Re: [OPSEC] [v6ops] IPv6 LL-only as WG document - feedback requested

["Eric Vyncke (evyncke)" <[e-mail]>]

Brian

Thanks for your suggestion about wording. I think we agree on the content and your format is better :-)

-éric


> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of
> Brian E Carpenter
> Sent: mercredi 15 août 2012 09:50
> To: Carlos Pignataro (cpignata)
> Cc: '[e-mail]' (draft-behringer-lla-
> [e-mail]); [e-mail]; [e-mail]; v6ops v6ops WG
> ([e-mail])
> Subject: Re: [OPSEC] [v6ops] IPv6 LL-only as WG document - feedback
> requested
> 
> Carlos,
> 
> On 14/08/2012 22:08, Carlos Pignataro (cpignata) wrote:
> > Michael, Brian,
> >
> > Should "The Suggested Approach" http://tools.ietf.org/html/draft-
> behringer-lla-only-01#section-2.1 also include some prescriptiveness or
> specific recommendation regarding the use of RFC 5837, instead of including
> that solution to interface identification as a "Caveats and Possible
> Workarounds" only?
> 
> I have no strong opinion on this. Just indicating the existence of 5837
> seems OK, though.
> 
> Looking at the current text, it says that the loopback GUA MUST be used for
> all
> ICMPv6 messages, which is good, but it also says "ICMP error message can
> also be sourced from the global scope loopback address."
> That seems unnecessary in view of the MUST, but in any case, s/can/will/.
> 
> Actually my main comment on the draft is on this text in the Introduction:
> 
> "We propose to configure neither globally routable IPv6 addresses nor
> unique local addresses on infrastructure links of routers, wherever
> possible.  We recommend to use exclusively link-local addresses on  such
> links."
> 
> I suggest a more neutral approach, since some operators clearly prefer to
> use GUAs:
> 
>  It is possible to configure neither globally routable IPv6 addresses nor
> unique local addresses on infrastructure links of routers. This document
> describes how to use exclusively link-local addresses on such links.
> 
> (and s/proposes/describes how/ in the Abstract)
> 
> Thanks
>     Brian
> 
> > Thanks,
> >
> > -- Carlos.
> >
> > On Aug 6, 2012, at 5:24 AM, Brian E Carpenter wrote:
> >
> >> Hi,
> >>
> >>>   o  Management plane traffic, such as SSH, Telnet, SNMP, ICMP echo
> >>>      request ... can be addressed to loopback addresses of routers with
> >>>      a global scope address.  Router management can also be done over
> >>>      out-of-band channels.
> >>>
> >>>   o  ICMP error message can also be sourced from the global scope
> >>>      loopback address.
> >> These statements seem too weak. Using GUAs for ICMP in particular
> >> needs to have a normative MUST somewhere (preferably in a BCP). In
> >> the context of this Informational draft, the language needs to state
> >> a requirement ("must" not "can") even if you don't use RFC 2119
> terminology.
> >>
> >> This matters because packets with a LL source address MUST NOT be
> >> forwarded, so a router that is misconfigured to send ICMP replies
> >> with a LL source address breaks both ping and traceroute.
> >>
> >> I think the rule is that any packet that is *not* sent to a LL
> >> address must have a GUA as the source address. That takes care of
> >> ICMP, and everything else as well.
> >>
> >> Furthermore, that GUA needs to be associated with a prefix that
> >> belongs to the organisation operating the router in question.
> >> Otherwise the traceroute results can be very confusing. We discussed that
> on v6ops back in March.
> >>
> >> Regards
> >>   Brian Carpenter
> >>
> >>
> >>
> >>
> >> On 06/08/2012 10:03, Gunter Van de Velde (gvandeve) wrote:
> >>> (distributed to OPSEC WG and in cc v6ops)
> >>>
> >>> Dear all,
> >>>
> >>> During the OPSEC WG meeting last Wednesday there was consensus to adopt
> the draft http://tools.ietf.org/html/draft-behringer-lla-only-01 as working
> group document with Informational status.
> >>>
> >>> Please read the draft, and if there is no violent objection on the list,
> the document will be requested to be submitted as WG document in 7 days.
> >>>
> >>> Ciao,
> >>> G/, KK & Warren
> >>>
> >>>
> >>>
> >>> --------------------------------------------------------------------
> >>> ----
> >>>
> >>> _______________________________________________
> >>> v6ops mailing list
> >>> [e-mail]
> >>> https://www.ietf.org/mailman/listinfo/v6ops
> >> _______________________________________________
> >> v6ops mailing list
> >> [e-mail]
> >> https://www.ietf.org/mailman/listinfo/v6ops
> >>
> >
> >
> _______________________________________________
> OPSEC mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/opsec