Subject: Re: [pcp] base #24 (closed): PCP mappings same public IP address as dynamic mappings

From: "pcp issue tracker" <[email-masked]>
Date: Tue, 08 Feb 2011 22:57:21 -0000

#24: PCP mappings same public IP address as dynamic mappings

Changes (by dwing@…):

  * status:  reopened => closed
  * resolution:  => fixed

Comment:

 In -05, this will now read:

 {{{
           Once an internal host has no implicit dynamic mappings
           and has no explicit dynamic mappings in the PCP-controlled
           device, a subsequent PCP request for that internal host MAY
           be assigned to a different external IP address.  Generally,
           this re-assignment would occur when a CGN device is load
           balancing newly-seen hosts to its public IPv4 address
           pool.
 }}}

-- 
--------------------------------+-------------------------------------------
 Reporter:  dwing@…             |        Owner:        
     Type:  enhancement         |       Status:  closed
 Priority:  major               |    Milestone:        
Component:  base                |      Version:        
 Severity:  Active WG Document  |   Resolution:  fixed 
 Keywords:                      |  
--------------------------------+-------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/pcp/trac/ticket/24#comment:3>
pcp <http://tools.ietf.org/pcp/>

---

From: Francis Dupont <[email-masked]>
Date: Wed, 09 Feb 2011 17:42:37 +0100

I strongly disagree: the external address must be per subscriber,
not per host (or per host only when there is no subscriber,
BTW DS-Lite requires per subscriber (cf REQ-1 of
draft-ietf-behave-lsn-requirements-00.txt) and for the CGN
side of NAT444 hosts are not visible so I don't know there is
a case where one can see a difference).

Regards

[email-masked]

PS: for IWF IGD the State Variables, including ExternaIPAddress,
are clearly global (i.e., per WANIPConnection service instance).
So per control point ExternaIPAddress is *not* allowed.

---

From: "Dan Wing" <[email-masked]>
Date: Wed, 9 Feb 2011 09:30:45 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Wednesday, February 09, 2011 8:43 AM
> To: pcp issue tracker
> Cc: [email-masked]; [email-masked]
> Subject: Re: [pcp] base #24 (closed): PCP mappings same public IP
> address as dynamic mappings
> 

The text in -05 (which isn't yet published) currently says:

   8.4.1.  Maintaining Same External IP Address

   If there are active mappings associated with a given subscriber (see
   Section 10.5) -- created via dynamic assignment, by PCP or any other
   means -- subsequent PCP mapping requests belonging to the same
   subscriber MUST use the same external IP address.  This follows the
   intent of REQ-1 of [I-D.ietf-behave-lsn-requirements].

   Once an internal host has no implicit dynamic mappings and has no
   explicit dynamic mappings in the PCP-controlled device, a subsequent
   PCP request for that internal host MAY be assigned to a different
   external IP address.  Generally, this re-assignment would occur when
   a CGN device is load balancing newly-seen hosts to its public IPv4
   address pool.

If I understand correctly, you want the second paragraph to replace
"internal host" with "all hosts belonging to a given subscriber"?

-d

---

From: "pcp issue tracker" <[email-masked]>
Date: Wed, 09 Feb 2011 17:52:54 -0000

Comment(by dwing@…):

 New option, UNPROCESSED, was added in -04.  This issue is closed.

Ticket URL: <http://trac.tools.ietf.org/wg/pcp/trac/ticket/24#comment:4>
pcp <http://tools.ietf.org/pcp/>

---

From: Reinaldo Penno <[email-masked]>
Date: Wed, 9 Feb 2011 14:27:13 -0500

I think this requirement needs more discussion. Maybe 'LSN requirements' was
too focused on NAT444 because that is the history of the document.

A 'subscriber' can be an enterprise over IPoE, PPP, and many others. You can
only map all hosts within a subscriber to the same public if you know which
hosts belong to a subscriber to begin with. This is not always the case.

On 2/9/11 9:30 AM, "Dan Wing" <[email-masked]> wrote:

> _______________________________________________
> pcp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pcp

---

From: Francis Dupont <[email-masked]>
Date: Thu, 10 Feb 2011 00:16:11 +0100

In your previous mail you wrote:

   

   
=> yes and I believe 'has no mapping of any kind' is better than
'has no implicit ... and has no explicit...'.
BTW I can't see how with your proposed wording the first and second
paragraphs are compatible.

Regards

---

From: Francis Dupont <[email-masked]>
Date: Thu, 10 Feb 2011 00:21:19 +0100

I am afraid the ticket number is not #24
(IMHO it is #19)...

Regards

---

From: Francis Dupont <[email-masked]>
Date: Thu, 10 Feb 2011 00:41:04 +0100

I think this requirement needs more discussion. Maybe 'LSN
   requirements' was too focused on NAT444 because that is the history
   of the document.
   
=> I agree it seems CGNs/LSNs are only DS-Lite AFTRs and the ISP
side of NAT444. Both are very similar so if someone invents a
third option many details won't match.

   A 'subscriber' can be an enterprise over IPoE, PPP, and many
   others. You can only map all hosts within a subscriber to the same
   public if you know which hosts belong to a subscriber to begin
   with. This is not always the case.
   
=> I am afraid the subscriber notion is essential for the security,
so the other case has a major security issue which is addressed in
a way I'd like to know before going further.   
   
Regards

---

From: "Dan Wing" <[email-masked]>
Date: Wed, 9 Feb 2011 18:34:20 -0800

> From: Reinaldo Penno [mailto:[email-masked]]
> Sent: Wednesday, February 09, 2011 11:27 AM
> To: Dan Wing; [email-masked]
> Cc: [email-masked]
> requirements' was

And there could, I suppose, be more hosts at a subscriber's site
than can be mapped to a single IPv4 address.  For example, 100 hosts
and the ISP wants to give every host 1000 ports.

Q: does anything break if two hosts, belonging to the same subscriber,
are given different external IPv4 addresses?  Today, without CGN,
that happens all the time anyway.

-d

---

From: Reinaldo Penno <[email-masked]>
Date: Wed, 9 Feb 2011 21:34:42 -0500

> third option many details won't match.

The example I gave already exists today. Enterprises/Branches that go
through a CGN that has more than one NAT public IP address for the
enterprise. In this case, the CGN should not map all hosts in the enterprise
to a single public IP otherwise it will not make use of all public IP
addresses.

In general in the case of a centralized CGN (as opposed to a CGN in a BNG or
similar) I'm not sure how the mapping of 'subscriber' to the same one (or
more) public IPs can be guaranteed by PCP.

Are you suggesting some sort of 'subscriber ID' in PCP?

> a way I'd like to know before going further.

Can you elaborate how the notion of subscriber is essential to security?

---

From: Francis Dupont <[email-masked]>
Date: Thu, 10 Feb 2011 14:32:49 +0100

=> usually the ISP ignores the number of hosts, i.e., the only use
of the host notion at the ISP level is a different internal address
(of course this supposes first there is not a NAT hidding hosts).

=> I can't parse your statement: the term external address makes sense
only where there is a NAT, and with a NAT only one address is visible.
   
And to answer to the question, yes it breaks applications.
Now if you'd like to discuss this, IMHO the behave WG is the right place.
   
Regards

---

From: Francis Dupont <[email-masked]>
Date: Thu, 10 Feb 2011 14:36:16 +0100

=> as you suggest there is no notion of subscriber in an enterprise NAT,
so the one external address per subscriber simply doesn't apply.
   
Regards

---

From: Reinaldo Penno <[email-masked]>
Date: Thu, 10 Feb 2011 10:38:10 -0500

There is a very specific definition of a subscriber; this subscriber gets
specific H-QoS, filtering, pay differentiated fee, have AAA enabled, etc.
But I'm afraid it does not fit the model you are advocating.

Can you elaborate on what you said about the notion of subscriber is
essential for security?

---

From: "Dan Wing" <[email-masked]>
Date: Thu, 10 Feb 2011 08:58:36 -0800

> Sent: Thursday, February 10, 2011 5:33 AM
> To: Dan Wing
> Cc: 'Reinaldo Penno'; [email-masked]

Name one.

-d

---

From: Francis Dupont <[email-masked]>
Date: Thu, 10 Feb 2011 18:13:19 +0100

=> I use the definition from base-04 (3 page 8 and 10.5 pages 42 and 43).

=> the subscriber security is in fact the strict separation between
subscribers, so not only the notion could not be loose but
the way a subscriber can be identified is critical. (cf 10.5)

Note we have only two security level: the security inside a subscriber
and the security between subscribers. This is why we are in trouble
with enterprise NATs which don't fit in any of them.

Regards

---

From: Reinaldo Penno <[email-masked]>
Date: Thu, 10 Feb 2011 12:50:47 -0500

> => I use the definition from base-04 (3 page 8 and 10.5 pages 42 and 43).

"   subscriber:
      an entity provided access to the network.  In the case of a
      commercial ISP, this is typically a single home."

This is just a circuit/billing relationship. We should not extrapolate the
addressing relationship from this.

There are home subscribers with fixed IPv4(s), dynamic, with a bridge device
that go through a single layer of NAT (CGN in the network); not to mention
SOHO and Enterprise. They can all go trough the same CGN.

> the way a subscriber can be identified is critical. (cf 10.5)

I think maybe the issue is that in the paragraph below should substitute
'subscriber' by 'PCP Client or third-party device'

"  The MAP OpCodes require subscriber identification because they
   allocate resources or adjust resources allocated to a subscriber."

It seems natural this change since if we are talking about resources,
certainly different hosts/PCP Clients within a 'subscriber' (billing
relationship) can ask for different resources.

---

From: Francis Dupont <[email-masked]>
Date: Thu, 10 Feb 2011 19:13:31 +0100

Name one.
   
=> NAT based load balancers and in general internally distributed
applications (but the question should be sent to the behave WG
mailing list).
   
Regards

PS: note someone who worked at that time for a huge ISP really
insisted about this point, so I expect you'll get more/better
arguments from people using CGNs (which is not my case :-).

---

From: "Dan Wing" <[email-masked]>
Date: Thu, 10 Feb 2011 11:03:42 -0800

> Sent: Thursday, February 10, 2011 10:14 AM
> To: Dan Wing

NAT based load balancers, in front of servers, such as an HTTP
server??

-d

---

From: Francis Dupont <[email-masked]>
Date: Thu, 10 Feb 2011 20:08:55 +0100

This is just a circuit/billing relationship.
                          ^^^^^^^

=> it is enough for me (and it should be enough for any
for-profit ISP too :-)

   We should not extrapolate the addressing relationship from this.

=> we apply the behave requirement which says a subscriber
should get an unique external address. (of course the opposite
is not true: an external address can be (and will be) shared
between several subscribers.
   
   There are home subscribers with fixed IPv4(s), dynamic, with a
   bridge device that go through a single layer of NAT (CGN in the
   network); not to mention SOHO and Enterprise. They can all go
   trough the same CGN.
   
=> this is a subscriber-ID issue. IMHO as soon as there is a
reliable one it is fine. Note without a reliable subscriber-ID
the provided service is for free (:-).

   
=> I should not have the same interpretation of the term resources
as this text seems fine for me.

=> I can't follow your logic. What does really matter is the billing
and there is an one-to-one relationship between bills and subscribers.

Regards

PS: draft-ietf-behave-lsn-requirements-00 uses the term CPE in
place of subscriber. IMHO we are better for the reasons
I explained but what is the opinion?

---

From: Reinaldo Penno <[email-masked]>
Date: Thu, 10 Feb 2011 14:24:05 -0500

The LSN requirements document? This document will evolve considerably and
this discussion is very relevant to it.

If it the document refers to CPE and the CPE is bridged and each host gets
it own address how can this be enforced? Again, there is implicit assumption
of two layers of NAT and furthermore that the first layer has just one
address and second has a single address assigned to the first layer.

PCP can state those assumptions or can ask BEHAVE to clarify them.

---

From: Francis Dupont <[email-masked]>
Date: Fri, 11 Feb 2011 01:34:45 +0100

The LSN requirements document?

=> yes, it replaces a document which is explicitly referenced
by the DS-Lite I-D.

   This document will evolve considerably and
   this discussion is very relevant to it.
   
=> yes of course but it is a BEHAVE document.

   If it the document refers to CPE and the CPE is bridged and each host gets
   it own address how can this be enforced?

=> it doesn't matter as soon there is either no subscriber or
a reliable subscriber-ID (the MAC address?).

   Again, there is implicit assumption of two layers of NAT and
   furthermore that the first layer has just one address and second
   has a single address assigned to the first layer.
   
=> I don't believe there is an implicit assumption for NAT444
but clearly NAT444 is in the scope and is expected to become
a common way to deploy CGNs aka LSNs.

=> I am in favor of both: there should not be some implicit assumptions
even if this limits the applicability of PCP today.

Regards