Subject: 6to4 and 'campus' networks

From: Nathan Ward <[email-masked]>
Date: Sun, 19 Aug 2007 20:37:24 +1200

Many university campus networks (and large businesses that have been  
around for some time, etc.) run non-RFC1918 addresses internally.  
They then NAT, proxy or statefully filter traffic through their  
border. If someone has a better name than "campus" for this, then  
then I'm all ears - I realise it's not accurate at all.

My understanding of Windows (and to some extent some Linuxes and  
BSDs) 6to4 behaviour is that when they detect an interface with a non- 
RFC1918 IPv4 address, they bring up 6to4.

While this is fine for networks that don't filter or otherwise mess  
with IP protocol 41, this causes big problems for users behind  
networks that filter or NAT.

When I recently turned on AAAA records on a fairly decently sized  
traffic website of mine, the most comments about reachability came  
from people on 'campus' style networks, as described above. AAAA  
records are now turned off for that site, for obvious reasons. These  
were all non-technical users with Vista on their machines.

Has anyone given thought to a 6to4 'qualification' procedure for auto- 
configured 6to4? Such a procedure could be as simple as sending an  
ICMPv6 echo request to 2002:c058:6301:: (192.88.99.1) and bringing  
the interface up if there is an acceptable response.

Note that I accept that in an ideal world, administrators of networks  
like this would block traffic to 192.88.99.1, and return an ICMP  
unreachable message of some flavour, so that when we try and reach an  
IPv6 connected host, we instantly realise 6to4 is unusable (and maybe  
even fall back to Teredo or something, instead of IPv4). In the real  
world however, expecting all the administrators of these types of  
networks to make changes like this is fairly unreasonable, and as I  
mention, it's a fairly big problem for anyone wanting to roll out  
AAAA records to production stuff, right now.

--
Nathan Ward

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Sun, 19 Aug 2007 12:57:20 +0300

> then I'm all ears - I realise it's not accurate at all.

I have had cases were proto-41 was statelessly firewalled as well (no 
NAT though). One was a "campus" network, but I have also met this 
problem on some commercial Wi-Fi networks.

> BSDs) 6to4 behaviour is that when they detect an interface with a
> non- RFC1918 IPv4 address, they bring up 6to4.

Yes.

And they also start sending router advertisements, regardless of 
any "administered" IPv6 router on the network.

> networks that filter or NAT.

Exactly.

(...)
> Has anyone given thought to a 6to4 'qualification' procedure for
> auto- configured 6to4? Such a procedure could be as simple as sending
> an ICMPv6 echo request to 2002:c058:6301:: (192.88.99.1) and bringing

I have considered this. It does not work. You will see that, ok, 
proto-41 is not statelessly firewalled. But that is not sufficient 
since 6to4 is relayed asymetrically between 6to4 nodes and the native 
IPv6 Internet.

For proper detection, you would need to ping a native IPv6 node, which 
you know will reply through an outbound 6to4 relay that encapsulates 
packets with a source address different from 192.88.99.1. If that 
works, there's good chance that there is no firewalling at all (or some 
kind of "cone" firewalling).

-- 
Rémi Denis-Courmont
http://www.remlab.net/

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 19 Aug 2007 13:09:00 +0200

No disagreement with Rémi, but we should understand that this
refers to the "host 6to4" heresy, and is not how 6to4 is defined in
RFC 3056. The model in that spec is that it is the campus border
router that implements 6to4 and issues appropriate RAs within
the campus. It would be interesting to hear about implementations
of RFC 3056.

Regards
    Brian Carpenter

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Sun, 19 Aug 2007 14:27:53 +0300

> the campus. It would be interesting to hear about implementations

I would not call that « "host 6to4" heresy » though.

These automagical RFC3056 implementations (at least Windows XP and 
Vista) actually do behave as full 6to4 border gateways. So 
real "router", not simple "host" -- That's where the whole "rogue RAs" 
thread that I unintendedly sparked in Prague comes from.

And if I'm not mistaken, this behavior is part of the "share my Internet 
connection with other computers" option somewhere in Windows.

-- 
Rémi Denis-Courmont
http://www.remlab.net/

---

From: "Templin, Fred L" <[email-masked]>
Date: Mon, 20 Aug 2007 08:25:38 -0700

> then I'm all ears - I realise it's not accurate at all.

I think the term "enterprise" has also been used?

Fred
[email-masked]