Re: [OPSEC] [v6ops] IPv6 LL-only as WG document - feedback requested

[Brian E Carpenter <[e-mail]>]

Carlos,

On 14/08/2012 22:08, Carlos Pignataro (cpignata) wrote:
> Michael, Brian,
> 
> Should "The Suggested Approach" http://tools.ietf.org/html/draft-behringer-lla-only-01#section-2.1 also include some prescriptiveness or specific recommendation regarding the use of RFC 5837, instead of including that solution to interface identification as a "Caveats and Possible Workarounds" only?

I have no strong opinion on this. Just indicating the existence of 5837
seems OK, though.

Looking at the current text, it says that the loopback GUA MUST be used for all
ICMPv6 messages, which is good, but it also says
"ICMP error message can also be sourced from the global scope loopback address."
That seems unnecessary in view of the MUST, but in any case, s/can/will/.

Actually my main comment on the draft is on this text in the Introduction:

"We propose to configure neither globally routable IPv6 addresses nor
 unique local addresses on infrastructure links of routers, wherever
 possible.  We recommend to use exclusively link-local addresses on
 such links."

I suggest a more neutral approach, since some operators clearly prefer
to use GUAs:

 It is possible to configure neither globally routable IPv6 addresses nor
 unique local addresses on infrastructure links of routers. This document
 describes how to use exclusively link-local addresses on such links.

(and s/proposes/describes how/ in the Abstract)

Thanks
    Brian

> Thanks,
> 
> -- Carlos.
> 
> On Aug 6, 2012, at 5:24 AM, Brian E Carpenter wrote:
> 
>> Hi,
>>
>>>   o  Management plane traffic, such as SSH, Telnet, SNMP, ICMP echo
>>>      request ... can be addressed to loopback addresses of routers with
>>>      a global scope address.  Router management can also be done over
>>>      out-of-band channels.
>>>
>>>   o  ICMP error message can also be sourced from the global scope
>>>      loopback address.
>> These statements seem too weak. Using GUAs for ICMP in particular
>> needs to have a normative MUST somewhere (preferably in a BCP). In the
>> context of this Informational draft, the language needs to state a requirement
>> ("must" not "can") even if you don't use RFC 2119 terminology.
>>
>> This matters because packets with a LL source address MUST NOT be forwarded,
>> so a router that is misconfigured to send ICMP replies with a LL source
>> address breaks both ping and traceroute.
>>
>> I think the rule is that any packet that is *not* sent to a LL address must
>> have a GUA as the source address. That takes care of ICMP, and everything else
>> as well.
>>
>> Furthermore, that GUA needs to be associated with a prefix that belongs to
>> the organisation operating the router in question. Otherwise the traceroute
>> results can be very confusing. We discussed that on v6ops back in March.
>>
>> Regards
>>   Brian Carpenter
>>
>>
>>
>>
>> On 06/08/2012 10:03, Gunter Van de Velde (gvandeve) wrote:
>>> (distributed to OPSEC WG and in cc v6ops)
>>>
>>> Dear all,
>>>
>>> During the OPSEC WG meeting last Wednesday there was consensus to adopt the draft http://tools.ietf.org/html/draft-behringer-lla-only-01 as working group document with Informational status.
>>>
>>> Please read the draft, and if there is no violent objection on the list, the document will be requested to be submitted as WG document in 7 days.
>>>
>>> Ciao,
>>> G/, KK & Warren
>>>
>>>
>>>
>>> ------------------------------------------------------------------------
>>>
>>> _______________________________________________
>>> v6ops mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/v6ops
>> _______________________________________________
>> v6ops mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/v6ops
>>
> 
>