Re: [tsvwg] Status of ECN encapsulation drafts (i.e., stuck)

[Sebastian Moeller <[e-mail]>]

Hi Bob,


> On Mar 15, 2020, at 11:50, Bob Briscoe <[e-mail]> wrote:
> 
> Rod,
> 
> On 14/03/2020 22:18, Rodney W. Grimes wrote:
>> Bob,
>> 	Questions and comments in line.
>> 
>> 
>> 
>>> Finding the best max packet size is an area where neither IPv4 nor IPv6 
>>> has ever found a good solution. Getting a tunnel to fragment and 
>>> reassemble is indeed painfully sub-optimal, but all the other solutions 
>>> have their own problems. It is possible the sub-optimality is often 
>>> going on under-the-covers, just because it works. I do know that, for 
>>> IPv4, the Don't Fragment (DF) flag is often ignored by tunnels, as a 
>>> preferable alternative to just ditching the traffic.
>>> 
>>> 
>> 
>> What do you base your "know" on?
>> Can you please site an implementaiton?
>> 
> 
> Here's a selection of implementations that allow you to configure clearing the DF flag in order to allow fragmentation prior to encapsulation:
> 	• Cisco IOS: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dplane/configuration/15-mt/sec-ipsec-data-plane-15-mt-book/sec-df-bit-ovride.html
> 	• Juniper JunOS: https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/clear-dont-fragment-bit-edit-interfaces.html
> 	• Huawei: https://support.huawei.com/enterprise/en/doc/EDOC1100034238/a1bd518c/optional-configuring-the-df-flag-bit-for-gre-packets
> 	• Ericsson Redback: http://rbman.ito.expert/en_lzn7830011_1_r4a/3_19082-CRA1191170_1-V1Uen.G.html#CHAPTER1.59
> 	• Linux: iptables -t mangle -A PREROUTING -j DF --clear
> While searching, I also found clear-df by accident in a firewall manual (not even doing any tunnelling)

	[SM] Isn't that a gross violation of the end-to-end principle? Or is the interpretation of the DF flag here, do not deliver fragments to the end-points, but anything transparent is fair game?


> 
> And I even discovered "clear-df" in an (expired) individual Internet Draft from Ericsson for the Yang data model of an IPv4 tunnel: 
> draft-liu-intarea-ipipv4-tunnel-yang-02

	[SM] That might be use a "cover all bases" approach without actually endorsing any such use (let's try to model actual in-the-field-reality compared to RFC-reality).

> 
> Note, these are not to be confused with suppressing propagation of DF=1 from the arriving IP header to the outer (so that a downstream router within the tunnel is allowed to fragment). In Linux, that would be: iptables -t mangle -A POSTROUTING -j DF --clear
> 
> So yes, I know this is often done, but I don't know how often.

	[SM] Bigger question, should the IETF actually endorse something like that?

Best Regards
	Sebastian


> 
> 
> 
> Bob
> -- 
> ________________________________________________________________
> Bob Briscoe                               
> http://bobbriscoe.net/