Re: [mif] draft-ietf-mif-current-practices-00

[Dave Thaler <[e-mail]>]

And for the "note well", Microsoft may have some IP in this area.

-Dave

> -----Original Message-----
> From: Dave Thaler
> Sent: Monday, April 12, 2010 3:43 PM
> To: '[e-mail]'; [e-mail]; [e-mail];
> [e-mail]
> Cc: [e-mail]
> Subject: RE: [mif] draft-ietf-mif-current-practices-00
>
> > -----Original Message-----
> > From: [e-mail] [mailto:[e-mail]]
> > Sent: Monday, April 12, 2010 1:53 PM
> > To: [e-mail]; [e-mail]; [e-mail]; Dave
> > Thaler
> > Cc: [e-mail]
> > Subject: RE: [mif] draft-ietf-mif-current-practices-00
> >
> > Hi,
> >
> > Why do you think #4 is not mif-specific? What possible use NRPT has for
> single
> > interfaced host? Or is the idea such that a host could have single
> interface,
> > but just use different DNS server for queries matching NRPT?
>
> Right.  The NRPT is similar to a configured cache of NS records.
> It's used to solve the problem of have access to multiple disjoint namespaces
> (like corporate DNS and public DNS).  Private names aren't resolvable in
> the public DNS, so you have to know what DNS server to ask.
>
> > ....hmm...
> > Do you consider a host using DirectAccess single or multi-interfaced? From
> my
> > quick reading of the DirectAccess feature, it sounds to be somewhere in
> > between - not obviously multi-interface like the VPN-case is, but not quite
> > single-interfaced either.
>
> Right it could be either one.
>
> >
> > Is there a way to configure NRPT policies remotely via some protocol?
>
> Yes, it's designed to be configured by an enterprise administrator of the
> organization that manages the host.  So there's an authenticated,
> configuration distribution protocol for ActiveDirectory-domain-joined hosts.
>
> -Dave
>
> >
> > Thanks for explanation,
> >
> > Teemu
> >
> > > -----Original Message-----
> > > From: [e-mail] [mailto:[e-mail]] On Behalf Of
> > > ext gabriel montenegro
> > > Sent: 08. huhtikuuta 2010 23:17
> > > To: Dan Wing; Hui Deng; Dave Thaler
> > > Cc: [e-mail]
> > > Subject: Re: [mif] draft-ietf-mif-current-practices-00
> > >
> > > In addition to those three usages of "suffix":
> > >
> > > 1. Domain Search list suffix
> > > 2. For interface-specific suffix list
> > > 3. Suffix to control Dynamic DNS Updates
> > >
> > > There is yet another usage in Windows introduced in windows 7 and its
> > > server counterpart, Windows Server 2008 R2:
> > >
> > > 4. Suffix in the NRPT [1] to aid in identifying a Namespace that
> > > requires special handling,
> > > as used for DirectAccess [2]. This is not MIF-specific either.
> > >
> > > Only #2 is MIF-specific (and this should be called out), but it makes
> > > sense to clarify the
> > > other uses of "suffix" otherwise #2 won't be clear.
> > >
> > > [1] NRPT: See http://technet.microsoft.com/en-us/magazine/ff394369.aspx
> > > [2] DirectAcess: http://technet.microsoft.com/en-
> > > us/magazine/2009.05.cableguy.aspx
> > >
> > > Gabriel
> > >
> > > ----- Original Message ----
> > > > From: Dan Wing <[e-mail]>
> > > > To: Hui Deng <[e-mail]>; Dave Thaler
> > > <[e-mail]>
> > > > Cc: [e-mail]; Gabriel Montenegro <[e-mail]>
> > > > Sent: Thu, April 8, 2010 7:22:23 AM
> > > > Subject: Re: [mif] draft-ietf-mif-current-practices-00
> > > >
> > > >
> > >
> > > > -----Original Message-----
> > > > From: Hui Deng [mailto:> ymailto="mailto:[e-mail]"
> > > > href="mailto:[e-mail]">[e-mail]]
> > > > Sent:
> > > > Wednesday, April 07, 2010 7:29 PM
> > > > To: Dave Thaler
> > > > Cc: Dan Wing;
> > > > Gabriel Montenegro; > href="mailto:[e-mail]">[e-mail]
> > > > Subject: Re: [mif]
> > > > draft-ietf-mif-current-practices-00
> > > >
> > > > 2nd purpose has been
> > > > documented in the current practice draft,
> > > > whether 1st and 3rd purpose
> > > > need to be documented as well? it may not
> > > > directly related to
> > > > MIF?
> > >
> > > Some operating systems -- e.g., most flavors of Unix -- do not
> > > > support the
> > > ability for sending different DNS queries to different DNS
> > > > servers.
> > >
> > > It would be helpful if the draft more clearly described the
> > > > functionality.
> > > Someone unfamiliar with the Windows functionality, reading the
> > > > draft, assumes
> > > it is merely talking about the 'domain search list' -- because
> > > > that is what
> > > they are familiar with.
> > >
> > > I don't care how the draft
> > > > is fixed to make it clearer.  I propose describing
> > > the 2 (and, as Dave
> > > > pointed out, 3) functions.  If you want to adjust the
> > > document to
> > > > instead talk about the per-interface stuff, that's great -- my
> > > point is that
> > > > right now it is insufficiently clear in explaining it.
> > >
> > > -d
> > >
> > > >
> > > > -Hui
> > > >
> > > > 2010/4/7 Dave Thaler <> ymailto="mailto:[e-mail]"
> > > > href="mailto:[e-mail]">[e-mail]>:
> > > >
> > > > >> -----Original Message-----
> > > > >> From: Dan Wing [mailto:> ymailto="mailto:[e-mail]"
> > > > href="mailto:[e-mail]">[e-mail]]
> > > > >> Sent:
> > > > Tuesday, April 06, 2010 11:52 AM
> > > > >> To: Dave Thaler; 'Hui Deng';
> > > > Gabriel Montenegro
> > > > >> Cc: > href="mailto:[e-mail]">[e-mail]
> > > > >> Subject: RE: [mif]
> > > > draft-ietf-mif-current-practices-00
> > > > >>
> > > > >>
> > > >
> > > > >>
> > > > >> > -----Original Message-----
> > > > >> >
> > > > From: Dave Thaler [mailto:>
> > > href="mailto:[e-mail]">[e-mail]]
> > > > >>
> > > > > Sent: Tuesday, April 06, 2010 10:06 AM
> > > > >> > To: Hui Deng;
> > > > Dan Wing; Gabriel Montenegro
> > > > >> > Cc: > ymailto="mailto:[e-mail]"
> > > > href="mailto:[e-mail]">[e-mail]
> > > > >> > Subject: RE:
> > > > [mif] draft-ietf-mif-current-practices-00
> > > > >> >
> > > > >>
> > > > > Hui is correct, Windows has per-interface DNS server lists
> > > > >>
> > > > configured.
> > > > >> >
> > > > >> > It then uses a host-wide
> > > > "effective" server list for an
> > > > actual query,
> > > > >> >
> > > > where the effective server list may be different for
> > > > different
> > > > names.
> > > > >> >
> > > > >> > On Windows the per-interface
> > > > suffix is actually termed the
> > > > >> > "connection-specific DNS
> > > > suffix" to distinguish it from the
> > > > >> > "primary DNS suffix" of
> > > > the machine.  I think that's why
> > > > >> > "interface-specific" was
> > > > repeated in the first bullet.
> > > > >>
> > > > >>
> > > >
> > > > >>
> > > > >> In draft-montenegro-mif-multihoming, there are two
> > > >
> > > > purposes and terms
> > > > >> that
> > > > >> seem to be
> > > > intermingled using the term "DNS suffix".
> > > > >>
> > > > >> One
> > > > purpose is the suffix for non-FQDN names, like
> > > > "payroll" or
> > > > "mail",
> > > > >> which will have a suffix added to them (e.g., > target="_blank"
> > > href="http://example.com">example.com).
> > > > >
> > > >
> > > > > That's what windows calls the "DNS Suffix Search List" (see the
> > > >
> > > > > sample output I sent previously below).  It's called the
> > > > >
> > > > "domain search list" in other places (like RFC 3397), or just
> > > > >
> > > > "search list" (RFC 1123).
> > > > >
> > > > >> The
> > > > >>
> > > > other purpose is deciding which DNS server will be be sent
> > > > a query
> > > > for
> > > > >> a certain FQDN (e.g., queries for *.>
> > > href="http://example.net">example.net go to one
> > > > DNS server
> > > >
> > > > >> and queries for *.example.com go to a different DNS server).
> > > >
> > > > >
> > > > > Another purpose is deciding which DNS server will receive a
> > > > dynamic
> > > > > update for a name with a certain suffix (e.g., Windows
> > > >
> > > > supports dynamic
> > > > > updates for the primary DNS name, and
> > > > optionally also the
> > > > connection-
> > > > > specific DNS name of the
> > > > machine).
> > > > >
> > > > >>
> > > > >>
> > > > >> In
> > > > draft-ietf-mif-current-practices-00, which is the WG document
> > > > >>
> > > > that seems to have boiled down draft-montenegro-mif-multihoming,
> > > >
> > > > >> but draft-ietf-mif-current-practices-00 also does not clearly
> > > >
> > > > >> separate the two purposes.
> > > > >
> > > > > Yep
> > > >
> > > > >
> > > > > -Dave
> > > > >>
> > > > >> -d
> > > >
> > > > >>
> > > > >>
> > > > >> > Example on Windows, extracted
> > > > from "ipconfig /all" output:
> > > > >> >
> > > > >> > Windows
> > > > IP Configuration
> > > > >> >
> > > > >> >    Host Name . . .
> > > > . . . . . . . . . : dthaler-win7
> > > > >> >    Primary Dns Suffix  .
> > > > . . . . . . : >
> > > href="http://ntdev.corp.microsoft.com">ntdev.corp.microsoft.com
> > > >
> > > > >> >
> > > >  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > > > >>
> > > > >    Node Type . . . . . . . . . . . . : Hybrid
> > > > >> >    IP
> > > > Routing Enabled. . . . . . . . : No
> > > > >> >    WINS Proxy Enabled.
> > > > . . . . . . . : No
> > > > >> >    DNS Suffix Search List. . . . . . :
> > > > ntdev.corp.microsoft.com
> > > > >> >
> > > >      >
> > > href="http://redmond.corp.microsoft.com">redmond.corp.microsoft.com
> > > >
> > > > >> >                                        >
> > > href="http://ntdev.microsoft.com">ntdev.microsoft.com
> > > > >> >
> > > >                                        >
> > > href="http://dns.corp.microsoft.com">dns.corp.microsoft.com
> > > > >>
> > > > >    System Quarantine State . . . . . : Not Restricted
> > > > >>
> > > > >
> > > > >> > Wireless LAN adapter Wireless Network
> > > > Connection:
> > > > >> >
> > > > >> >    Connection-specific
> > > > DNS Suffix  . : >
> > > href="http://hsd1.wa.comcast.net">hsd1.wa.comcast.net.
> > > > >> >
> > > >    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > > > >>
> > > > >    Description . . . . . . . . . . . : Intel(R) Wireless WiFi
> > > >
> > > > >> > Link 4965AGN
> > > > >> >    Physical Address. . . . . .
> > > > . . . : 00-1D-E0-34-4F-6F
> > > > >> >    DHCP Enabled. . . . . . . . .
> > > > . . : Yes
> > > > >> >    Autoconfiguration Enabled . . . . :
> > > > Yes
> > > > >> >    Link-local IPv6 Address . . . . . :
> > > >
> > > > >> > fe80::4853:4753:9d8d:3b45%13(Preferred)
> > > > >> >
> > > >  IPv4 Address. . . . . . . . . . . : 192.168.0.195(Preferred)
> > > > >>
> > > > >    Subnet Mask . . . . . . . . . . . : 255.255.255.0
> > > > >> >
> > > >    Lease Obtained. . . . . . . . . . : Monday, April 05, 2010
> > > > >>
> > > > > 10:19:02 PM
> > > > >> >    Lease Expires . . . . . . . . . . :
> > > > Tuesday, April 06,
> > > > >> > 2010 10:19:02 PM
> > > > >> >
> > > >    Default Gateway . . . . . . . . . : 192.168.0.1
> > > > >> >    DHCP
> > > > Server . . . . . . . . . . . : 192.168.0.1
> > > > >> >    DHCPv6 IAID
> > > > . . . . . . . . . . . : 335551968
> > > > >> >    DHCPv6 Client DUID. .
> > > > . . . . . . :
> > > > >> >
> > > > 00-01-00-01-12-0C-E2-7A-00-1E-37-CC-8D-DD
> > > > >> >
> > > > >>
> > > > >    DNS Servers . . . . . . . . . . . : 2001:df8:0:1::25
> > > > >>
> > > > >                                        192.168.0.1
> > > > >> >
> > > >  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > > > >> >
> > > >  NetBIOS over Tcpip. . . . . . . . : Enabled
> > > > >> >
> > > >
> > > > >> > -Dave
> > > > >> >
> > > > >> > >
> > > > -----Original Message-----
> > > > >> > > From: Hui Deng [mailto:> ymailto="mailto:[e-mail]"
> > > > href="mailto:[e-mail]">[e-mail]]
> > > > >> >
> > > > > Sent: Monday, April 05, 2010 7:40 PM
> > > > >> > > To: Dan
> > > > Wing; Gabriel Montenegro; Dave Thaler
> > > > >> > > Cc: > ymailto="mailto:[e-mail]"
> > > > href="mailto:[e-mail]">[e-mail]
> > > > >> > > Subject:
> > > > Re: [mif] draft-ietf-mif-current-practices-00
> > > > >> > >
> > > >
> > > > >> > > DNS server always has specific interface related
> > > > information,
> > > > >> > > but the final DNS server will still be
> > > > host based, I
> > > > wouldn't say
> > > > >> it
> > > > >> >
> > > > > is not correct.
> > > > >> > >
> > > > >> > > one
> > > > example would be you have internet connection and vpn
> > > > >>
> > > > connection
> > > > >> > > at the same time,
> > > > >> >
> > > > > good VPN implementation will always rely on VPN DNS server
> > > > >>
> > > > > information
> > > > >> > > for Internet connection.
> > > >
> > > > >> > >
> > > > >> > > -Hui
> > > > >> >
> > > > >
> > > > >> > > 2010/3/31 Dan Wing <> ymailto="mailto:[e-mail]"
> > > > href="mailto:[e-mail]">[e-mail]>:
> > > > >> >
> > > > > > Section 3.2.1.3 of describes the DNS configuration
> > > > of
> > > > Windows,
> > > > >> and
> > > > >> > > says:
> > > > >>
> > > > > > >
> > > > >> > > >  "Interface specific DNS
> > > > configuration can be input
> > > > via static
> > > > >> > > >
> > > > configuration or via DHCP.  It includes:
> > > > >> > > >
> > > >
> > > > >> > > >   o  An interface-specific suffix list.
> > > > >>
> > > > > > >
> > > > >> > > >   o  A list of DNS server IP
> > > > addresses."
> > > > >> > > >
> > > > >> > > > It
> > > > is curious that the first bullet repeats "interface
> > > > >> >
> > > > specific", but
> > > > >> > > the
> > > > >> > > >
> > > > second bullet does not repeat it.  A reasonable
> > > > interpretation
> > > > is
> > > > >> > > that the
> > > > >> > > > second
> > > > bullet is not interface-specific, but the
> > > > lead-in sentence
> > > >
> > > > >> > > says this is
> > > > >> > > >
> > > > interface-specific.  I was hoping
> > > > >> >
> > > > draft-montenegro-mif-multihoming-00
> > > > >> > > would
> > > >
> > > > >> > > > clarify, but it doesn't.
> > > > >> > >
> > > > >
> > > > >> > > > -d
> > > > >> > > >
> > > >
> > > > >> > > > _______________________________________________
> > > >
> > > > >> > > > mif mailing list
> > > > >> > > > > ymailto="mailto:[e-mail]"
> > > > href="mailto:[e-mail]">[e-mail]
> > > > >> > > > > href="https://www.ietf.org/mailman/listinfo/mif"
> > > target=_blank
> > > > >https://www.ietf.org/mailman/listinfo/mif
> > > > >> > >
> > > > >
> > > > >> >
> > > > >>
> > > > >
> > > >
> > > > >
> > >
> > > _______________________________________________
> > > mif mailing
> > > > list
> > > > href="mailto:[e-mail]">[e-mail]
> > > > href="https://www.ietf.org/mailman/listinfo/mif" target=_blank
> > > > >https://www.ietf.org/mailman/listinfo/mif
> > > _______________________________________________
> > > mif mailing list
> > > [e-mail]
> > > https://www.ietf.org/mailman/listinfo/mif