Re: [renum] New Version Notification for draft-jiang-6renum-enterprise-01.txt

[Teco Boot <[e-mail]>]

Op 14 nov. 2011, om 03:16 heeft Brian E Carpenter het volgende geschreven:

>> I don't see ISPs relax the PA ingress filters. 
> 
> They will (and do) do it for large customers, just as they will
> (and do) announce backup routes for large customers. You just need to
> give them enough millions of currency units...

So a solution is needed for *poor* enterprises :-)

> I agree with you for smaller enterprise customers; the only question
> is how much of this belongs in the gap analysis for renumbering.
> See draft-ietf-v6ops-ipv6-multihoming-without-ipv6nat.

I read this doc as it is applicable for small networks, not for enterprises. I'm fine referring to another doc that describes the gap. Extend draft-ietf-v6ops-ipv6-multihoming-without-ipv6nat for (small or poor) enterprises having a multi-hop network running a routing protocol?

Teco

> 
> Regards
>   Brian
> 
> On 2011-11-14 14:41, Teco Boot wrote:
>>>> Page 11:
>>>>>>     - Border filtering
>>>>>>     In a multihomed site, an egress router to ISP A could normally
>>>>>>     filter packets with source addresses from other ISPs. The egress
>>>>>>     router connecting to ISP A should be notified if the egress router
>>>>>>     connecting to ISP B initiates a renumbering event in order to
>>>>>>     properly update its filter function.
>>>> I don't get this. Isn't ingress filtering recommended? Do ISP A and B coordinate? IMHO an ISP should block packets with other ISPs PA addresses.
>>>> So the network has to forward packets with ISP_A source addresses to ISP_A, not ISP_B. And forward packets with ISP_B source addresses to ISP_B, not ISP_A.
>>>> 
>>> I think the text you quote is confused; it is not the enterprise's egress
>>> routers that do the filtering, but the ISPs' ingress routers.
>>> 
>>> Then there's another discussion. A large enterprise running multiple PA prefixes
>>> would surely tell *all* its ISPs about those prefixes, and expect them to
>>> relax their ingress filters accordingly. A small enterprise probably couldn't
>>> do that, so needs two things:
>>> 
>>> 1. Address pair selection in the hosts that avoids this problem.
>>> 2. Egress router selection based on source address.
>>> 
>>> In any case the renumbering issue is how to inform all your ISPs of the
>>> new prefix to be allowed in their ingress filters, and the old prefix
>>> that is now to be blocked.
>> 
>> I don't see ISPs relax the PA ingress filters. I say routing shall better support multi-homing, it is needed for small enterprises (point 2 above). Large enterprises may have many PA prefixes, so needed there also.
>> 
>> RFC 3704 section 4.3 describes some options for directing packets to the correct ISP. It says "This is not a complicated procedure", but the approach looks clumsy to me. The problem should be tackled at the root, a fix in routing. Get this into gap-analysis document?
>> 
>> PS1: On solutions, not to mention BRDP-based routing: check draft-baker-fun-routing-class.
>> PS2: I understand it will take some time before this is fixed. But that is no excuse to postpone.
>> 
>> Teco.
>> 
>> 
>> 
>>