Re: [BEHAVE] Comments and question on scope of Re: I-D Action:draft-ietf-behave-lsn-requirements-00.txt

["Dan Wing" <[e-mail]>]

> -----Original Message-----
> From: Reinaldo Penno [mailto:[e-mail]]
> Sent: Wednesday, October 20, 2010 9:53 AM
> To: Dan Wing; 'Ikuhei.Yamagata'; [e-mail]; 'Dave Thaler'
> Cc: [e-mail]
> Subject: Re: Comments and question on scope of Re: [BEHAVE] I-D
> Action:draft-ietf-behave-lsn-requirements-00.txt
> 
> 
> 
> 
> On 10/20/10 9:31 AM, "Dan Wing" <[e-mail]> wrote:
> 
> >>>> In some ISPs the ratio of available ports to subscriber
> >> (compression)
> >>>> is
> >>>> very low and those mechanisms are not needed at all.
> >>>
> >>> Disagree.  Without such a limit, a malfunctioning host or a host
> >>> doing port scanning could consume all 64K ports, causing a DoS for
> >>> other users behind that same NAT, without consuming much bandwidth
> >>> at all.
> >>
> >> Exactly, some people agree others do not. This is a deployment
> >> decision. We provide a knob and let ISPs decide.
> >
> > Would "MUST provide the ability to restrict # of ports allocated to
> an
> > interior host or subscriber, to allow operator to prevent a single
> > host or subscriber from consuming all ports" be reasonable wording?
> 
> Yes.
> 
> >
> > ...
> >>> In NAT444, ingress filtering works just like it does today:  the
> >>> source address of traffic from the subscriber can be filtered to
> >>> only be the IP address assigned by DHCP (or PPP).
> >>
> >>
> >> I think there is a disconnect. If the LSN is deep into the network,
> how
> >> it
> >> will perform ingress filtering for DHCP subs?
> >
> > It can't.  The filtering has to be configured on the network
> equipment
> > close enough to the subscriber to effectively filter.  That is
> similar,
> > if not identical, to how ingress filtering works today; if ingress
> > filtering is done too far from the subscriber, it allows a subscriber
> > to spoof traffic within the ISP's network (interior to wherever the
> > filtering is done), such as towards their neighbor down the street.
> 
> Okay, we seem to agree, but then how can this be a general LSN
> requirement?
> It can only be a requirement if the LSN is close to the subscribers. If
> we
> can word like that I'm okay.

If the LSN is not directly connected to subscribers (i.e., the LSN is not
draft-miles-behave-l2nat, DS-Lite tunnel, draft-arkko-dual-stack-extra-lite,
etc.), I agree with what you're saying.  I believe we can craft wording
around the case where the CGN is directly connected to subscribers and,
where the CGN is not directly connected to subscribers it is a requirement
of the network to do ingress filtering.

-d