Subject: Re: [mif] draft-ietf-mif-current-practices-00

From: Hui Deng <[email-masked]>
Date: Tue, 6 Apr 2010 10:39:51 +0800

DNS server always has specific interface related information,
but the final DNS server will still be host based, I wouldn't say it
is not correct.

one example would be you have internet connection and vpn connection
at the same time,
good VPN implementation will always rely on VPN DNS server information
for Internet connection.

-Hui

2010/3/31 Dan Wing <[email-masked]>:
> Section 3.2.1.3 of describes the DNS configuration of Windows, and says:
>
>  "Interface specific DNS configuration can be input via static
>   configuration or via DHCP.  It includes:
>
>   o  An interface-specific suffix list.
>
>   o  A list of DNS server IP addresses."
>
> It is curious that the first bullet repeats "interface specific", but the
> second bullet does not repeat it.  A reasonable interpretation is that the
> second bullet is not interface-specific, but the lead-in sentence says this is
> interface-specific.  I was hoping draft-montenegro-mif-multihoming-00 would
> clarify, but it doesn't.
>
> -d
>
> _______________________________________________
> mif mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mif
>

---

From: gabriel montenegro <[email-masked]>
Date: Tue, 6 Apr 2010 09:13:22 -0700 (PDT)

Re: draft-montenegro-mif-multihoming:

I would have thought that it is clear, given that this info is found in section 4.2 which is called "interface-specific DNS configuration". It is not found in the previous section 4.1 which is called "host-wide DNS configuration".

----- Original Message ----
> From: Dan Wing <[email-masked]>
> To: [email-masked]
> Sent: Tue, March 30, 2010 4:02:55 PM
> Subject: [mif] draft-ietf-mif-current-practices-00
> 

  "Interface specific DNS configuration can be input via 
> static

> o  An interface-specific suffix list.

  o  A list of DNS 
> server IP addresses."

It is curious that the first bullet repeats 
> "interface specific", but the
second bullet does not repeat it.  A 
> reasonable interpretation is that the
second bullet is not 
> interface-specific, but the lead-in sentence says this 
> is
interface-specific.  I was hoping draft-montenegro-mif-multihoming-00 
> would
clarify, but it 
> doesn't.

-d

mif 
> mailing list
> href="mailto:[email-masked]">[email-masked]
> href="https://www.ietf.org/mailman/listinfo/mif" target=_blank

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 6 Apr 2010 11:42:26 -0700

> -----Original Message-----
> From: gabriel montenegro [mailto:[email-masked]] 
> Sent: Tuesday, April 06, 2010 9:13 AM
> To: Dan Wing; [email-masked]
> Subject: Re: [mif] draft-ietf-mif-current-practices-00
> 
> I would have thought that it is clear, given that this info 
> is found in section 4.2 which is called "interface-specific 
> DNS configuration".

I agree it is in an appropriately-named section -- I said
that in my original post to MIF.

My specific suggestion is to simply change from

OLD:
   Interface-specific DNS configuration is input either via static
   configuration or via DHCP.

   .  Interface-specific suffix list

   .  List of DNS server IP addresses - The first one is the "primary"
     with all others being secondary.
NEW:
   Interface-specific DNS configuration is input either via static
   configuration or via DHCP.

   .  suffix list
.....^

   .  List of DNS server IP addresses - The first one is the "primary"
     with all others being secondary.

-d

> It is not found in the previous section 
> 4.1 which is called "host-wide DNS configuration".
> 
> 
>

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 6 Apr 2010 11:52:11 -0700

> From: Dave Thaler [mailto:[email-masked]] 
> Sent: Tuesday, April 06, 2010 10:06 AM
> To: Hui Deng; Dan Wing; Gabriel Montenegro
> Cc: [email-masked]
> Subject: RE: [mif] draft-ietf-mif-current-practices-00
> 
> Hui is correct, Windows has per-interface DNS server lists configured.
> 
> It then uses a host-wide "effective" server list for an actual query,
> where the effective server list may be different for different names.
> 
> On Windows the per-interface suffix is actually termed the
> "connection-specific DNS suffix" to distinguish it from the
> "primary DNS suffix" of the machine.  I think that's why
> "interface-specific" was repeated in the first bullet.

In draft-montenegro-mif-multihoming, there are two purposes and terms that 
seem to be intermingled using the term "DNS suffix".  

One purpose is the suffix for non-FQDN names, like "payroll" or "mail", 
which will have a suffix added to them (e.g., example.com).  The 
other purpose is deciding which DNS server will be be sent a query for 
a certain FQDN (e.g., queries for *.example.net go to one DNS server 
and queries for *.example.com go to a different DNS server).

In draft-ietf-mif-current-practices-00, which is the WG document
that seems to have boiled down draft-montenegro-mif-multihoming,
but draft-ietf-mif-current-practices-00 also does not clearly
separate the two purposes.

-d

> Example on Windows, extracted from "ipconfig /all" output:
> 
> Windows IP Configuration
> 
>    Host Name . . . . . . . . . . . . : dthaler-win7
>    Primary Dns Suffix  . . . . . . . : ntdev.corp.microsoft.com
>    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>    Node Type . . . . . . . . . . . . : Hybrid
>    IP Routing Enabled. . . . . . . . : No
>    WINS Proxy Enabled. . . . . . . . : No
>    DNS Suffix Search List. . . . . . : ntdev.corp.microsoft.com
>                                        redmond.corp.microsoft.com
>                                        ntdev.microsoft.com
>                                        dns.corp.microsoft.com
>    System Quarantine State . . . . . : Not Restricted
> 
> Wireless LAN adapter Wireless Network Connection:
> 
>    Connection-specific DNS Suffix  . : hsd1.wa.comcast.net.
>    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>    Description . . . . . . . . . . . : Intel(R) Wireless WiFi 
> Link 4965AGN
>    Physical Address. . . . . . . . . : 00-1D-E0-34-4F-6F
>    DHCP Enabled. . . . . . . . . . . : Yes
>    Autoconfiguration Enabled . . . . : Yes
>    Link-local IPv6 Address . . . . . : 
> fe80::4853:4753:9d8d:3b45%13(Preferred)
>    IPv4 Address. . . . . . . . . . . : 192.168.0.195(Preferred)
>    Subnet Mask . . . . . . . . . . . : 255.255.255.0
>    Lease Obtained. . . . . . . . . . : Monday, April 05, 2010 
> 10:19:02 PM
>    Lease Expires . . . . . . . . . . : Tuesday, April 06, 
> 2010 10:19:02 PM
>    Default Gateway . . . . . . . . . : 192.168.0.1
>    DHCP Server . . . . . . . . . . . : 192.168.0.1
>    DHCPv6 IAID . . . . . . . . . . . : 335551968
>    DHCPv6 Client DUID. . . . . . . . : 
> 00-01-00-01-12-0C-E2-7A-00-1E-37-CC-8D-DD
> 
>    DNS Servers . . . . . . . . . . . : 2001:df8:0:1::25
>                                        192.168.0.1
>    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>    NetBIOS over Tcpip. . . . . . . . : Enabled
> 
> -Dave
> 
> > From: Hui Deng [mailto:[email-masked]]
> > Sent: Monday, April 05, 2010 7:40 PM
> > To: Dan Wing; Gabriel Montenegro; Dave Thaler
> > Cc: [email-masked]
> > > It is curious that the first bullet repeats "interface 
> specific", but
> > the

---

From: Dave Thaler <[email-masked]>
Date: Tue, 6 Apr 2010 17:05:58 +0000

Windows IP Configuration

   Connection-specific DNS Suffix  . : hsd1.wa.comcast.net.
   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   Description . . . . . . . . . . . : Intel(R) Wireless WiFi Link 4965AGN
   Physical Address. . . . . . . . . : 00-1D-E0-34-4F-6F
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::4853:4753:9d8d:3b45%13(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.0.195(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Monday, April 05, 2010 10:19:02 PM
   Lease Expires . . . . . . . . . . : Tuesday, April 06, 2010 10:19:02 PM
   Default Gateway . . . . . . . . . : 192.168.0.1
   DHCP Server . . . . . . . . . . . : 192.168.0.1
   DHCPv6 IAID . . . . . . . . . . . : 335551968
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-12-0C-E2-7A-00-1E-37-CC-8D-DD

-Dave

---

From: Dave Thaler <[email-masked]>
Date: Tue, 6 Apr 2010 19:42:41 +0000

> From: Dan Wing [mailto:[email-masked]]
> Sent: Tuesday, April 06, 2010 11:52 AM
> To: Dave Thaler; 'Hui Deng'; Gabriel Montenegro
> Cc: [email-masked]
> which will have a suffix added to them (e.g., example.com).  

That's what windows calls the "DNS Suffix Search List" (see the
sample output I sent previously below).  It's called the
"domain search list" in other places (like RFC 3397), or just
"search list" (RFC 1123).

> The

Another purpose is deciding which DNS server will receive a dynamic 
update for a name with a certain suffix (e.g., Windows supports dynamic
updates for the primary DNS name, and optionally also the connection-
specific DNS name of the machine).

> separate the two purposes.

Yep

-Dave
> > > > Section 3.2.1.3 of describes the DNS configuration of Windows,
> and
> > > says:
> > > >

---

From: Hui Deng <[email-masked]>
Date: Thu, 8 Apr 2010 10:28:48 +0800

2nd purpose has been documented in the current practice draft,
whether 1st and 3rd purpose need to be documented as well? it may not
directly related to MIF?

-Hui

---

From: "Dan Wing" <[email-masked]>
Date: Thu, 8 Apr 2010 07:22:23 -0700

> Sent: Wednesday, April 07, 2010 7:29 PM
> To: Dave Thaler
> Cc: Dan Wing; Gabriel Montenegro; [email-masked]

Some operating systems -- e.g., most flavors of Unix -- do not support the
ability for sending different DNS queries to different DNS servers.

It would be helpful if the draft more clearly described the functionality.
Someone unfamiliar with the Windows functionality, reading the draft, assumes
it is merely talking about the 'domain search list' -- because that is what
they are familiar with.  

I don't care how the draft is fixed to make it clearer.  I propose describing
the 2 (and, as Dave pointed out, 3) functions.  If you want to adjust the
document to instead talk about the per-interface stuff, that's great -- my
point is that right now it is insufficiently clear in explaining it.

-d

> >> In draft-montenegro-mif-multihoming, there are two 
> purposes and terms
> >> that
> >> > > but the final DNS server will still be host based, I 
> wouldn't say
> >> it
> >> > > is not correct.
> >> > >
> >> > > > second bullet does not repeat it.  A reasonable 
> interpretation is
> >> > > that the
> >> > > > second bullet is not interface-specific, but the 
> lead-in sentence
> >> > > says this is

---

From: gabriel montenegro <[email-masked]>
Date: Thu, 8 Apr 2010 13:17:13 -0700 (PDT)

In addition to those three usages of "suffix":

1. Domain Search list suffix
2. For interface-specific suffix list 
3. Suffix to control Dynamic DNS Updates

There is yet another usage in Windows introduced in windows 7 and its server counterpart, Windows Server 2008 R2:

4. Suffix in the NRPT [1] to aid in identifying a Namespace that requires special handling, 
as used for DirectAccess [2]. This is not MIF-specific either.

Only #2 is MIF-specific (and this should be called out), but it makes sense to clarify the 
other uses of "suffix" otherwise #2 won't be clear.

[1] NRPT: See http://technet.microsoft.com/en-us/magazine/ff394369.aspx
[2] DirectAcess: http://technet.microsoft.com/en-us/magazine/2009.05.cableguy.aspx

Gabriel

----- Original Message ----
> To: Hui Deng <[email-masked]>; Dave Thaler <[email-masked]>
> Cc: [email-masked]; Gabriel Montenegro <[email-masked]>
> Sent: Thu, April 8, 2010 7:22:23 AM

> From: Hui Deng [mailto:> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]] 
> Sent: 
> Cc: Dan Wing; 
> Gabriel Montenegro; > href="mailto:[email-masked]">[email-masked]
> Subject: Re: [mif] 
> 2nd purpose has been 
> documented in the current practice draft,
> whether 1st and 3rd purpose 
> need to be documented as well? it may not
> directly related to 
> MIF?

Some operating systems -- e.g., most flavors of Unix -- do not 
> support the
ability for sending different DNS queries to different DNS 
> servers.

It would be helpful if the draft more clearly described the 
> functionality.
Someone unfamiliar with the Windows functionality, reading the 
> draft, assumes
it is merely talking about the 'domain search list' -- because 
> that is what
they are familiar with.  

I don't care how the draft 
> is fixed to make it clearer.  I propose describing
the 2 (and, as Dave 
> pointed out, 3) functions.  If you want to adjust the
document to 
> instead talk about the per-interface stuff, that's great -- my
point is that 
> right now it is insufficiently clear in explaining it.

-d

> 
> -Hui
> 
> 2010/4/7 Dave Thaler <> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]>:
> 
> >> From: Dan Wing [mailto:> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]]
> >> Sent: 
> >> Cc: > href="mailto:[email-masked]">[email-masked]
> >> Subject: RE: [mif] 
> From: Dave Thaler [mailto:> href="mailto:[email-masked]">[email-masked]]
> >> 
> >> > Cc: > ymailto="mailto:[email-masked]" 
> >> > Subject: RE: 
> [mif] draft-ietf-mif-current-practices-00
> >> >
> >> 
> > Hui is correct, Windows has per-interface DNS server lists
> >> 
> configured.
> >> >
> >> > It then uses a host-wide 
> "effective" server list for an 
> actual query,
> >> > 
> where the effective server list may be different for 
> different 
> names.
> >> >
> >> seem to be 
> intermingled using the term "DNS suffix".
> >>
> >> One 
> purpose is the suffix for non-FQDN names, like 
> "payroll" or 
> "mail",
> >> which will have a suffix added to them (e.g., > target="_blank" href="http://example.com">example.com).
> >
> 
> other purpose is deciding which DNS server will be be sent 
> a query 
> for
> >> a certain FQDN (e.g., queries for *.> href="http://example.net">example.net go to one 
> DNS server
> 
> > update for a name with a certain suffix (e.g., Windows 
> 
> supports dynamic
> > updates for the primary DNS name, and 
> optionally also the 
> connection-
> > specific DNS name of the 
> machine).
> >
> >>
> >>
> >> In 
> draft-ietf-mif-current-practices-00, which is the WG document
> >> 
> >> > Windows 
> IP Configuration
> >> >    Primary Dns Suffix  . 
> . . . . . . : > href="http://ntdev.corp.microsoft.com">ntdev.corp.microsoft.com
> 
> >> >   
>      > href="http://redmond.corp.microsoft.com">redmond.corp.microsoft.com
> 
> >> >                                        > href="http://ntdev.microsoft.com">ntdev.microsoft.com
> >> > 
>                                        > href="http://dns.corp.microsoft.com">dns.corp.microsoft.com
> >> 
> >> >    Connection-specific 
> DNS Suffix  . : > href="http://hsd1.wa.comcast.net">hsd1.wa.comcast.net.
> >> > 
> >> >    DHCP 
> Server . . . . . . . . . . . : 192.168.0.1
> >> >    DHCPv6 IAID 
> >> > > From: Hui Deng [mailto:> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]]
> >> > 
> >> > > Cc: > ymailto="mailto:[email-masked]" 
> >> > > Subject: 
> Re: [mif] draft-ietf-mif-current-practices-00
> >> > >
> 
> >> > > one 
> example would be you have internet connection and vpn
> >> 
> connection
> >> > > at the same time,
> >> > 
> > good VPN implementation will always rely on VPN DNS server
> >> 
> > information
> >> > > for Internet connection.
> 
> >> > >
> >> > > -Hui
> >> > 
> >
> >> > > 2010/3/31 Dan Wing <> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]>:
> >> > 
> > > Section 3.2.1.3 of describes the DNS configuration 
> of 
> Windows,
> >> and
> >> > > says:
> >> 
> > > >
> >> > > >  "Interface specific DNS 
> configuration can be input 
> via static
> >> > > >   
> >> > > > It 
> is curious that the first bullet repeats "interface
> >> > 
> specific", but
> >> > > the
> >> > > > 
> interpretation 
> >> > > > second 
> bullet is not interface-specific, but the 
> lead-in sentence
> 
> >> > > says this is
> >> > > > 
> interface-specific.  I was hoping
> >> > 
> draft-montenegro-mif-multihoming-00
> >> > > would
> 
> >> > > > clarify, but it doesn't.
> >> > > 
> >
> >> > > > -d
> >> > > >
> 
> >> > > > > ymailto="mailto:[email-masked]" 

mif mailing 
> list

---

From: Hui Deng <[email-masked]>
Date: Fri, 9 Apr 2010 21:29:04 +0800

Hi Gabriel,

Thanks for your sending the summary of usage and reference,
It become more clear about suffix now.

Btw, could you kind help again to make the revision text
for MIF current practice draft related to this?

Thanks again

-Hui

---

From: gabriel montenegro <[email-masked]>
Date: Fri, 9 Apr 2010 09:12:14 -0700 (PDT)

Sure. I'll massage text from this thread and send it to Margaret.

----- Original Message ----
> From: Hui Deng <[email-masked]>
> To: gabriel montenegro <[email-masked]>
> Cc: Dan Wing <[email-masked]>; Dave Thaler <[email-masked]>; [email-masked]
> Sent: Fri, April 9, 2010 6:29:04 AM

Thanks for your sending the summary of usage and 
> reference,

Btw, could you kind 
> help again to make the revision text
for MIF current practice draft related 
> to this?

Thanks again

-Hui

2010/4/9 gabriel montenegro 
> <> href="mailto:[email-masked]">[email-masked]>:
> 
> There is yet another usage in 
> Windows introduced in windows 7 and its server counterpart, Windows Server 2008 
> R2:
>
> Only #2 is MIF-specific (and this 
> should be called out), but it makes sense to clarify the
> other uses of 
> [1] NRPT: See 
> http://technet.microsoft.com/en-us/magazine/ff394369.aspx
> [2] 
> DirectAcess: 
> http://technet.microsoft.com/en-us/magazine/2009.05.cableguy.aspx
>
> 
> Gabriel
>
>> From: Dan Wing 
> <> href="mailto:[email-masked]">[email-masked]>
>> To: Hui Deng 
> <> href="mailto:[email-masked]">[email-masked]>; Dave Thaler 
> <> href="mailto:[email-masked]">[email-masked]>
>> 
> Cc: > href="mailto:[email-masked]">[email-masked]; Gabriel Montenegro <> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]>
>> 
>> From: Hui Deng [mailto:> 
> ymailto="mailto:> href="mailto:[email-masked]">[email-masked]"
>> 
> href="mailto:> href="mailto:[email-masked]">[email-masked]">> ymailto="mailto:[email-masked]" 
>> To: Dave 
> Thaler
>> Gabriel Montenegro; > 
> href="mailto:> href="mailto:[email-masked]">[email-masked]">> href="mailto:[email-masked]">[email-masked]
>> Subject: Re: 
> [mif]
> Someone 
> unfamiliar with the Windows functionality, reading the
>> draft, 
> assumes
>> right 
> now it is insufficiently clear in explaining it.
>
> 
> -d
>
>>
>> -Hui
>>
>> 2010/4/7 Dave 
> Thaler <> ymailto="mailto:> href="mailto:[email-masked]">[email-masked]"
>> 
> href="mailto:> href="mailto:[email-masked]">[email-masked]">> ymailto="mailto:[email-masked]" 
>> >> From: Dan Wing 
> [mailto:> ymailto="mailto:> href="mailto:[email-masked]">[email-masked]"
>> href="mailto:> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]">> ymailto="mailto:[email-masked]" 
>> >> To: Dave 
> Thaler; 'Hui Deng';
>> Gabriel Montenegro
>> >> Cc: > 
> href="mailto:> href="mailto:[email-masked]">[email-masked]">> href="mailto:[email-masked]">[email-masked]
>> >> Subject: RE: 
> [mif]
> From: Dave Thaler [mailto:> href="mailto:> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]">> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]]
>> 
> >>
> >> > Cc: > ymailto="mailto:> href="mailto:[email-masked]">[email-masked]"
>> href="mailto:> ymailto="mailto:[email-masked]" href="mailto:[email-masked]">[email-masked]">> ymailto="mailto:[email-masked]" 
> RE:
>> >> > It then uses a 
> host-wide
>> actual 
> query,
>> >> > On Windows the per-interface
>> suffix 
> is actually termed the
>> >> > "connection-specific 
> DNS
>> suffix" to distinguish it from the
>> >> > 
> "primary DNS suffix" of
> >> > "interface-specific" was
>> repeated in the first 
> bullet.
>> >> which will have a suffix added to them (e.g., > 
> target="_blank" href="http://example.com">> href="http://example.com">example.com).
>> 
> >
>>
>> "domain search 
> list" in other places (like RFC 3397), or just
>> >
>> 
>> >> a certain FQDN 
> (e.g., queries for *.> href="http://example.net">> href="http://example.net">example.net go to one
>> DNS 
> server
>>
>> > Another 
> purpose is deciding which DNS server will receive a
>> 
> dynamic
>> > specific DNS name of the
> machine).
>> >> but 
> draft-ietf-mif-current-practices-00 also does not 
> clearly
>>
>> >> > Example on Windows, 
> extracted
>> from "ipconfig /all" output:
>> >> 
> >
>> >> > Windows
>> IP Configuration
>> 
> >> >
>> >> >    Host Name . . .
>> . . . . . 
> . . . . : dthaler-win7
>> >> >    Primary Dns Suffix 
>  .
>> . . . . . . : > href="http://ntdev.corp.microsoft.com">> target="_blank" 
> href="http://ntdev.corp.microsoft.com">ntdev.corp.microsoft.com
>>
>> 
> >> >
>> 
>> >> >    IP
>> Routing Enabled. . . . . . . 
> . : No
>> >> >    WINS Proxy Enabled.
>> . . . . . . 
> . : No
>> >> >    DNS Suffix Search List. . . . . . 
> :
>> ntdev.corp.microsoft.com
>> >> >
>>     
>  > href="http://redmond.corp.microsoft.com">> href="http://redmond.corp.microsoft.com">redmond.corp.microsoft.com
>>
>> 
> >> >                                        > 
> href="http://ntdev.microsoft.com">> href="http://ntdev.microsoft.com">ntdev.microsoft.com
>> >> 
> >
>>                                        > 
> href="http://dns.corp.microsoft.com">> href="http://dns.corp.microsoft.com">dns.corp.microsoft.com
>> 
> >>
>> DNS 
> Suffix  . : > href="http://hsd1.wa.comcast.net">> href="http://hsd1.wa.comcast.net">hsd1.wa.comcast.net.
>> >> 
> >
>>   
> >> >    Physical Address. . . . . .
>> . . . : 
> 00-1D-E0-34-4F-6F
>> >> >    DHCP Enabled. . . . . . . . 
> .
>> . . : Yes
>> >> >    Autoconfiguration Enabled . 
> . . . :
>> Yes
>> > 10:19:02 
> PM
>> >> >    Lease Expires . . . . . . . . . . :
>> 
> Tuesday, April 06,
>> >> > 2010 10:19:02 PM
>> 
> >> >
>> >> >    DHCPv6 IAID
>> . . . . 
> . . . . . . . : 335551968
>> >> >    DHCPv6 Client DUID. 
> .
>> . . . . . . :
>> >> >
>> 
>> >> > > From: Hui Deng [mailto:> 
> ymailto="mailto:> href="mailto:[email-masked]">[email-masked]"
>> 
> href="mailto:> href="mailto:[email-masked]">[email-masked]">> ymailto="mailto:[email-masked]" 
> >> > > Cc: > ymailto="mailto:> href="mailto:[email-masked]">[email-masked]"
>> href="mailto:> ymailto="mailto:[email-masked]" href="mailto:[email-masked]">[email-masked]">> ymailto="mailto:[email-masked]" 
>> >> > > DNS server always 
> has specific interface related
>> information,
>> >> 
> > > but the final DNS server will still be
>> host based, 
> I
>> wouldn't say
>> >> it
>> >> 
> >
>> > is not correct.
>> >> > >
>> 
> >> > > one
>> > good VPN 
> implementation will always rely on VPN DNS server
>> 
> >>
>> > information
>> >> > > for 
> Internet connection.
>>
>> >> > >
>> 
> >> > > -Hui
>> >> >
>> >
>> 
> >> > > 2010/3/31 Dan Wing <> ymailto="mailto:> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]"
>> href="mailto:> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]">> ymailto="mailto:[email-masked]" 
>> >> > > >  "Interface specific 
> DNS
>> >> > > >   o  A 
> list of DNS server IP
>> addresses."
>> specific", 
> but
> ymailto="mailto:> href="mailto:[email-masked]">[email-masked]"
>> href="mailto:> ymailto="mailto:[email-masked]" href="mailto:[email-masked]">[email-masked]">> ymailto="mailto:[email-masked]" 
> > href="> >https://www.ietf.org/mailman/listinfo/mif" target=_blank
>> href="mailto:> href="mailto:[email-masked]">[email-masked]">> href="mailto:[email-masked]">[email-masked]
>> href="> href="https://www.ietf.org/mailman/listinfo/mif" target=_blank 
> >https://www.ietf.org/mailman/listinfo/mif" target=_blank

---

From: "Dan Wing" <[email-masked]>
Date: Fri, 9 Apr 2010 14:38:28 -0700

> Sent: Thursday, April 08, 2010 1:17 PM
> To: Dan Wing; Hui Deng; Dave Thaler
> Cc: [email-masked]
> There is yet another usage in Windows introduced in windows 7 
> and its server counterpart, Windows Server 2008 R2:
> 

Thanks.

To be concrete, I would suggest text something like this at
the top of the section on draft-ietf-mif-current-practices
describing Windows DNS behavior:

  "Windows uses host name suffixes for four different purposes:
   domain search list suffix (similar to the "domain" entry in
   the standard Unix /etc/resolv.conf file), interface-specific
   suffix list, dynamic DNS updates, and the name resolution
   policy table (NRPT).  It is Windows interface-specific
   suffix list that is described in this section."

and then tighten up the rest of section to only describe that.

-d

> [2] DirectAcess: 

> > From: Dave Thaler [mailto:> 
> > suffix is actually termed the
> > >> > "connection-specific DNS 
> > repeated in the first bullet.
> > >>
> > >>
> > 
> > >>
> target="_blank" href="http://example.com">example.com).
> > >
> > 
> > >> a certain FQDN (e.g., queries for *.> 
> href="http://example.net">example.net go to one 
> > DNS server
> > 
> > . . . . . . . . . : dthaler-win7
> > >> >    Primary Dns Suffix  . 
> > . . . . . . : > 
> > Routing Enabled. . . . . . . . : No
> > >> >    WINS Proxy Enabled. 
> > . . . . . . . : No
> href="http://redmond.corp.microsoft.com">redmond.corp.microsoft.com
> > 
> > >> >                                        > 
> href="http://ntdev.microsoft.com">ntdev.microsoft.com
> > >> > 
> >                                        > 
> href="http://dns.corp.microsoft.com">dns.corp.microsoft.com
> > >> 
> > DNS Suffix  . : > 
> href="http://hsd1.wa.comcast.net">hsd1.wa.comcast.net.
> > >> > 
> > . . . : 00-1D-E0-34-4F-6F
> > . . . . . . . . . . . : 335551968
> > >> >    DHCPv6 Client DUID. . 
> > . . . . . . :
> > >> > 
> ymailto="mailto:[email-masked]" 
> > host based, I

---

From: <[email-masked]>
Date: Mon, 12 Apr 2010 22:52:55 +0200

Hi,

Why do you think #4 is not mif-specific? What possible use NRPT has for single interfaced host? Or is the idea such that a host could have single interface, but just use different DNS server for queries matching NRPT?
....hmm...
Do you consider a host using DirectAccess single or multi-interfaced? From my quick reading of the DirectAccess feature, it sounds to be somewhere in between - not obviously multi-interface like the VPN-case is, but not quite single-interfaced either. 

Is there a way to configure NRPT policies remotely via some protocol?

Thanks for explanation,

Teemu

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> ext gabriel montenegro
> Sent: 08. huhtikuuta 2010 23:17
> There is yet another usage in Windows introduced in windows 7 and its
> server counterpart, Windows Server 2008 R2:
>

---

From: Dave Thaler <[email-masked]>
Date: Mon, 12 Apr 2010 22:43:04 +0000

> From: [email-masked] [mailto:[email-masked]]
> Sent: Monday, April 12, 2010 1:53 PM
> To: [email-masked]; [email-masked]; [email-masked]; Dave
> Thaler
> Cc: [email-masked]
> Why do you think #4 is not mif-specific? What possible use NRPT has for single
> interfaced host? Or is the idea such that a host could have single interface,
> but just use different DNS server for queries matching NRPT?

Right.  The NRPT is similar to a configured cache of NS records.
It's used to solve the problem of have access to multiple disjoint namespaces
(like corporate DNS and public DNS).  Private names aren't resolvable in
the public DNS, so you have to know what DNS server to ask.

> ....hmm...
> Do you consider a host using DirectAccess single or multi-interfaced? From my
> quick reading of the DirectAccess feature, it sounds to be somewhere in
> between - not obviously multi-interface like the VPN-case is, but not quite
> single-interfaced either.

Right it could be either one.

> Is there a way to configure NRPT policies remotely via some protocol?

Yes, it's designed to be configured by an enterprise administrator of the
organization that manages the host.  So there's an authenticated, 
configuration distribution protocol for ActiveDirectory-domain-joined hosts.

-Dave

---

From: Dave Thaler <[email-masked]>
Date: Mon, 12 Apr 2010 22:44:54 +0000

And for the "note well", Microsoft may have some IP in this area.

-Dave

> From: Dave Thaler
> Sent: Monday, April 12, 2010 3:43 PM
> To: [email-masked]'; [email-masked]; [email-masked];
> [email-masked]
> Cc: [email-masked]

---

From: gabriel montenegro <[email-masked]>
Date: Mon, 12 Apr 2010 16:17:51 -0700 (PDT)

Hi Teemu,

I don't consider NRPT a MIF-specific technology as the whole point is 
to enable *namespace-specific DNS servers*, in addition to the well-known
interface-specific DNS servers.

Also, NRPT is not specific to DirectAccess. For example, it is also used for DNSSEC. 
Even when used for DirectAccess, it is even harder than with VPNs to consider
it an "interface". For example, DirectAccess can use IPsec transport mode to access
intranet resources. Whereas VPN's that use IPsec in tunnel mode are sometimes
thought of as constituting an "interface", I'm not sure I've seen that for 
IPsec in *transport* mode.

NRPT can be managed remotely by Group Policy.

thanks,

Gabriel

----- Original Message ----
> From: "[email-masked]" <[email-masked]>
> To: [email-masked]; [email-masked]; [email-masked]; [email-masked]
> Cc: [email-masked]
> Sent: Mon, April 12, 2010 1:52:55 PM

Why do you think #4 is not mif-specific? What possible use NRPT has 
> for single interfaced host? Or is the idea such that a host could have single 
> interface, but just use different DNS server for queries matching 
> NRPT?
....hmm...
Do you consider a host using DirectAccess single or 
> multi-interfaced? From my quick reading of the DirectAccess feature, it sounds 
> to be somewhere in between - not obviously multi-interface like the VPN-case is, 
> but not quite single-interfaced either. 

Is there a way to configure NRPT 
> policies remotely via some protocol?

Thanks for 
> explanation,

Teemu

> From: 
> > href="mailto:[email-masked]">[email-masked] [mailto:> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]] On Behalf 
> Of
> ext gabriel montenegro
> 4. Suffix in the NRPT [1] to aid in identifying a Namespace 
> that
> requires special handling,
> Only #2 is MIF-specific (and 
> this should be called out), but it makes
> sense to clarify the
> 
> [1] NRPT: 
> See http://technet.microsoft.com/en-us/magazine/ff394369.aspx
> [2] 
> DirectAcess: http://technet.microsoft.com/en-
> 
> us/magazine/2009.05.cableguy.aspx
> 
> Gabriel
> 
> 
> > From: Dan Wing <> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]>
> > To: Hui Deng 
> > instead 
> talk about the per-interface stuff, that's great -- my
> point is 
> that
> 2010/4/7 Dave Thaler <> ymailto="mailto:> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]"
> > 
> From: Dan Wing [mailto:> ymailto="mailto:> href="mailto:[email-masked]">[email-masked]"
> > >> To: 
> Dave Thaler; 'Hui Deng';
> Cc: > href="mailto:> href="mailto:[email-masked]">[email-masked]">> href="mailto:[email-masked]">[email-masked]
> > >> Subject: RE: 
> [mif]
> href="mailto:> ymailto="mailto:[email-masked]" 
> > >> > "primary DNS suffix" of
> > the machine.  I think 
> that's why
> draft-montenegro-mif-multihoming, there are two
> >
> > 
> purposes and terms
> > >> that
> > >> seem to 
> be
> target="_blank"
> href="http://example.com">> href="http://example.com">example.com).
> > >
> 
> >
> > "search list" 
> (RFC 1123).
> (e.g., queries for *.>
> href="http://example.net">> target="_blank" href="http://example.net">example.net go to one
> > 
> DNS server
> >
> Another purpose is deciding which DNS server will receive a
> > 
> dynamic
> draft-ietf-mif-current-practices-00 also does not clearly
> >
> 
> > >> > Example on Windows, extracted
> 
> href="http://ntdev.corp.microsoft.com">> target="_blank" 
> > . . . . . . . 
> : No
> > >> >    DNS Suffix Search List. . . . . . :
> 
> > ntdev.corp.microsoft.com
> > >> >
> >     
>  >
> href="http://redmond.corp.microsoft.com">> href="http://redmond.corp.microsoft.com">redmond.corp.microsoft.com
> 
> >
> > >> >                                       
>  >
> Suffix  . : >
> href="http://hsd1.wa.comcast.net">> href="http://hsd1.wa.comcast.net">hsd1.wa.comcast.net.
> > >> 
> >
> >   
> > >> >    Autoconfiguration Enabled 
> . . . . :
> > Yes
> > >> >    Link-local IPv6 Address 
> . . . . . :
> >
> > >> > 
> > >> > 2010 10:19:02 
> . . . . . . . . . . : 335551968
> > >> >    DHCPv6 Client 
> DUID. .
> > . . . . . . :
> > >> >
> > 
> >> > > To: Dan
> > Wing; Gabriel Montenegro; Dave 
> Thaler
> > >> > > Cc: > ymailto="mailto:> ymailto="mailto:[email-masked]" 
> href="mailto:[email-masked]">[email-masked]"
> always has specific interface related
> > information,
> > 
> > host 
> based, I
> > >> > > 2010/3/31 Dan Wing 
> <> ymailto="mailto:> href="mailto:[email-masked]">[email-masked]"

---

From: <[email-masked]>
Date: Tue, 13 Apr 2010 07:56:22 +0200

Gabriel,

>From my point of view NRPT is about (roaming) host simultaneously being connected to multiple administrative domains..

What I'm after is that even if NRPT with DirectAccess is maybe closer to single-interfaced host than multi-interfaced hosts (as a host can just have single source IP address, and even if it has multiple, any one of those can be used with the globally unique IP address of NRPT matching destination, I believe), very similar DNS things are in MIF domain, such as split-DNS.

With NRPT it is probably not possible for administrators of different access networks to configure (conflicting) rules to a host, but with a more generic option (see draft-savolainen-mif-dns-server-selection-02) and multiple interfaces there could be conflicting rules that need to be sorted out.

Therefore I'd just like to check whether you agree the namespaces/split-DNS is in MIF scope generally, even if you say NRPT with DirectAccess would not be?

Now, if a new DHCP-option would be defined as proposed, there could be conflict between policies configured via DHCP (on attached network) and NRPT. I think NRPT policies should override conflicting policies of access networks. I.e. the logic would be to check whether FQDN matches to NRPT, and then if it matches to any specific access network policies, and only then use the "default" DNS server? What do you think?

Best regards,

Teemu

> From: ext gabriel montenegro [mailto:[email-masked]]
> Sent: 13. huhtikuuta 2010 02:18
> To: Savolainen Teemu (Nokia-D/Tampere); [email-masked];
> [email-masked]; [email-masked]
> Cc: [email-masked]
> > ymailto="mailto:>
> href="mailto:[email-masked]">[email-masked]"
> > >
> > href="mailto:>
> href="mailto:[email-masked]">[email-masked]">>
> > href="mailto:>
> > From: Dan Wing [mailto:> ymailto="mailto:>
> > > href="mailto:> ymailto="mailto:[email-masked]"
> href="mailto:[email-masked]">[email-masked]">>
> > href="http://example.net">> target="_blank"
> > href="http://redmond.corp.microsoft.com">>
> > href="http://ntdev.microsoft.com">>
> > href="http://dns.corp.microsoft.com">>
> > href="http://hsd1.wa.comcast.net">>
> > ymailto="mailto:>
> href="mailto:[email-masked]">[email-masked]"
> > >
> > href="mailto:>
> href="mailto:[email-masked]">[email-masked]">>
> > > href="mailto:> ymailto="mailto:[email-masked]"
> href="mailto:[email-masked]">[email-masked]">>
> > > href="mailto:> ymailto="mailto:[email-masked]"
> href="mailto:[email-masked]">[email-masked]">>