Re: But are we talking IPv6 only? That's how I read the draft. (Re: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03)

[james woodyatt <[e-mail]>]

On Aug 27, 2008, at 17:12, Dan Wing wrote:
> [I wrote:]
>> On Aug 27, 2008, at 03:17, Mark Smith wrote:
>>> * Native IPv6 CPE security, plus IPv4 security/functionality
>>> requirements to support IPv6 transition via IPv4 tunnelling
>>
>> It was my understanding that this is the proper scope, not the
>> alternatives you mentioned.
>
> If the scope includes IPv6-over-IPv4 tunnels, then there are two
> network topologies:
>
>  1.  CPE gets a single IPv4 address and is an IPv4 NAPT, or
>  2.  the residential user gets one IPv4 address for each
>      device in their home that wants to do a IPv6-over-IPv4
>      tunnel.
>
> If (1), I don't see how unsolicited incoming packets can be
> directed to the correct host behind the IPv4 NAPT.
>
> If (2), we are outside the realm of simple residential networks --  
> they only
> have one IPv4 address.  We can't plan for more to become common as  
> we approach
> IPv4 exhaustion.
>
> Is there another network topology that I am missing?

Ah.   I see the confusion.  In the scope of the whole draft, we are  
talking about CPE that can include dual-stack transition mechanisms.   
In the specific scope of R23, the words "upper layer protocol" are  
intended to imply only IPv6 as the outer layer (which may itself be  
tunneled in an IPv4 transition mechanism, but the filtering  
recommendations in this draft are intended for use in applying filters  
inside the tunnel, not to the outside).

We are not trying to make recommendations about IPv4 simple security  
in this draft.  This could be made more clear.


--
james woodyatt <[e-mail]>
member of technical staff, communications engineering