[v6ops] Further feedback to the quesions of Erik Kline in v6ops session

[Chongfeng Xie <[e-mail]>]

Hi Eric Kline,

Thank you very much for your questions to EVN6 during v6ops meeting in Brisbane.  Due to time factor , I did not give a detailed feedback to you then. More responses are as follows tagged as [Chongfeng]:

Q1. There are SRv6 and BGP doing the same thing. The principle and advantage is just the lack of addition encapsulation?
[Chongfeng]: EVN6 exploits the inherent capabilities of IPv6 for ethernet virtual network, besides removing of additional encapsulation, several other advantages can be provided as below,
      
      -Service can be provisioned by PE as long as its access to lPv6 Internet is available. There is no constraint to it from the underlying network which exits in other approaches.

      -There is no specific requirement to the interworking interface of ISPs, so it can be easily implemented in multi-operator environment.

      - Instead of being statically, pre-configured in PE, the tunnel end point address is generated based on dynamic mapping from MAC address to IPv6 address, so the risk of DDOS attack can be reduced.

      -For different hosts within the same site have different outer IPv6 addresses, load balancing in IPv6 network can be implemented based on the source IPv6 addresses.

Q2: I am wondering how to defend traffic ejection, If I can guess MAC address and VEI, I can send traffic to send traffic to someone else's network?
 
[Chongfeng]: Illegal traffic ejection can be defended by egress checking the source prefix of the incoming packet. When an attacker guesses MAC address/VEI and send traffic to someone else’s network, the egress PE can check the packets in the traffic and will find that the source prefix (i.e. source mapping prefix of the IPv6 source address) does not belong to the VEN6 instance identified by the VEI value, the packets will be considered as abnormal and discarded. Other security means, such as source address verification, can also be used to further enhance defending capability.

Q3. VEI is the same to VXLAN? 
[Chongfeng]:  Logically, VEI in is same to the VNI ID of VXLAN, however, it has more bits and can identify more instances of virtual network than VNI of VXLAN.

I hope that the feedback above can clarify your concerns. If you have more questions, please feel free to raise them.

Best regards
Chongfeng