Subject: RE: Broadband Forum liaison to IETF on IPv6 security

From: Mikael Abrahamsson <[email-masked]>
Date: Fri, 6 Nov 2009 07:36:31 +0100 (CET)

On Thu, 5 Nov 2009, Dunn, Jeffrey H. wrote:

> I may be missing something, but it appears that, in the cases described, 
> the two hosts downstream of two separate cable modems are off link to 
> each other. This brings up the question: Do there two cable modems 
> constitute two virtual interfaces, like two VLANs on the same physical 
> router interface? If so, this is an architectural, rather than an 
> implementation, question. Thoughts?

This is basically "forced forwarding" for the L2 aggregation layer. It's 
often done on ETTH deployments as well as cable environments, in IPv4 it's 
done in conjunction with local-proxy-arp (in your IP subnet, the ISP 
router will answer all ARP requests with its own MAC and all traffic 
between clients within the subnet is done via the router which does not 
send out ICMP redirects).

In my mind it's unsuitable for clients to run SLAAC in these environments 
and the only real alternative is full DHCPv6(-PD) with SAVI-like 
functionality in the L2 equipment along the way (in v4 the L2 equipment 
does DHCP-snooping and installs L3 filters accordingly).

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Antonio Querubin <[email-masked]>
Date: Fri, 6 Nov 2009 08:34:35 -1000 (HST)

On Fri, 6 Nov 2009, Dunn, Jeffrey H. wrote:

> The problem is IMHO the following: How to assign an IPv6 UGA to CPE 
> hosts attached to a BMA LAN (usually Ethernet or Wi-Fi) that is in turn 
> connected via a CPE router through an NBMA link (cable modem or DSL) to 
> an ISP router that provides Internet access. Currently, there are two

And what happens when there are multiple CPE routers

a)  connected via a BMA LAN to the DSL or cable modem

and/or

b)  'connected' via separate NBMA links but are on the same WAN subnet 
(assigned by the ISP)

I think in the latter, if the ISP decides to silo the individual NBMA 
links then they need to adjust for that in how they do the sub-delegation 
which is I think what the issue is.  But if the ISP actually bridges the 
separate NBMA links, then there's no silo issue and the CPE can pretend 
they're in 'a'.

Antonio Querubin
808-545-5282 x3003
e-mail/xmpp:  [email-masked]

---

From: "Wes Beebee (wbeebee)" <[email-masked]>
Date: Fri, 6 Nov 2009 16:47:55 -0500

The key is that the access router (which is the only router that knows this is an NBMA link and not a BMA link) can selectively decide to send ND messages (either NA's or NS(DAD) messages) when the access router detects that there is a duplicate on the link.  This is the minimum requirement to support DAD on an NBMA link.  This would need to specified in an NBMA-specific document and probably doesn't need to be mentioned in a document like RFC 4861.

- Wes 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dunn, Jeffrey H.
Sent: Friday, November 06, 2009 2:18 PM
To: Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Antonio,

Regardless of whether the ISP bridges the NBMA links or not, the CPE router will not propagate the ND or NS messages onto these links. The Ethernet and Wi-Fi BMA LAN segments are separate logical links from each other and the ISP link(s). How will the CPE router be "convinced" to bridge these link-local scoped messages off link?

Best Regards, 
  
Jeffrey Dunn
Info Systems Eng., Lead
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Antonio Querubin [mailto:[email-masked]]
Sent: Friday, November 06, 2009 1:35 PM
To: Dunn, Jeffrey H.
Cc: Thomas Narten; Fred Baker; [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Thomson; [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

On Fri, 6 Nov 2009, Dunn, Jeffrey H. wrote:

> hosts attached to a BMA LAN (usually Ethernet or Wi-Fi) that is in 
> turn connected via a CPE router through an NBMA link (cable modem or 
> DSL) to an ISP router that provides Internet access. Currently, there 
> are two

and/or

b)  'connected' via separate NBMA links but are on the same WAN subnet (assigned by the ISP)

I think in the latter, if the ISP decides to silo the individual NBMA links then they need to adjust for that in how they do the sub-delegation which is I think what the issue is.  But if the ISP actually bridges the separate NBMA links, then there's no silo issue and the CPE can pretend they're in 'a'.

Antonio Querubin
808-545-5282 x3003

---

From: "Hemant Singh (shemant)" <[email-masked]>
Date: Fri, 6 Nov 2009 18:23:41 -0600

This is the same thought I emailed about that the access concentrator in the NBMA link performing ND Proxy - Wes and I are saying the same thing - he put is very nicely in concise form.  The access concentrator is also the first hop IPv6 router to the broadband enabled home and note that a router interface joins only the all-nodes mcast address and the interface solicited-node mcast address.  Such an interface mcast join will not let the router see all NS(DAD)s on the link.  That is why when a router in the BMA or NBMA link starts sniffing all mcast traffic, then the router sees all the NS(DAD)s on its link and this sniffing for all mcast traffic happens to be the first requirement of a ND Proxy!

As for your question below, the CPE Router in the home has got to have been delegated a prefix and each home gets a different prefix, so how can the UGA from the home device from one home ever encounter a dup at the access concentrator?  If anything dups can exist within the same home, but the CPE Router already takes care of those dups in the home LAN link.

Hemant

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dunn, Jeffrey H.
Sent: Friday, November 06, 2009 6:26 PM
To: Wes Beebee (wbeebee); Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Wes,

That is an interesting idea. One question occurs to me that you can probably answer. What happens if a host behind the CPE router does SLAAC, configures a UGA? Since it has already done DAD, the host assumes it has an unused address. When the host finally tries to use the UGA to access the Internet and the access router sends an NA or NS(DAD), what should the host do? It has already validated the UGA using DAD. My interpretation is that it should reply to the NS(DAD) with an NA (based on RFC 4862). I am not sure about a duplicate NA, since DAD is supposed to prevent this. 

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Wes Beebee (wbeebee) [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 4:48 PM
To: Dunn, Jeffrey H.; Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

- Wes 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dunn, Jeffrey H.
Sent: Friday, November 06, 2009 2:18 PM
To: Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Antonio,

Best Regards, 
  
Jeffrey Dunn
Info Systems Eng., Lead
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Antonio Querubin [mailto:[email-masked]]
Sent: Friday, November 06, 2009 1:35 PM
To: Dunn, Jeffrey H.
Cc: Thomas Narten; Fred Baker; [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Thomson; [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

and/or

Antonio Querubin
808-545-5282 x3003

---

From: "Hemant Singh (shemant)" <[email-masked]>
Date: Fri, 6 Nov 2009 19:06:32 -0600

Jeffrey,

The answer to your question is a yes.  Alternatively, the ISP may just dole out a delegated prefix shorter than a /64 and the CPE Rtr has to live with it but the ISP may use something like a /55 that gives sufficient number of links in the home LAN.  I will reply to any more discussion on this thread once I reach Hiroshima. 

Hemant

-----Original Message-----
From: Dunn, Jeffrey H. [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 7:31 PM
To: Hemant Singh (shemant); Wes Beebee (wbeebee); Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

OK. Then the CPE router has a unique /64 for all of its broadcast domains? Does that mean that the customer needs to tell the ISP how many /64 prefixes they need?

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

---

From: Eric Levy-Abegnoli <[email-masked]>
Date: Fri, 06 Nov 2009 10:44:03 +0100

Mikael Abrahamsson a écrit :
>> I may be missing something, but it appears that, in the cases 
>> described, the two hosts downstream of two separate cable modems are 
>> off link to each other. This brings up the question: Do there two 
>> cable modems constitute two virtual interfaces, like two VLANs on the 
>> same physical router interface? If so, this is an architectural, 
>> rather than an implementation, question. Thoughts?
>
> This is basically "forced forwarding" for the L2 aggregation layer. 
> It's often done on ETTH deployments as well as cable environments, in 
> IPv4 it's done in conjunction with local-proxy-arp (in your IP subnet, 
> the ISP router will answer all ARP requests with its own MAC and all 
> traffic between clients within the subnet is done via the router which 
> does not send out ICMP redirects).
>
> In my mind it's unsuitable for clients to run SLAAC in these 
> environments and the only real alternative is full DHCPv6(-PD) with 
> SAVI-like functionality in the L2 equipment along the way (in v4 the 
> L2 equipment does DHCP-snooping and installs L3 filters accordingly).
>
The initial question mentionned link-local duplicate. For a reason: ther 
are not assigned by DHCPv6 which preq their existence and unicity. SLACC 
is your only choice.
Eric

---

From: "Dunn, Jeffrey H." <[email-masked]>
Date: Fri, 6 Nov 2009 14:18:19 -0500

Antonio,

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Antonio Querubin [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 1:35 PM
To: Dunn, Jeffrey H.
Cc: Thomas Narten; Fred Baker; [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Thomson; [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

and/or

Antonio Querubin
808-545-5282 x3003

---

From: "Dunn, Jeffrey H." <[email-masked]>
Date: Fri, 6 Nov 2009 18:25:55 -0500

Wes,

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Wes Beebee (wbeebee) [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 4:48 PM
To: Dunn, Jeffrey H.; Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

- Wes 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dunn, Jeffrey H.
Sent: Friday, November 06, 2009 2:18 PM
To: Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Antonio,

Best Regards, 
  
Jeffrey Dunn
Info Systems Eng., Lead
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Antonio Querubin [mailto:[email-masked]]
Sent: Friday, November 06, 2009 1:35 PM
To: Dunn, Jeffrey H.
Cc: Thomas Narten; Fred Baker; [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Thomson; [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

and/or

Antonio Querubin
808-545-5282 x3003

---

From: "Dunn, Jeffrey H." <[email-masked]>
Date: Fri, 6 Nov 2009 19:31:08 -0500

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Hemant Singh (shemant) [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 7:24 PM
To: Dunn, Jeffrey H.; Wes Beebee (wbeebee); Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Hemant

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dunn, Jeffrey H.
Sent: Friday, November 06, 2009 6:26 PM
To: Wes Beebee (wbeebee); Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Wes,

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Wes Beebee (wbeebee) [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 4:48 PM
To: Dunn, Jeffrey H.; Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

- Wes 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dunn, Jeffrey H.
Sent: Friday, November 06, 2009 2:18 PM
To: Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Antonio,

Best Regards, 
  
Jeffrey Dunn
Info Systems Eng., Lead
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Antonio Querubin [mailto:[email-masked]]
Sent: Friday, November 06, 2009 1:35 PM
To: Dunn, Jeffrey H.
Cc: Thomas Narten; Fred Baker; [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Thomson; [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

and/or

Antonio Querubin
808-545-5282 x3003

---

From: "Dunn, Jeffrey H." <[email-masked]>
Date: Fri, 6 Nov 2009 20:29:25 -0500

Hemant,

Fair enough. I suppose that there are enough /55's or /56's that every household can have one; however, it does make "right sizing" the initial allocation to the ISP very important. We would not want to be allocating non-contiguous /28's on a regular basis :-)

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

-----Original Message-----
From: Hemant Singh (shemant) [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 8:07 PM
To: Dunn, Jeffrey H.; Wes Beebee (wbeebee); Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Jeffrey,

Hemant

-----Original Message-----
From: Dunn, Jeffrey H. [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 7:31 PM
To: Hemant Singh (shemant); Wes Beebee (wbeebee); Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

---

From: "Hemant Singh (shemant)" <[email-masked]>
Date: Sun, 8 Nov 2009 19:05:40 -0600

So have I and Wes been able to close the issue for the DSL Forum folks?  Implement ND Proxy at your first-hop IPv6 router/access concentrator.  

Thanks,

Hemant

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Hemant Singh (shemant)
Sent: Saturday, November 07, 2009 10:07 AM
To: Dunn, Jeffrey H.; Wes Beebee (wbeebee); Antonio Querubin
Cc: Thomas Narten; [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; Erik Nordmark; [email-masked]; [email-masked]; Robin Mersh; Susan Thomson (sethomso); Fred Baker (fred); [email-masked]; [email-masked]; IPv6 Operations; Mailing List; JINMEI Tatuya / 神明達哉
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Jeffrey,

Hemant

-----Original Message-----
From: Dunn, Jeffrey H. [mailto:[email-masked]] 
Sent: Friday, November 06, 2009 7:31 PM
To: Hemant Singh (shemant); Wes Beebee (wbeebee); Antonio Querubin
Cc: Thomas Narten; Fred Baker (fred); [email-masked]; SAVI Mailing List; [email-masked]; Hesham Soliman; [email-masked]; Erik Nordmark; [email-masked]; IPv6 Operations; Susan Thomson (sethomso); [email-masked]; Robin Mersh; Mailing List; [email-masked]; JINMEI Tatuya / 神明達哉; Dunn, Jeffrey H.
Subject: RE: Fwd: Broadband Forum liaison to IETF on IPv6 security

Best Regards, 
  
Jeffrey Dunn 
Info Systems Eng., Lead 
MITRE Corporation.
(301) 448-6965 (mobile)

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------