Re: [v6ops] Fwd: New Version Notification for draft-wkumari-long-headers-01.txt

[Ray Hunter <[e-mail]>]

Gert Doering wrote:
> Hi,
>
> On Thu, Jul 04, 2013 at 05:36:06PM -0700, Joe Touch wrote:
>> So let's please be very clear about what _this_ draft is saying - it is 
>> NOT about making routers do something that routers *need* to do.
>
> If you can build a router for me that has a control plane which is 
> completely unreachable from the outside, that would be sufficient
> (but that would likely be a MPLS P router, who wouldn't need to look
> at *any* IPv6 bits).

Right.

> Today's routers *need* to be able to protect themselves, and that can
> only be done by L4-aware rate limiting and ACLs.

So could we specify different requirements and solutions for control
traffic which terminates on the router, compared to end user traffic
which only transits it?

If so, couldn't this requirement be implemented as "being able to filter
at wire speed any traffic headed for the control processor based on a
IPV6 source prefix", rather than having to filter on a full L4 header?

And then numbering end user LAN's from prefixes completely disjoint from
your control network ranges and BGP peer addresses?

If it's more than this I think it'd help to better specify the requirement.

> So please stop repeating this "a router doesn't need any of this" - while
> this is fairly nice for a theoretical router, it doesn't work out there,
> and *this* is what should be interesting.  Not "ivory tower beauty".
>
> Gert Doering
>         -- Operator