Re: [dhcwg] Stephen Farrell's No Objection on draft-ietf-dhc-dhcpv6-failover-protocol-04: (with COMMENT)

[kkinnear <[e-mail]>]

Stephen,

Thanks for your review!

I've responded to your comments, indented, below...

> On Feb 1, 2017, at 8:33 PM, Stephen Farrell <[e-mail]> wrote:
> 
> Stephen Farrell has entered the following ballot position for
> draft-ietf-dhc-dhcpv6-failover-protocol-04: No Objection
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-dhc-dhcpv6-failover-protocol/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> 
> - I support Ben's discuss about "secure mode" - a few
> more details are needed, in particular how a pair
> decide to use/not-use TLS - are there different ports
> or a STARTTLS equivalent - I can't see that defined
> here. (Is it inherited from RFC7653? If so, maybe you
> need to say?)


	Yes, Section 9.1 of RFC 7653 discusses exactly this issue (in
	part due to your review comments from July 2015, as it
	happens).  I believe the discussion there is sufficient.

	I substantially enhanced the Security Considerations section
	as a result of Ben Campbell's comments.  One paragraph that I
	added discussed secure and insecure mode.  I will expand that
	paragraph to point in more detail towards RFC 7653 as follows:


  "DHCPv6 failover can operate in secure or insecure mode.  Secure
  mode (using TLS) would be indicated when the TCP connection between
  failover partners is open to external monitoring or interception.
  Insecure mode should only be used when the TCP connection between
  failover partners remains within set of protected systems.  Details
  of such protections are beyond the scope of this document.  Failover
  servers MUST use the approach documented in Section 9.1 of [RFC7653]
  to decide to use or not to use TLS."


> 
> - For the DNS update stuff - is there no need to use
> TSIG secrets? If there is, how is that sync'd between
> the pair of DHCP servers?  If it is sync'd then don't
> you need to say that TLS is a MUST for such
> connections? If there is no support for TSIG, is that
> likely to work?
> 
> 

	Surely, TSIG is important.  Each DHCP server in a failover
	pair has its own relationship with the relevant DNS servers,
	and needs to be configured with the correct TSIG secrets to
	update those DNS servers.  The configuration of a DHCP server
	to communicate with a DNS server is a configuration issue, and
	outside of the scope of the failover protocol.  

	In the (now blessedly distant) past, we spent years working on
	the DHCPv4 failover protocol trying to shoehorn configuration
	information into the protocol, and it never worked.  DHCP
	servers need *lots* of configuration, and we have most
	consciously decided that synchronizing that configuration
	between failover partners is not the purpose of the DHCPv6
	failover protocol.

Thanks again for your review!

Kim