RE: But are we talking IPv6 only? That's how I read the draft. (Re:Somesuggestions for draft-ietf-v6ops-cpe-simple-security-03)

["Templin, Fred L" <[e-mail]>]

 

>-----Original Message-----
>From: Rémi Després [mailto:[e-mail]] 
>Sent: Friday, August 29, 2008 8:54 AM
>To: Templin, Fred L
>Cc: james woodyatt; IPv6 Operations
>Subject: Re: But are we talking IPv6 only? That's how I read 
>the draft. (Re:Somesuggestions for 
>draft-ietf-v6ops-cpe-simple-security-03)
>
>Templin, Fred L   (m/j/a) 8/29/08 5:03 PM:
>
>>> - ISATAP is a tool that assigns full /128 addresses to IPv6 
>hosts of 
>>> IPv4-only sites.
>>> - If my understanding of the subject is right, it is 
>therefore not a 
>>> tool to assign an IPv6 prefix to a router CPE behind which 
>>> several hosts 
>>> have teir individual IPv6 addresses. (A prefix shorter than 
>/128 would 
>>> be necesssary, typically /48 to /64).
>> 
>> Sorry, but that is too limited a view. ISATAP routers can
>> indeed be assigned prefixes via DHCPv6 IPv6 prefix delegation
>> (or manual config) and can function as IPv6 routers for
>> more-specific prefixes than just ::/0.
>> 
>> In other words, there are "traditional" ISATAP routers that
>> service default routes for forwarding to end systems outside
>> of the site and ISATAP routers that service more-specific
>> routes for forwarding to end systems within the site; even
>> if the end systems are deeply nested in "sites-within-sites".
>> 
>
>Quite interesting.
>
>Is there a document where "non traditional" ISATAP you are refering to
>is described?

"Traditional vs. non-traditional" is perhaps not such a great
terminology; better might be "explicitly-stated vs. implicitly-
permitted". But yes, there is a document that expands on what
is implicitly permitted by RFC5214.  

>It should be related to what I am currently working on, namely 
>a generic
>architecture for global address tunneling.
>- Its scope is IPv4 or IPv6 global addresses, via IPv6 or IPv4 
>realms in 
>which addressing may be global or local.
>- It will include 6to4, "traditional" ISATAP, 6rd,  and several new
>useful configurations.

ISATAP permits tying together disjoint private IPv4
addressing realms at the IPv6 level, where each disjoint
addressing realm can be thought of as a separate site. It
also allows for recursively-nested disjoint private IPv4
addressing realms tied together in an IPv6 prefix delegation
hierarchy.

So, each site has a disjoint IPv4 routing realm and IPv6
routing is used as an overlay that ties the sites together
when IPv6-in-IPv4 encapsulation via ISATAP tunneling is used.
An outward appearance of this from an IPv4 perspective may
be as recursively-nested NATs-within-NATs, so access to
global IPv4 services for nodes that are within deeply-nested
sites may be through multiple levels of NATs. If you find
that distasteful, you can always use something like dual
stack lite and have IPv4-in-IPv6-in-IPv4 - it may seem odd,
but I think you will find it works...

Fred
[e-mail] 
   

>
>The plan is to have a draft for IETF 73.
>
>
>
>Rémi
>
>
>