://www1.ietf.org/mail-archive/web/int-area/current/msg00028.html
http://www1.ietf.org/mail-archive/web/int-area/current/msg00035.html
http://www1.ietf.org/mail-archive/web/int-area/current/msg00037.html
http://www1.ietf.org/mail-archive/web/int-area/current/msg00080.html

The summary of the INT area discussion, and this discussion here so  
far, is that tunnelling is a fine tool for many purposes, including  
but not limited to IP virtualisation.  However, at the same time,  
there are also a number of concerns, some of which are more technical  
in nature (e.g. MTU, overhead) and some of which are more  
architectural (e.g. IP addresses no longer represent end-points,  
tunnelling allows transparency at the core, tunnelling can be used to  
circumvent firewall policies).

Now, trying to go forward, the reason why I took this topic up in the  
first place was that I would like to better understand the various  
sets of semantics that various groups of users expect from IP.  The  
fact that we use tunnelling to virtualise IP seems to indicate that  
different user groups want different semantics, and that the current  
global IP service does not fulfil these semantical needs.

Let me try to take a simplistic attempt to describe a couple of  
scenarios:

1. A home user

An individual home user is interested in
a) general connectivity for web browsing and other similar needs
b) connectivity with her social tribe, i.e. friends etc
c) connectivity to the services at her job

Of these, c) may benefit from IP virtualisation.  Indeed, if the user  
uses IPsec VPN for connecting to her employer's intranet, her  
computer may have a virtual interface corresponding to this VPN  
connection.

What makes this scenario tricky, from the current architecture point  
of view, is the desire to keep at least the domains a) and c) clearly  
separate, and the separate security requirements pertaining to them.

2. Distributed corporate intranet

Typically, users of a corporate intranet currently use mainly the  
intranet, accessing the Internet through an application level  
gateway, or at least a packet filtering firewall.  A good question is  
whether it would be better to describe the situation in terms of two  
virtual networks, 1) the corporate intranet and 2) the public  
internet, with separate types of firewalling towards each of them,  
and with string separation between them.

---

Based on the two simplistic examples above, I think it is fair to  
state that there seems to be a need for having simultaneous but  
clearly separated connectivity with multiple disjoint IP networks.   
Is the requirement really that simple?

Now, putting aside that the requirement can be (and is being) solved  
with tunnelling, would there be alternative ways of doing this?  Are  
Unique Local IPv6 Unicast Addresses (RFC 4193) another way to achieve  
the goal?  If not, what else is needed?

--Pekka Nikander

_______________________________________________
Architecture-discuss mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/architecture-discuss