Subject: DHCP issue in draft-palet-v6ops-solution-tun-auto-disc-01.txt

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Tue, 02 Nov 2004 01:35:49 +0100

Hi all,

Regarding draft-palet-v6ops-solution-tun-auto-disc-01.txt

There is an issue that had been discussed in my email on 24th Oct. with
Pekka.

Please, read the draft, and provide your inputs, specially on the need to
include a DHCP backup solution or not.

> My point of view is that both the ability to resolve SRV/A and anycast are
> already available today in all the clients, so making both as part of the
> requirement, will not add actually any new requirements.
> 
> I'm not considering DHCP at all. May be need to be further clarified. Is one
> more option, but more related, in my opinion, to very controlled networks
> where you are sure that DHCP options are relayed. We can even delete this
> section if it creates confusion. Thoughts from the WG well be needed here !
> 

Regards,
Jordi

**********************************
Madrid 2003 Global IPv6 Summit
Presentations and videos on line at:
http://www.ipv6-es.com

This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Tue, 02 Nov 2004 01:39:09 +0100

Hi all,

Next issue with this document.

Please, read the document and provide inputs, specially on this point.

>>> Our intend here is to offer two options:
>>> 1) No service at all outside the ISP (then filtering will make it)
>>> 2) An ISP that offers services (some, may be not the same) to users outside
>>> its own network. I think this is a possibility and we must support it in a
>>> clear way, in case somebody want to make use of it.
>> 
>> I can understand these options, but AFAIK dual-faced DNS does not
>> offer any better means to achieve 2), while being a lot worse.  Sure,
>> you can hide the tunnel endpoint (so that it can only be looked up in
>> the local net) and still keep it operational if you move away from the
>> network, but that allows a lot of abuse (such as local customers
>> telling their friends outside the IP address to use for their
>> tunnels).  Doing dual-faced DNS here would be security by obscurity
>> and that would not be good.
>> 
>> The only practical solution to the 3rd party case appears to be some
>> form of registered mode, i.e., the tunnel endpoint being accessible to
>> anyone, but only allowing certain registered users.
> 
> I'm not really sure about this point of view. Need to think about it. More
> opinions from the WG, please ?
> 

Regards,
Jordi

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Tue, 02 Nov 2004 01:41:21 +0100

Hi all,

Last one ;-)

Please, once more, read the document and provide your inputs, specially on
this:

>>>> the client (rather the operating system)
>>>>  makes a DNS query [6][7] for QNAME=teredo_srv.ispname.com, QCLASS=IN,
>>>>  and QTYPE=A or QTYPE=CNAME.
>>>> 
>>>> ==> which QTYPE is it?  Are you saying the implementations need to query
>>>> both?  That's not good.  Note that if you do a QTYPE=A query, that should
>>>> also match CNAME and give the A record in the answer section, so there is
>>>> no
>>>> need to query CNAME explicitly.  Try e.g. 'dig aaaa ftp.ipv6.funet.fi'.
>>> 
>>> No, just query one of both, the one the OS prefers ;-)
>> 
>> Uhh, you need to specify better what to do so that it can be done in
>> an interoperable manner.  Or if you specify you have to query both,
>> that's OK too, but causes significant issues because it takes
>> additional packets and additional latency.
> 
> Yes, you're right. I guess it will be simple to stick to A, if we care so
> much about the extra packets. WG opinion ?

Regards,
Jordi

---

From: Soohong Daniel Park <[email-masked]>
Date: Tue, 02 Nov 2004 10:12:09 +0900

>I'm not considering DHCP at all. May be need to be further 
>clarified. Is one more option, but more related, in my opinion, 
>to very controlled networks where you are sure that DHCP 
>options are relayed. We can even delete this section if it 
>creates confusion. 

*controlled networks* is also important domain for adopting
IPv6 widely, especially enterprise network is entirely controlled
by network administrator. Also enabling DHCP is quite normal,
cheap and a widely deployed scenario. This solution works
very well within our enterprise network.

>Thoughts from the WG well be needed here !

Which WG do you mean ? DHC WG or V6OPS WG or both ?

     Daniel (Soohong Daniel Park)
     Mobile Platform Lab. Samsung Electronics.

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Tue, 02 Nov 2004 02:26:46 +0100

Hi Daniel,

My original email was in v6ops, because I think is that WG who should decide
about if the document (draft-palet-v6ops-solution-tun-auto-disc-01.txt) need
to keep or not the DHCP solution for "controlled networks".

I agree with your comment, let's see what the rest of the WG say.

Regards,
Jordi

> De: Soohong Daniel Park <[email-masked]>
> Responder a: [email-masked]
> Fecha: Tue, 02 Nov 2004 10:12:09 +0900
> Para: [email-masked], [email-masked]
> CC: Dhcwg <[email-masked]>
> Asunto: RE: DHCP issue in draft-palet-v6ops-solution-tun-auto-disc-01.txt
>

---

From: Pekka Savola <[email-masked]>
Date: Tue, 2 Nov 2004 08:20:49 +0200 (EET)

> very well within our enterprise network.

I've no doubt it works within an enterprise network, but because it 
does not work under all the major scenarios (for example, over 
dial-ups, ADSLs, over VPN or v6-in-[udp]v4 tunnels, etc. where you 
don't run DHCP, and not necessarilily even PPP), the real question is: 
"is DHCP a sufficiently convincing method in a subset of all scenarios 
for configuration of the tunnel endpoint?"

DNS works under every scenario.  DHCP provides a slightly more 
customization per client but I'm sceptical whether this is 
an actual necessity.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Rob Austein <[email-masked]>
Date: Tue, 02 Nov 2004 16:38:52 -0500

If the question is "Is there any need to make an explicit CNAME query
when what one is really looking for is an A RR?", the answer is "No".