Re: [dhcwg] I-D Action: draft-ietf-dhc-dhcpv6-pd-relay-requirements-00.txt

[[e-mail]]

Hi Tim,

Have you seen this in the wild?

What about the following:

   R-4:    If the relay has an existing route for a delegated prefix via an interface, and receives ingress traffic on this interface with a destination address from the delegated prefix (not configured on the relay), then it MUST be dropped. 

Thanks,
Ian


> On 8. Apr 2020, at 16:38, Timothy Winters <[e-mail]> wrote:
> 
> Hi Ole,
> 
> I think the issue in all of these cases is the CPE doesn't know it had the prefix previously.  So 3633 won't cover this case, as to the CPE it just seems like IPv6 packets.  It routes them out it's default route, which happens to be the same interface it got them.   
> 
> ~Tim
> 
> On Wed, Apr 8, 2020 at 10:29 AM Timothy Winters <[e-mail] <mailto:[e-mail]>> wrote:
> Hi Ole,
> 
> We have a rule for this when it's delegated to the CPE, WPD-5 to blackhole PDs not assigned.  In this case the CPE had no idea it had it.   G-3 disallows LAN to WAN forwarding before getting an address.  I think this case is WAN to WAN forwarding.   It's not in 7084 to my knowledge, as for 3633 I'm not so sure about.  Let me have a look.
> 
> ~Tim
> 
> On Wed, Apr 8, 2020 at 10:12 AM <[e-mail] <mailto:[e-mail]>> wrote:
> > Sounds like a useful issue to try to address – the DHC connection is because of the DHCP issues.
> >  
> > And, I assume looping occurs because packets cycle between SP router and CPE until TTL/HOP expires?
> >  
> > Do you have a suggestion as to what the CPE should do in this case? For example, are you suggesting that the CPE drop received traffic (except for DHCP and perhaps some other limited traffic addressed to it)?
> 
> A CPE should never provide transit.
> I.e it should never forward a packet received on it's WAN interface back out the WAN interface.
> 
> A more specific rule for that is in 7084 and possibly in 3633, requiring a blockhole route on the requesting router for the delegated prefix.
> 
> Ole
>