Subject: RE: Fwd: Re: WG Review: Transparent Interconnection of Lots ofLinks (trill)

From: "Manfredi, Albert E" <[email-masked]>
Date: Wed, 22 Jun 2005 16:22:38 -0400

If TRILL is striving to adapt a link state protocol to a flat address
space, seems to me that within the current IETF structure, expertise
would be in the routing area.

But this seems to create confusion. Maybe I'm confused, but I don't
think TRILL is going after creating larger layer 2 nets at all, right?
Just attempting to do something more clever than a spanning tree for the
layer 2 catenet. So I don't think that lack of market success of NHRP or
MPOA, from the old ION wg, where two fair dinkum *routing* protocols
were being meshed together, applies here. Isn't the scope of TRILL far
smaller? I hope so.

We need a "bridging" area in the IETF, then, and perhaps work on things
like IGMP snooping can go in there as well. This might help alleviate
some of the concerns I've seen aired. We need a home for "this is really
supposed to be IEEE work, but they don't want to do it or they need
help."

Bert

> -----Original Message-----
> From: Margaret Wasserman [mailto:[email-masked]] 
> Sent: Wednesday, June 22, 2005 12:16 PM
> To: Susan Hares; Adrian Farrel; Brian E Carpenter
> Cc: Alex Zinin; [email-masked]; [email-masked]; 
> [email-masked]; [email-masked]
> Subject: RE: Fwd: Re: WG Review: Transparent Interconnection 
> of Lots ofLinks (trill)
> 
> 
> Hi Sue,
> 
> The TRILL WG would not be chartered to develop a link-state routing 
> protocol.  They would be chartered to make use of an existing 
> link-state routing protocol, and any extensions or modifications to 
> that protocol would be referred to the appropriate routing area WG.
> 
> The TRILL WG would  determine the mechanisms for encapsulating and 
> forwarding Ethernet frames and for auto-configuring the rbridges.  I 
> am not sure that in-depth expertise in link-state routing protocols 
> is needed for that.  Instead, you need expertise in encapsulation, 
> forwarding and configuration, which are all Internet area topics.
> 
> Margaret

_______________________________________________
routing-discussion mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/routing-discussion

---

From: Pekka Savola <[email-masked]>
Date: Thu, 23 Jun 2005 07:08:11 +0300 (EEST)

On Wed, 22 Jun 2005, Manfredi, Albert E wrote:
> layer 2 catenet.

Maybe not intentionally, but I think that will be the result.  A usage 
case that has been shown has been a hospital whose network (with 
thousands of hosts) is a single broadcast domain.

I think everyone can agree that instead of making such large broadcast 
domains, the network should be split up by routing instead.

While TRILL would "fix" the usage case above so that using a single 
broadcast domain would still "work", that would still be very bad 
network design, and in the longer term, it would probably be 
counter-productive.

(In our environment, what we've seen recently is *decrease* in the 
size of broadcast domains/subnets due to the requirements to isolate 
and filter the traffic from other hosts at the site.  Using a single 
domain makes this security issue much worse.)

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 23 Jun 2005 13:57:50 +0200

Pekka Savola wrote:
> (In our environment, what we've seen recently is *decrease* in the size 
> of broadcast domains/subnets due to the requirements to isolate and 
> filter the traffic from other hosts at the site.  Using a single domain 
> makes this security issue much worse.)
> 

Having run one of those very large broadcast domains in my past life,
I understand Pekka and Manfred perfectly - but nevertheless there
seems to be a market for such solutions, and that means either
we do a hopefully good standard, or someone else does a possibly
less good standard. I don't think there's a 3rd choice.

    Brian

---

From: Curtis Villamizar <[email-masked]>
Date: Thu, 23 Jun 2005 14:39:51 -0400

Pekka,

We seem to be in agreement.

> thousands of hosts) is a single broadcast domain.

Or the college campus with 30,000-50,000 student an increasing number
with laptops.  Bridging has already been considered somewhat of a
failure on some of the larger campuses in the ethernet days and in
those days there were far fewer comuputers.

> domains, the network should be split up by routing instead.

So we should look for a solution which is based on routing.  No sense
repeating a prior failed exercise.

> domain makes this security issue much worse.)

Security by subnet isolation isn't the best security practice
butsecuring the hosts and running the applications the user needs
often isn't possible (particularly if the hosts are microsoft based).
Therefore this is very common.  One place where bridging has come into
play is creating virtual subnets to connect people who work together
but are dispersed around a building and in doing so supporting this
form of security.

So there still are still good reasons to do bridging but large scale
connection of wireless (or wired) is not a good application of
bridging.

If this is the sort of application that is driving the bridging work,
then it makes perfect sense to just use IP and encapsulate the
ethernet frames in IP and don't worry about what does the routing.  It
could be RIP, OSPF, ISIS, BGP, or (unlikely) something else.  What is
needed then is a means to distribute the mapping of MAC address to the
IP address of the nearest participating switch.  OSPF itself, or ISIS
doesn't work over distances unless you set up tunneled adjacencies.
It would be simpler to have a protocol that allows logical adjacencies
and supports some form of flooding but has no need for any other
routing protocol feature and will never need to do an SPF.  This
doesn't scale well since a domain wide mapping of MAC to something is
needed, but it does the job for small domains.

This would for example, allow a people in the office on the west coast
to be on the same subnet as a people on the east coast (pick a country
or continent) with a scattering of people in other locations.  This
addresses the "desire" to do security by subnetting.  It also
accommodates the handful of PC applications that for some reason use
IP broadcast to discover other users (I think Lotus Notes has been
weened of that behaviour but there are others).  The solution being
offerred only works with adjacent boxes (unless tunneled, over GRE for
example).

Sound a bit like adding a simple protocol to do MAC to IP mapping and
using "Transparent Ethernet Bridging" over GRE?

> Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

This seems to be a case of a square peg and a round hole and the
search for a better hammer to address the problem.  Maybe its just the
way many IT departments want to do things.  

In Radia's introduction in the draft (draft-perlman-rbridge-03.txt) it
states "The design allows for zero configuration" which may be the
underlying problem that needs solving.  As is there are other ways to
get very close to a fixed router and DHCP server configuration.  You
only need one router per closet or two for redundancy, and you will
still need a DHCP server even with the rbridges.

Curtis