Re: [v6ops] PI [ULA draft revision #2 Regarding isolated networks]

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Gert Doering writes:
> Hi,
> 
> On Sat, May 31, 2014 at 11:11:42PM +0200, Philip Homburg wrote:
> > >Maybe you should step down from your "I have PI, I like it, everybody must
> > >have PI" soapbox and actually look at what, for example, homenet has 
> > >achieved in the last years.  This stuff looks complicated (and under the
> > >hood, it is), but the end user experience "take this box, plug in a number
> > >of ISPs, things work, no further configuration is needed(*)" is nothing yo
> u
> > >can match with a PI network.
> > 
> > I can see how you can do do multiple PA prefixes client side. Done that
> > for years now. Even with different routers providing the upstreams. No prob
> lem
> > there.
> > 
> > But I have nothing to update my DNS zones. How do I reflect which links 
> > are up or down? Is there even a draft for that? What's the BCP for TTL
> > values, DNSSEC, etc?
> 
> This is where things get interesting.  You, Owen, I are not "the 99% home
> users out there" - home users don't do DNS zones, because they do not 
> control a DNS server...  (they do mDNS because it's automatic and works
> fine for in-house purposes).   Where this falls apart, of course, is when
> you need to setup some sort of "call me" service, like remote help, 
> access your home disks from abroad, etc.
> 
> Some router vendors (AVM) have started to offer dyn-dns services that
> attach the current (dynamic) prefix to a statically known host-id and
> thus provide DNS to reach "home devices".  I'm not aware of specific 
> drafts that govern how IETF thinks this *should* be done, though.

The IETF has published exactly one method for updating the DNS (RFC 2136).
It has standardized several methods for securing that update.

RFC 2136: Dynamic Updates in the Domain Name System (DNS UPDATE)
RFC 2845: Secret Key Transaction Authentication for DNS (TSIG)
RFC 2931: DNS Request and Transaction Signatures ( SIG(0)s )
RFC 3645: Generic Security Service Algorithm for
         Secret Key Transaction Authentication for DNS (GSS-TSIG)

Now there are some other adhoc methods by various dynamic DNS
providers but UPDATE + TSIG and UPDATE + GSS-TSIG have been using
by enterprises for over a decade now depending upon whether you are
a Microsoft AD Enterprise (UPDATE + GSS-TSIG) or not (UPDATE + TSIG)
from the DHCP server.

UPDATE + TSIG work fine from a CPE device.
UPDATE + TSIG work fine from a node one you have configured shared TSIG
	keys.

TSIG is just username + password and when you present it as username
+ password it is understood by the average punter.

UPDATE + SIG(0) works fine from a node one the administrator has added
	the KEY record for the node to the zone usually using UPDATE + TSIG.
UPDATE + GSS-TSIG work fine for Microsoft AD sites where each node is
	add to the AD DOMAIN and gets a Kerberos key which it uses with
	UPDATE to update its own information.

All of these method work.  All of them can be in ACLs to restrict the updates
down to the RRset level.  Now if someone wants to write a BCP saying that
nodes should support UPDATE.  That nodes should add their addresses to the
DNS when they change I would be all for it.

Apple already do UPDATE + TSIG.
Microsoft already do UPDATE + GSS-TSIG.

Mark


> Gert Doering
>         -- NetMaster
> -- 
> have you enabled IPv6 on something today...?
> 
> SpaceNet AG                        Vorstand: Sebastian v. Bomhard
> Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
> D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
> Tel: [phone]           USt-IdNr.: DE813185279
> 
> _______________________________________________
> v6ops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/v6ops
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]