Re: [dhcwg] I-D Action: draft-ietf-dhc-dhcpv6-pd-relay-requirements-00.txt

["Bernie Volz (volz)" <[e-mail]>]

I’m not sure how that R-4 text helps as there is no “delegated prefix” yet (assuming the CPE has rebooted and has no saved state regarding previous delegated prefixes)?


  *   Bernie

From: Timothy Winters <[e-mail]>
Sent: Wednesday, April 8, 2020 11:51 AM
To: [e-mail]
Cc: Ole Troan <[e-mail]>; Bernie Volz (volz) <[e-mail]>; [e-mail]; [e-mail]
Subject: Re: [dhcwg] I-D Action: draft-ietf-dhc-dhcpv6-pd-relay-requirements-00.txt

Hi Ian,

  We've seen it on our setups when we reboot a device and forget about connection to a LAN clicent.   Oddly we aren't trying to test the forwarding loop so I would say it happens.

I think that text resolves my issue perfectly.

~Tim

On Wed, Apr 8, 2020 at 11:33 AM <[e-mail]<mailto:[e-mail]>> wrote:
Hi Tim,

Have you seen this in the wild?

What about the following:

   R-4:    If the relay has an existing route for a delegated prefix via an interface, and receives ingress traffic on this interface with a destination address from the delegated prefix (not configured on the relay), then it MUST be dropped.

Thanks,
Ian



On 8. Apr 2020, at 16:38, Timothy Winters <[e-mail]<mailto:tim@qacafe..com>> wrote:

Hi Ole,

I think the issue in all of these cases is the CPE doesn't know it had the prefix previously.  So 3633 won't cover this case, as to the CPE it just seems like IPv6 packets.  It routes them out it's default route, which happens to be the same interface it got them.

~Tim

On Wed, Apr 8, 2020 at 10:29 AM Timothy Winters <[e-mail]<mailto:[e-mail]>> wrote:
Hi Ole,

We have a rule for this when it's delegated to the CPE, WPD-5 to blackhole PDs not assigned.  In this case the CPE had no idea it had it.   G-3 disallows LAN to WAN forwarding before getting an address.  I think this case is WAN to WAN forwarding.   It's not in 7084 to my knowledge, as for 3633 I'm not so sure about.  Let me have a look.

~Tim

On Wed, Apr 8, 2020 at 10:12 AM <[e-mail]<mailto:[e-mail]>> wrote:
> Sounds like a useful issue to try to address – the DHC connection is because of the DHCP issues.
>
> And, I assume looping occurs because packets cycle between SP router and CPE until TTL/HOP expires?
>
> Do you have a suggestion as to what the CPE should do in this case? For example, are you suggesting that the CPE drop received traffic (except for DHCP and perhaps some other limited traffic addressed to it)?

A CPE should never provide transit.
I.e it should never forward a packet received on it's WAN interface back out the WAN interface.

A more specific rule for that is in 7084 and possibly in 3633, requiring a blockhole route on the requesting router for the delegated prefix.

Ole