RE: Broadband Forum liaison to IETF on IPv6 security

[Mikael Abrahamsson <[e-mail]>]

On Thu, 5 Nov 2009, Dunn, Jeffrey H. wrote:

> I may be missing something, but it appears that, in the cases described, 
> the two hosts downstream of two separate cable modems are off link to 
> each other. This brings up the question: Do there two cable modems 
> constitute two virtual interfaces, like two VLANs on the same physical 
> router interface? If so, this is an architectural, rather than an 
> implementation, question. Thoughts?

This is basically "forced forwarding" for the L2 aggregation layer. It's 
often done on ETTH deployments as well as cable environments, in IPv4 it's 
done in conjunction with local-proxy-arp (in your IP subnet, the ISP 
router will answer all ARP requests with its own MAC and all traffic 
between clients within the subnet is done via the router which does not 
send out ICMP redirects).

In my mind it's unsuitable for clients to run SLAAC in these environments 
and the only real alternative is full DHCPv6(-PD) with SAVI-like 
functionality in the L2 equipment along the way (in v4 the L2 equipment 
does DHCP-snooping and installs L3 filters accordingly).

-- 
Mikael Abrahamsson    email: [e-mail]