Subject: RE: [mobile-ip] Re: IPv6 ingress filtering early access

From: "Glenn Morrow" <[email-masked]>
Date: Thu, 3 Jan 2002 11:24:48 -0600

Jari,

There was a long offline argument about how a router would definitely know
that it was the first hop router. I.e. how would it know to turn on the
checks or not without configuration. The point was brought up about
assymetric routing where outbound traffic goes through a set of egress
routers and inbound comes in on  ingress routers. The point was made that
the outbound routers would likely not have a FIB flag set in cache
indicating that node was a first hop. 

So it seems that in order to turn on some kind of check on the 1st hop
automatically, we would need to find some other standardized means of
turning the checks on. I think that if MAC anti-spoofing was mandated then
the solution to mandate the filtering would be mute; however, the problem
set is essentially the same in that you would still have to find a way to
have the router detect automatigically that the anti-spoofing checks were
needed - sort of a zeroconf solution.

We could have the routers monitor the autoconfiguration messages and perhaps
the DHCP messages or we could rely on an all routers multicast message to
handle the situation with assymetric routes. This would be automagic yet I
still suspect someone will complain about subnet bandwidth being used up
with a new message, etc.. Even if such a thing were agreed we will get into
the arguments about core routers also having hosts attached to them. Someone
will likely take the stance that I don't want these core routers being
bogged down; however, configuration via either subneting or simple
configurable overrides would likely quell these arguments as well. 

This would certainly change the thinking from one of you have to configure
the router to enable the filtering to that of you have to configure the
router to disable the filtering. 

Anyway these were my thoughts about this. Thanks for bringing it up. I am
hopeful that something could be done and agreed on this matter with IPv6 and
perhaps even IPv4 for newer implementations or releases. Most of the core
routers are configured in some fashion anyway.

Thanks,

Glenn

> -----Original Message-----
> From: Jari Arkko [mailto:[email-masked]]
> Sent: Wednesday, December 26, 2001 1:39 PM
> To: Francis Dupont; [email-masked]
> Cc: [email-masked]
> Subject: [mobile-ip] Re: IPv6 ingress filtering early access
> 
> 
> > 
> ftp://ftp.ipv6.rennes.enst-bretagne.fr/pub/draft-dupont-ipv6-i
> ngress-filtering-00.txt
> 
> Nice draft, thanks for taking the time to write down the problems and
> their alternative solutions. Hope you still had time for Christmas ;-)
> 
> I have a few comments.
> 
> First, it seems that the main alternatives we have is (a) 
> restrict MIPv6
> functionality by removing intermediate alternatives between 
> bidirectional
> tunneling and route optimisation, or (b) deploy AAA to help 
> visited networks
> figure out what are legal home addresses. 
> 
> It is interesting to note the different actors in these two 
> alternatives. In the
> first alternative, it is the CN who is taking the 
> responsibility, and requiring
> no help whatsoever from the firewalls in between. In the 
> second alternative,
> we put all the trust on the firewalls/routers of sites, and 
> none of the CNs do
> any worrying over this anymore. Both solutions work if 
> applied allover, and
> the second solution allows the current MIPv6 flexibility, 
> being therefore the
> preferred solution if seen feasible.
> 
> However, I'm concerned about the "applied allover" part. 
> Specifically - while
> I'm very much fond of the AAA solutions - I'm concerned 
> whether we can expect
> all parts of the Internet to have an infrastructure that 
> really can figure out the
> home addresses. What if there's a coin-operated (or Visa-) 
> airport WLAN?
> With no connection to a global roaming association of who 
> owns what addresses.
> What kind of filtering should that do? Prohibit everything 
> else expect bidirectional
> tunneling, or allow home addresses to be used? If latter, 
> then the trusting
> CNs don't have a clue that they could be used as reflectors...
> 
> Finally, I seem to remember there was a discussion a long 
> time ago whether
> we could somehow provide automatic, mandatory, ingress 
> filtering in IPv6.
> If such a feature were possible, it would really make setting 
> up networks easier
> and denial of service attacks easier to trace. Do you think 
> this would be
> feasible? If yes, perhaps it should also be discussed in the 
> draft. Currently,
> we are headed towards the same situation as in IPv4 where 
> ingress filtering
> is only partially applied, and we keep coming up with "patch" 
> solutions such
> as I-trace to help the situation. Interestingly, these 
> solutions typically need
> changes to a large fraction of the routers in the Internet 
> which we already are
> doing anyway to move to IPv6...
> 
> Jari
> 
> 
> 
>

---

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Mon, 7 Jan 2002 15:49:59 +0100

=> I agree you can still use it, but definitely not in this
way. Home address is bound to the HA and NOT the AAAH server. 
Please let's not go down the MIPv4-AAA-wedding road !

I could have my HA@home and visa paying my access bills. 
No need for Visa to know my Home address. They should know
my identity of course, NAI, IMSI, credit card number ....etc

but absolutely no need to know my Home address, which I can
change regularly.

Hesham