Subject: [OPSEC] I-D Action: draft-ietf-opsec-lla-only-00.txt

From: [email-masked]
Date: Fri, 17 Aug 2012 01:55:32 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF.

	Title           : Using Only Link-Local Addressing Inside an IPv6 Network
	Author(s)       : Michael Behringer
                          Eric Vyncke
	Filename        : draft-ietf-opsec-lla-only-00.txt
	Pages           : 7
	Date            : 2012-08-17

Abstract:
   This document proposes to use only IPv6 link-local addresses on
   infrastructure links between routers, wherever possible.  It
   discusses the advantages and disadvantages of this approach to aide
   the decision process for a given network,

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-opsec-lla-only

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-opsec-lla-only-00

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Fri, 17 Aug 2012 16:19:23 +0530

Hi,

It seems its common for duplicate MAC addresses to appear in the network. In that case more than one router would end up with having the same link local address. Will this not be an issue?

I was also wondering why the draft suggests using loose sequence of IPv6 prefixes to identify the complete path in RSVP-TE.

Cheers, Manav

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of [email-masked]
> Sent: Friday, August 17, 2012 2:26 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [OPSEC] I-D Action: draft-ietf-opsec-lla-only-00.txt
> 
> 
>  This draft is a work item of the Operational Security 
> Capabilities for IP Network Infrastructure Working Group of the IETF.
> 
> _______________________________________________
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec
>

---

From: Simon Eng <[email-masked]>
Date: Fri, 17 Aug 2012 19:15:56 +0800

Hi,

Minor point: there is a typo on page 3 (third bullet) "IICMP error ".

Under Section 2.2 (page 4), it was mentioned "Simpler DNS: Less address
space in use also means less DNS mappings to maintain."

Is it assumed that DNS will not be used for LLA on infrastructure links?
If an ISP networker is managing several routers, I don't think he/she will
be able to remember all the LLAs used on the routers right (especially IPv6
addresses with 128-bit)?  Perhaps, DNS will still be used??

Regards.

Simon

---

From: Gert Doering <[email-masked]>
Date: Fri, 17 Aug 2012 14:11:21 +0200

Hi,

On Fri, Aug 17, 2012 at 04:19:23PM +0530, Bhatia, Manav (Manav) wrote:
> It seems its common for duplicate MAC addresses to appear in the network. 

If that happens to you, you have way bigger problems.

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

---

From: "Michael Behringer (mbehring)" <[email-masked]>
Date: Fri, 17 Aug 2012 12:37:49 +0000

Simon, 

[...]
> Minor point: there is a typo on page 3 (third bullet) "IICMP error ".

Noted, thanks. 

> Under Section 2.2 (page 4), it was mentioned "Simpler DNS: Less 
> address space in use also means less DNS mappings to maintain."

> Is it assumed that DNS will not be used for LLA on infrastructure links? 

Yes. That's the point. We should point that out more clearly I guess. Someone else proposed a scheme where you could enter link local addresses for reverse resolution; I think it is fair to say that consensus was this is not a good idea. 

> If an ISP networker is managing several routers, I don't think he/she 
> will be able to remember all the LLAs used on the routers right
> (especially IPv6 addresses with 128-bit)?  Perhaps, DNS will still be used??

My feeling: No, it shouldn't. A link local address has its scope very clearly limited to the link. DNS is generally used with a global scope. In my mind, the two don't go together. While, using MAC addresses, you could generally assume LL addresses to be unique in a network (or even globally), there is no guarantee, and we'll run into trouble later if we allow DNS mappings for link local addresses. 

Somewhere, someone must have written this down explicitly? Can we refer to something here? 

Michael

[...]

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Fri, 17 Aug 2012 19:29:07 +0530

Oh, it happens all the time. Any proposal that relies on MACs being unique in the network lies on tenuous grounds.

You might want to look at this thread going on in the 6man mailing list.

http://www.ietf.org/mail-archive/web/ipv6/current/msg16222.html

Cheers, Manav 

> From: Gert Doering [mailto:[email-masked]] 
> Sent: Friday, August 17, 2012 5:41 PM
> To: Bhatia, Manav (Manav)
> Cc: [email-masked]
> Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-lla-only-00.txt
> 
> Hi,
>

---

From: Gert Doering <[email-masked]>
Date: Fri, 17 Aug 2012 16:11:28 +0200

Hi,

On Fri, Aug 17, 2012 at 07:29:07PM +0530, Bhatia, Manav (Manav) wrote:
> Oh, it happens all the time. 

Most certainly not.

> Any proposal that relies on MACs being unique in the network lies on tenuous grounds.
> 

As explained in the thread, that's different interfaces of the *same*
machine - and if you hook two of them to two switchports in the same
VLAN, you'll immediately have lots of weird effects, without any IPv6
in the mix.  So nobody sane does that (... without some sort of 
active/passive or bonding configuration).

Gert Doering
        -- NetMaster

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Fri, 17 Aug 2012 19:43:30 +0530

Hi,

I believe the thread also says that for various reasons different machines/ports in the network can end up with the same MAC. Its this point that I was alluding to.

Cheers, Manav

> Sent: Friday, August 17, 2012 7:41 PM
> Cc: Gert Doering; [email-masked]
> As explained in the thread, that's different interfaces of 
> the *same* machine - and if you hook two of them to two 
> switchports in the same VLAN, you'll immediately have lots of 
> weird effects, without any IPv6 in the mix.  So nobody sane 
> does that (... without some sort of active/passive or bonding 
> configuration).
> 
> Gert Doering
>         -- NetMaster
> --

---

From: Gert Doering <[email-masked]>
Date: Fri, 17 Aug 2012 16:17:14 +0200

Hi,

> I believe the thread also says that for various reasons different machines/ports in the network can end up with the same MAC. Its this point that I was alluding to.

That would always be a misconfiguration.

(Not that it does not happen, but it will cause massive breakage in other
parts, and thus needs fixing, so it makes no sense to accept "duplicate
MAC" as valid scenario here).

Gert Doering
        -- NetMaster

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Fri, 17 Aug 2012 19:52:50 +0530

It may not always be misconfiguration as suggested by this post.

http://www.ietf.org/mail-archive/web/ipv6/current/msg16245.html

Cheers, Manav 

> Sent: Friday, August 17, 2012 7:47 PM
> > I believe the thread also says that for various reasons 
> different machines/ports in the network can end up with the 
> same MAC. Its this point that I was alluding to.
> 
> (Not that it does not happen, but it will cause massive 
> breakage in other parts, and thus needs fixing, so it makes 
> no sense to accept "duplicate MAC" as valid scenario here).
> 
> Gert Doering
>         -- NetMaster
> --

---

From: Gert Doering <[email-masked]>
Date: Fri, 17 Aug 2012 16:28:57 +0200

Hi,

> http://www.ietf.org/mail-archive/web/ipv6/current/msg16245.html

If it's different Layer2 networks (which is "different BRAS boxes
in widely different locations") it won't do harm.

But the very same article that you quote clearly speaks about
"explicit manufacturing mistakes" and "software errors" - those might
not bei "misconfigurations by an human operator", but as far as the
network segment as a whole goes, it's still misconfiguration.

Better to bring them to the open by machines complaining about
duplicate addresses than to think up elaborate schemes to hide the
problems, only to have them show up less clearly in other places.

(We've had duplicate MACs in one of our networks just last month - 
misconfiguration of two ESX hosts.  Caused performance problems to
no end, and it was not obvious right away what caused the issue, 
as the ESX had no v6, and didn't notice the duplicate)

Gert Doering
        -- NetMaster

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Fri, 17 Aug 2012 15:00:14 +0000

Manav

First thanks for your interest in our I-D.

Regarding duplicate MAC, there is a vast difference between low-cost CPE and high-end routers used in the core.

Moreover, if on a specific really broadcast LAN (not broadband access) there are duplicate MAC addresses, then forget about getting any packet through ;-) The 'DAD' discussion on another mailing list was not related to pure Ethernet.

Moreoverover, as you known, OSPFv3 and other IGP uses LLA anyway, so, in case of duplicate LLA address, you will not get your IGP running correctly.

Last point, in most OS, you can override the default EUI-64 LLA by another one. I have seen deployments where all PE interfaces were fe80::1 and all CE interfaces were fe80::2 easy to remember and test ;-)

-éric

> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Bhatia, Manav (Manav)
> Sent: vendredi 17 août 2012 15:59
> To: Gert Doering
> Cc: [email-masked]
> Oh, it happens all the time. Any proposal that relies on MACs being
> unique in the network lies on tenuous grounds.
>

---

From: "Michael Behringer (mbehring)" <[email-masked]>
Date: Fri, 17 Aug 2012 16:15:07 +0000

Manav, 

[...]
> In that case more than one router would end up with having the same link
> local address. Will this not be an issue?

Duplicate MAC on a link would mess up a lot of things, as Gert also pointed out. Bottom line: That must not happen (independently of this draft). Across a network we don't care - it only has to be unique on a link.
 
> I was also wondering why the draft suggests using loose sequence of IPv6
> prefixes to identify the complete path in RSVP-TE.

Bad wording - sorry. We mean to say: "A possible workaround is to use routable (non-link local) addresses of each router to identify an explicit path, along with shared-risk-link-group (to not use a set of common interfaces)."

Is that clearer? 
Michael

[...]

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Fri, 17 Aug 2012 21:56:20 +0530

Hi Michael,

RSVP-TE will only use global IPv6 prefixes as OSPF/ISIS traffic engineering LSAs only advertise global v6 addresses. The link local IP addresses are NOT advertised and hence RSVP-TE can never use them.

You can look at rfc 5329 where we clearly say that only global v6 addresses must be used.

Cheers, Manav 

> From: Michael Behringer (mbehring) [mailto:[email-masked]] 
> Sent: Friday, August 17, 2012 9:45 PM
> To: Bhatia, Manav (Manav); [email-masked]
> Subject: RE: [OPSEC] I-D Action: draft-ietf-opsec-lla-only-00.txt
> 
> Manav, 
> 
> [...]
> > In that case more than one router would end up with having the same 
> > link local address. Will this not be an issue?
> 
> Duplicate MAC on a link would mess up a lot of things, as 
> Gert also pointed out. Bottom line: That must not happen 
> (independently of this draft). Across a network we don't care 
> - it only has to be unique on a link.
>  
> > I was also wondering why the draft suggests using loose sequence of 
> > IPv6 prefixes to identify the complete path in RSVP-TE.
> 
> Bad wording - sorry. We mean to say: "A possible workaround 
> is to use routable (non-link local) addresses of each router 
> to identify an explicit path, along with 
> shared-risk-link-group (to not use a set of common interfaces)."
> 
> Is that clearer? 
> Michael
> 
> [...]
> 
> 
>

---

From: "Michael Behringer (mbehring)" <[email-masked]>
Date: Fri, 17 Aug 2012 16:28:37 +0000

> From: Bhatia, Manav (Manav) [mailto:[email-masked]]
> Sent: 17 August 2012 18:26
> To: Michael Behringer (mbehring); [email-masked]
> RSVP-TE will only use global IPv6 prefixes as OSPF/ISIS traffic engineering
> LSAs only advertise global v6 addresses. The link local IP addresses are NOT
> advertised and hence RSVP-TE can never use them.
> 

Understood, we have clear that link local breaks the current model. My question is: Does it have to be a link address, or could it be a loopback? (And I don't know TE well enough, so this may well not work, looking for education). 

Michael
 
> > Duplicate MAC on a link would mess up a lot of things, as Gert also
> > pointed out. Bottom line: That must not happen (independently of this
> > draft). Across a network we don't care
> > Bad wording - sorry. We mean to say: "A possible workaround is to use
> > routable (non-link local) addresses of each router to identify an
> > explicit path, along with shared-risk-link-group (to not use a set of
> > common interfaces)."
> >
> > Is that clearer?
> > Michael
> >
> > [...]
> >
> >
> >

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Fri, 17 Aug 2012 22:00:20 +0530

It should be a link address as there are link attributes that CSPF uses when computing the RSVP path.

Cheers, Manav 

> Sent: Friday, August 17, 2012 9:59 PM
> > RSVP-TE will only use global IPv6 prefixes as OSPF/ISIS traffic 
> > engineering LSAs only advertise global v6 addresses. The 
> link local IP 
> > addresses are NOT advertised and hence RSVP-TE can never use them.
> > 
> Understood, we have clear that link local breaks the current 
> model. My question is: Does it have to be a link address, or 
> could it be a loopback? (And I don't know TE well enough, so 
> this may well not work, looking for education). 
> 
> Michael
>  
> > Cheers, Manav
> > 
> > > > In that case more than one router would end up with having the 
> > > > same link local address. Will this not be an issue?
> > >
> Gert also 
> > > pointed out. Bottom line: That must not happen (independently of 
> > > this draft). Across a network we don't care
> > > > I was also wondering why the draft suggests using loose 
> sequence 
> > > > of
> > > Bad wording - sorry. We mean to say: "A possible workaround is to 
> > > use routable (non-link local) addresses of each router to 
> identify 
> > > an explicit path, along with shared-risk-link-group (to not use a 
> > > set of common interfaces)."
> > >
> > > Is that clearer?
> > > Michael
> > >
> > > [...]
> > >
> > >
> > >
>

---

From: "Michael Behringer (mbehring)" <[email-masked]>
Date: Mon, 20 Aug 2012 08:30:49 +0000

If the requirement for RSVP-TE is definitely to have a ROUTABLE address ON THE LINK, then this looks like a reason not to use the approach described. 

I'll do some more digging to see whether there are workarounds, but if not, let's just be more explicit in that paragraph. 

Michael

> Sent: 17 August 2012 18:30
> > Understood, we have clear that link local breaks the current model. My
> > question is: Does it have to be a link address, or could it be a
> > loopback? (And I don't know TE well enough, so this may well not work,
> > looking for education).
> >
> > Michael
> >
> > > Cheers, Manav
> > >