Re: [v6ops] Implementation Status of PREF64

[Owen DeLong <[e-mail]>]

> On Sep 27, 2021, at 18:11 , Lorenzo Colitti <lorenzo=[e-mail]> wrote:
> 
> On Tue, Sep 28, 2021 at 6:04 AM Owen DeLong <owen=[e-mail] <mailto:[e-mail]>> wrote:
> 
> In the tightest forms, it goes something like this (oversimplified and generic):
> 
> 0. Port starts out locked down to communicating with DHCPv6 server and NAC authenticator only.
> 1. Use LL address to send DHCPv6 request.
> 2. Get DHCPv6 address and use that for 802.1x authentication. There are a variety of options
> 	here including authentication of not only the machine, but also the individual currently
> 	using the machine and the classification of network privileges based on either or both
> 	of these factors, etc.
> 3. A filter is added to your port permitting your presented DHCPv6 address (which the NAC authenticator
> 	has validated matches to your MAC and LL address) that permits your LL and DHCPv6 addresses
> 	to communicate with the rest of the network. Any additional policies can also be added at this
> 	point if the administrator chooses.
> 
> I don't see how DHCPv6 is required for any of this. What you describe above boils down to, "a machine is allowed to use the network only if its MAC address is acceptable to the network". That can be done with SLAAC just as well. Let me reword for SLAAC:

No… That’s not what it amounts to.

It amounts to a machine can only use the network _IF_ it completes 802.1x Authentication _AND_ the IP address(es) it is using match the DHCP server’s expectation of the address it issued to the MAC address in question.


> 
> 0. Port starts out locked down to communicating with NAC authenticator only.
> 1. Use LL address to send RS.
> 2. Get IPv6 address from SLAAC and use that for 802.1x authentication. There are a variety of options
> 	here including authentication of not only the machine, but also the individual currently
> 	using the machine and the classification of network privileges based on either or both
> 	of these factors, etc.
> 3. A filter is added to your port permitting your presented MAC address to to communicate with the
> 	rest of the network. Any additional policies can also be added at this
> 	point if the administrator chooses.
> 
> This is better than the DHCP version above because it allows the client to use multiple IP addresses and does not need to be re-done when the IP address changes.

Sometimes the network administrator doesn’t want the host using multiple IP addresses for a variety of reasons.

Just because you think it is better in the environments where you operate doesn’t mean it’s better for everyone in every environment.

I repeat… Your anti-DHCP religion is NOT HELPING.

Owen