(ngtrans) Re: draft-ietf-ngtrans-isatap-scenario-00.txt

[Pekka Savola <[e-mail]>]

Hi,

A few comments.

First off, I think it should be appropriate to mention that IPR have been 
claimed wrt. to ISATAP.  The conditions are quite unclear, but perhaps 
sobering up..

Second, there are a few security considerations that may be relevant in
this Enterprise/Managed networks problem space.  For some organizations,
embedding a private address (if NAT is used) in IPv6 address may be
unacceptable.  Especially in Enterprise/Manged environments, there are
often security compartments also inside the organization, that is,
internal firewalls.  Basically with ISATAP, every firewall must be
configured to accept any ip-protocol-41 packet from any internal node to
any internal node.

And on one chapter of the draft:

4.2.  Enables incremental deployment of IPv6 hosts within IPv4 sites   
with no aggregation scaling issues at border gateways

   Additional hosts can be added with no need for manual configuration
   (though this is possible, if wanted). Such hosts will (when using the
   recommended mechanism) discover the set of ISATAP routers via a
   lookup of DNS resource record. These routers are polled (using ISATAP
   encapsulation) and auto-configuration can be performed, resulting in
   aggregation efficiency when many hosts configure addresses from pre- 
   fixes advertised by the routers.

==> I feel unconfortable with this 'no aggregation scaling issues' 
statement.  IMO Isatap is mostly useful for a) automatic the tunneling to 
to a border IPv6 router, and b) optimizing the direct tunneling between 
two ISATAP nodes in a site.

The only real way I see ISATAP addresses this scaling issue is by not
putting the internal traffic to this border router.

If RPL initialization returns more than one address, though, I guess an 
ISATAP node should round-robin (like with NDISC) between those that send 
router advertisements.  But really, I don't see how this makes the scaling 
issues go away; assuming manual configuration, the nodes could very well 
just be configured to use another router.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords