Re: [renum] New Version Notification for draft-jiang-6renum-enterprise-01.txt

[Brian E Carpenter <[e-mail]>]

> I don't see ISPs relax the PA ingress filters. 

They will (and do) do it for large customers, just as they will
(and do) announce backup routes for large customers. You just need to
give them enough millions of currency units...

I agree with you for smaller enterprise customers; the only question
is how much of this belongs in the gap analysis for renumbering.
See draft-ietf-v6ops-ipv6-multihoming-without-ipv6nat.

Regards
   Brian

On 2011-11-14 14:41, Teco Boot wrote:
>>> Page 11:
>>>>>      - Border filtering
>>>>>      In a multihomed site, an egress router to ISP A could normally
>>>>>      filter packets with source addresses from other ISPs. The egress
>>>>>      router connecting to ISP A should be notified if the egress router
>>>>>      connecting to ISP B initiates a renumbering event in order to
>>>>>      properly update its filter function.
>>> I don't get this. Isn't ingress filtering recommended? Do ISP A and B coordinate? IMHO an ISP should block packets with other ISPs PA addresses.
>>> So the network has to forward packets with ISP_A source addresses to ISP_A, not ISP_B. And forward packets with ISP_B source addresses to ISP_B, not ISP_A.
>>>
>> I think the text you quote is confused; it is not the enterprise's egress
>> routers that do the filtering, but the ISPs' ingress routers.
>>
>> Then there's another discussion. A large enterprise running multiple PA prefixes
>> would surely tell *all* its ISPs about those prefixes, and expect them to
>> relax their ingress filters accordingly. A small enterprise probably couldn't
>> do that, so needs two things:
>>
>> 1. Address pair selection in the hosts that avoids this problem.
>> 2. Egress router selection based on source address.
>>
>> In any case the renumbering issue is how to inform all your ISPs of the
>> new prefix to be allowed in their ingress filters, and the old prefix
>> that is now to be blocked.
> 
> I don't see ISPs relax the PA ingress filters. I say routing shall better support multi-homing, it is needed for small enterprises (point 2 above). Large enterprises may have many PA prefixes, so needed there also.
> 
> RFC 3704 section 4.3 describes some options for directing packets to the correct ISP. It says "This is not a complicated procedure", but the approach looks clumsy to me. The problem should be tackled at the root, a fix in routing. Get this into gap-analysis document?
> 
> PS1: On solutions, not to mention BRDP-based routing: check draft-baker-fun-routing-class.
> PS2: I understand it will take some time before this is fixed. But that is no excuse to postpone.
> 
> Teco.
>  
> 
> 
>