
From nobody Tue Apr  1 02:23:39 2014
Return-Path: <leaf.yeh.sdo@gmail.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 059091A7D83 for <savi@ietfa.amsl.com>; Tue,  1 Apr 2014 02:23:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level: 
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6yhly5i0JEsB for <savi@ietfa.amsl.com>; Tue,  1 Apr 2014 02:23:33 -0700 (PDT)
Received: from mail-pd0-x22d.google.com (mail-pd0-x22d.google.com [IPv6:2607:f8b0:400e:c02::22d]) by ietfa.amsl.com (Postfix) with ESMTP id B50B21A7035 for <savi@ietf.org>; Tue,  1 Apr 2014 02:23:33 -0700 (PDT)
Received: by mail-pd0-f173.google.com with SMTP id z10so9257303pdj.18 for <savi@ietf.org>; Tue, 01 Apr 2014 02:23:30 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=from:to:cc:references:in-reply-to:subject:date:message-id :mime-version:content-type:thread-index:content-language; bh=kuYTh1ytA/cHRFO8zrduTZc4thYqcKwbIUInSclYtcU=; b=YRkNADiAAlT90V7OIpfGpXMfZ7cUA803AwL0LAgeo2VNL0/W+ECK5bFpKz5SMxHMB4 AltR8CcBNWnu4Z/GJ6C+L4/mUxDTHxfTNG9MJ7LukXcx8RiAjYna07sgt4btdjZLDqgp FZ5+iCwsuuX/ENFG/Xuso2s6SwArBPc9nikoc5fgCZrq3aroL+iBNp9um2J6VA2kcVqN 2eWnUwJnV9vdjKMR6eF0DIgdG3rZRjWdmeQivCK2p+xg89SDjd8c5E173WV+lfiE7wdZ JkmVNp661rXLBxFMadpTYgLzZUnzCIwQogtyc9/yjlRt5IgT+1ks3xxjTk7yxieWZTSC Zx5Q==
X-Received: by 10.68.194.202 with SMTP id hy10mr30185016pbc.94.1396344210369;  Tue, 01 Apr 2014 02:23:30 -0700 (PDT)
Received: from PC ([218.241.103.53]) by mx.google.com with ESMTPSA id ir10sm48661014pbc.59.2014.04.01.02.23.25 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 01 Apr 2014 02:23:29 -0700 (PDT)
From: "Leaf Yeh" <leaf.yeh.sdo@gmail.com>
To: "'Guang Yao'" <yaoguang@cernet.edu.cn>
References: <20140331054839.12951.1562.idtracker@ietfa.amsl.com> <533a1b73.0382440a.6009.ffffb32a@mx.google.com> <000501cf4d7b$e18af450$a4a0dcf0$@cernet.edu.cn>
In-Reply-To: <000501cf4d7b$e18af450$a4a0dcf0$@cernet.edu.cn>
Date: Tue, 1 Apr 2014 17:23:21 +0800
Message-ID: <533a8591.2ac5440a.0da6.1ee7@mx.google.com>
MIME-Version: 1.0
Content-Type: multipart/related; boundary="----=_NextPart_000_0065_01CF4DCF.180FC750"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AQH2W92cm8JJdKosbkMcCGTh4OHxCgI61sxxmpxn5CCAAANv0A==
Content-Language: zh-cn
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/g5iC1KpIulT2R3p4sNNylfq4ozc
Cc: savi@ietf.org, 'Ted Lemon' <ted.lemon@nominum.com>
Subject: Re: [savi] I-D Action: draft-ietf-savi-dhcp-21.txt
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Apr 2014 09:23:38 -0000

This is a multi-part message in MIME format.

------=_NextPart_000_0065_01CF4DCF.180FC750
Content-Type: multipart/alternative;
	boundary="----=_NextPart_001_0066_01CF4DCF.180FEE60"


------=_NextPart_001_0066_01CF4DCF.180FEE60
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Guang - R19: We found there is no direct link between SAVI devices, thus we
add a new link to illustrate this situation.

 

 

I guess we could live with the case of 'no direct link between SAVI
devices', just because the connection (i.e. Non-SAVI device) between them
are in the perimeter. 

 

 

Guang - R20: Since DHCP relay and server are only supposed to send DHCP
messages, data packets are not expected from them. If they also send data
packet, their roles are changed. How to process the data packet depends on
the the role which sends the data packet.

 

 

DHCP messages is only a kind of control plane packet. 

DHCP-Trust Attribute sounds only deactivate the blocking against the message
from server/relay.

 

If you let the data packet pass, then you will get a more flexible
application case as follows within the perimeter:



Right? I can't see the negative effect yet when you let the data packet pass
through the trust port of SAVI-switch.

 

 

Best Regards,

Leaf

 

 

 

-----Original Message-----
From: Guang Yao [mailto:yaoguang@cernet.edu.cn] 
Sent: Tuesday, April 01, 2014 3:28 PM
To: 'Leaf Yeh'
Cc: savi@ietf.org; 'Jun Bi'; 'Ted Lemon'
Subject: RE: [savi] I-D Action: draft-ietf-savi-dhcp-21.txt

 

Hi Leaf,

 

Thank you very much for these comments! The replies are as follows.

 

1. Q19. I am not sure the reason why there is a new link between SAVI Device
C to SAVI Device B in Fig.1. The relation between the SAVI Device A and the
SAVI Device B looks more like the case described in the Fig.1 of SAVI arch.

(RFC7039).

 

R19:

We found there is no direct link between SAVI devices, thus we add a new
link to illustrate this situation.

 

 

2. Q20. As to DHCP-Trust Attribute,

in section 4.2.2, <quote>

The "DHCP-Trust Attribute" indicates the DHCP Server-Client messages

   from the corresponding attachment is trustable.

...

</quote>

, in section 4.3.2 <quote>

   (5)  Configure DHCP-Trust attribute on the direct attachments of

        trusted DHCP relays/servers.

...

DHCP-Trust

  attribute is only configured on the inside links of the perimeter.

   Only DHCP server-client messages originated in the perimeter is

   trusted.

</quote>

 

 

When the port of SAVI-switch connected to the trusted DHCP relays/servers
(in the SAVI-perimeter) is configured DHCP-Trust attribute, how about the
data packet forwarding when it is received on this port? I guess the switch
will forward the packet as the normal without checking, right? May you need
a statement on this case in section 8.1?

 

R20:

Thank you for this comment. 

Since DHCP relay and server are only supposed to send DHCP messages, data
packets are not expected from them. If they also send data packet, their
roles are changed. How to process the data packet depends on the the role
which sends the data packet.

We will specify this point in the revision.

 

-----Original Message-----

From: Leaf Yeh [ <mailto:leaf.yeh.sdo@gmail.com>
mailto:leaf.yeh.sdo@gmail.com]

Sent: Tuesday, April 01, 2014 9:51 AM

To: 'Guang Yao'

Cc:  <mailto:savi@ietf.org> savi@ietf.org; 'Jun Bi'; 'Ted Lemon'

Subject: RE: [savi] I-D Action: draft-ietf-savi-dhcp-21.txt

 

Hi Guang,

 

Q19. I am not sure the reason why there is a new link between SAVI Device C
to SAVI Device B in Fig.1. The relation between the SAVI Device A and the
SAVI Device B looks more like the case described in the Fig.1 of SAVI arch.

(RFC7039).

 

 

Q20. As to DHCP-Trust Attribute,

in section 4.2.2, <quote>

The "DHCP-Trust Attribute" indicates the DHCP Server-Client messages

   from the corresponding attachment is trustable.

...

</quote>

, in section 4.3.2 <quote>

  (5)  Configure DHCP-Trust attribute on the direct attachments of

        trusted DHCP relays/servers.

...

DHCP-Trust

   attribute is only configured on the inside links of the perimeter.

   Only DHCP server-client messages originated in the perimeter is

   trusted.

</quote>

 

 

When the port of SAVI-switch connected to the trusted DHCP relays/servers
(in the SAVI-perimeter) is configured DHCP-Trust attribute, how about the
data packet forwarding when it is received on this port? I guess the switch
will forward the packet as the normal without checking, right? May you need
a statement on this case in section 8.1?

 

 

Best Regards,

Leaf

 

 

 

-----Original Message-----

From: savi [ <mailto:savi-bounces@ietf.org> mailto:savi-bounces@ietf.org] On
Behalf Of  <mailto:internet-drafts@ietf.org> internet-drafts@ietf.org

Sent: Monday, March 31, 2014 1:49 PM

To:  <mailto:i-d-announce@ietf.org> i-d-announce@ietf.org

Cc:  <mailto:savi@ietf.org> savi@ietf.org

Subject: [savi] I-D Action: draft-ietf-savi-dhcp-21.txt

 

 

A New Internet-Draft is available from the on-line Internet-Drafts
directories.

This draft is a work item of the Source Address Validation Improvements
Working Group of the IETF.

 

        Title           : SAVI Solution for DHCP

        Authors         : Jun Bi

                          Jianping Wu

                          Guang Yao

                          Fred Baker

         Filename        : draft-ietf-savi-dhcp-21.txt

         Pages           : 43

         Date            : 2014-03-30

 

Abstract:

   This document specifies the procedure for creating a binding between

   a DHCPv4/DHCPv6 assigned IP address and a binding anchor on a SAVI

   (Source Address Validation Improvements) device.  The bindings set up

   by this procedure can be used to filter out packets with forged

   source IP address in DHCP scenario.  This mechanism is proposed as a

   complement to ingress filtering to provide finer-grained source IP

   address validation.

 

 

The IETF datatracker status page for this draft is:

 <https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/>
https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/

 

There's also a htmlized version available at:

 <http://tools.ietf.org/html/draft-ietf-savi-dhcp-21>
http://tools.ietf.org/html/draft-ietf-savi-dhcp-21

 

A diff from the previous version is available at:

 <http://www.ietf.org/rfcdiff?url2=draft-ietf-savi-dhcp-21>
http://www.ietf.org/rfcdiff?url2=draft-ietf-savi-dhcp-21

 

 

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

 

Internet-Drafts are also available by anonymous FTP at:

 <ftp://ftp.ietf.org/internet-drafts/> ftp://ftp.ietf.org/internet-drafts/

 

_______________________________________________

savi mailing list

 <mailto:savi@ietf.org> savi@ietf.org

 <https://www.ietf.org/mailman/listinfo/savi>
https://www.ietf.org/mailman/listinfo/savi

 


------=_NextPart_001_0066_01CF4DCF.180FEE60
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 12 =
(filtered medium)"><!--[if !mso]><style>v\:* =
{behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	text-align:justify;
	text-justify:inter-ideograph;
	font-size:10.5pt;
	font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
	{mso-style-priority:99;
	mso-style-link:"\7EAF\6587\672C Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:10.5pt;
	font-family:"Calibri","sans-serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
	{mso-style-priority:99;
	mso-style-link:"\6279\6CE8\6846\6587\672C Char";
	margin:0cm;
	margin-bottom:.0001pt;
	text-align:justify;
	text-justify:inter-ideograph;
	font-size:9.0pt;
	font-family:"Calibri","sans-serif";}
span.Char
	{mso-style-name:"\7EAF\6587\672C Char";
	mso-style-priority:99;
	mso-style-link:\7EAF\6587\672C;
	font-family:"Calibri","sans-serif";}
span.Char0
	{mso-style-name:"\6279\6CE8\6846\6587\672C Char";
	mso-style-priority:99;
	mso-style-link:\6279\6CE8\6846\6587\672C;}
span.EmailStyle21
	{mso-style-type:personal-compose;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"3074" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DZH-CN link=3Dblue =
vlink=3Dpurple style=3D'text-justify-trim:punctuation'><div =
class=3DWordSection1><p class=3DMsoPlainText><span lang=3DEN-US>Guang - =
R19: We found there is no direct link between SAVI devices, thus we add =
a new link to illustrate this situation.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>I guess we could live with the =
case of 'no direct link between SAVI devices', just because the =
connection (i.e. Non-SAVI device) between them are in the perimeter. =
<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang - R20: Since DHCP relay and server are only supposed =
to send DHCP messages, data packets are not expected from them. If they =
also send data packet, their roles are changed. How to process the data =
packet depends on the the role which sends the data =
packet.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>DHCP messages is only a kind of control plane packet. =
<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>DHCP-Trust Attribute sounds only deactivate the blocking =
against the message from server/relay.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>If you let the data packet pass, =
then you will get a more flexible application case as follows within the =
perimeter:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><img width=3D403 height=3D218 id=3D"_x56fe__x7247__x0020_3" =
src=3D"cid:image001.png@01CF4DCF.0F8C3690"></span><span =
lang=3DEN-US><o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Right? I can&#8217;t see the negative effect yet when you =
let the data packet pass through the trust port of =
SAVI-switch.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Best Regards,<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Leaf<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>-----Original =
Message-----<br>From: Guang Yao [mailto:yaoguang@cernet.edu.cn] =
<br>Sent: Tuesday, April 01, 2014 3:28 PM<br>To: 'Leaf Yeh'<br>Cc: =
savi@ietf.org; 'Jun Bi'; 'Ted Lemon'<br>Subject: RE: [savi] I-D Action: =
draft-ietf-savi-dhcp-21.txt<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Hi Leaf,<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Thank you very much for these =
comments! The replies are as follows.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>1. Q19. I am not sure the reason =
why there is a new link between SAVI Device C to SAVI Device B in Fig.1. =
The relation between the SAVI Device A and the SAVI Device B looks more =
like the case described in the Fig.1 of SAVI =
arch.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>(RFC7039).<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>R19:<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>We found there is no direct link =
between SAVI devices, thus we add a new link to illustrate this =
situation.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>2. Q20. As to DHCP-Trust Attribute,<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>in section 4.2.2, =
&lt;quote&gt;<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>The &quot;DHCP-Trust Attribute&quot; indicates the DHCP =
Server-Client messages<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>&nbsp;&nbsp; from the =
corresponding attachment is trustable.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>...<o:p></o:p></span></p><p =
class=3DMsoPlainText><span =
lang=3DEN-US>&lt;/quote&gt;<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>, in section 4.3.2 =
&lt;quote&gt;<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp; (5)&nbsp; Configure DHCP-Trust attribute on =
the direct attachments of<o:p></o:p></span></p><p =
class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; trusted DHCP =
relays/servers.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>...<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>DHCP-Trust<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>&nbsp;&nbsp;attribute is only =
configured on the inside links of the perimeter.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>&nbsp;&nbsp; Only DHCP =
server-client messages originated in the perimeter =
is<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp; trusted.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span =
lang=3DEN-US>&lt;/quote&gt;<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>When the port of SAVI-switch =
connected to the trusted DHCP relays/servers (in the SAVI-perimeter) is =
configured DHCP-Trust attribute, how about the data packet forwarding =
when it is received on this port? I guess the switch will forward the =
packet as the normal without checking, right? May you need a statement =
on this case in section 8.1?<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>R20:<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Thank you for this comment. =
<o:p></o:p></span></p><p class=3DMsoPlainText><span lang=3DEN-US>Since =
DHCP relay and server are only supposed to send DHCP messages, data =
packets are not expected from them. If they also send data packet, their =
roles are changed. How to process the data packet depends on the the =
role which sends the data packet.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>We will specify this point in =
the revision.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>-----Original Message-----<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>From: Leaf Yeh [<a =
href=3D"mailto:leaf.yeh.sdo@gmail.com"><span =
style=3D'color:windowtext;text-decoration:none'>mailto:leaf.yeh.sdo@gmail=
.com</span></a>]<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Sent: Tuesday, April 01, 2014 9:51 =
AM<o:p></o:p></span></p><p class=3DMsoPlainText><span lang=3DEN-US>To: =
'Guang Yao'<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Cc: <a href=3D"mailto:savi@ietf.org"><span =
style=3D'color:windowtext;text-decoration:none'>savi@ietf.org</span></a>;=
 'Jun Bi'; 'Ted Lemon'<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Subject: RE: [savi] I-D Action: =
draft-ietf-savi-dhcp-21.txt<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Hi =
Guang,<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Q19. I am not sure the reason why there is a new link =
between SAVI Device C to SAVI Device B in Fig.1. The relation between =
the SAVI Device A and the SAVI Device B looks more like the case =
described in the Fig.1 of SAVI arch.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span =
lang=3DEN-US>(RFC7039).<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Q20. As to DHCP-Trust =
Attribute,<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>in section 4.2.2, &lt;quote&gt;<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>The &quot;DHCP-Trust =
Attribute&quot; indicates the DHCP Server-Client =
messages<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp; from the corresponding attachment is =
trustable.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>...<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&lt;/quote&gt;<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>, in section 4.3.2 =
&lt;quote&gt;<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp;(5)&nbsp; Configure DHCP-Trust attribute on the =
direct attachments of<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; trusted DHCP =
relays/servers.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>...<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>DHCP-Trust<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>&nbsp;&nbsp; attribute is only =
configured on the inside links of the perimeter.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>&nbsp;&nbsp; Only DHCP =
server-client messages originated in the perimeter =
is<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp; trusted.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span =
lang=3DEN-US>&lt;/quote&gt;<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>When the port of SAVI-switch =
connected to the trusted DHCP relays/servers (in the SAVI-perimeter) is =
configured DHCP-Trust attribute, how about the data packet forwarding =
when it is received on this port? I guess the switch will forward the =
packet as the normal without checking, right? May you need a statement =
on this case in section 8.1?<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Best =
Regards,<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Leaf<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>-----Original Message-----<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>From: savi [<a =
href=3D"mailto:savi-bounces@ietf.org"><span =
style=3D'color:windowtext;text-decoration:none'>mailto:savi-bounces@ietf.=
org</span></a>] On Behalf Of <a =
href=3D"mailto:internet-drafts@ietf.org"><span =
style=3D'color:windowtext;text-decoration:none'>internet-drafts@ietf.org<=
/span></a><o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Sent: Monday, March 31, 2014 1:49 =
PM<o:p></o:p></span></p><p class=3DMsoPlainText><span lang=3DEN-US>To: =
<a href=3D"mailto:i-d-announce@ietf.org"><span =
style=3D'color:windowtext;text-decoration:none'>i-d-announce@ietf.org</sp=
an></a><o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Cc: <a href=3D"mailto:savi@ietf.org"><span =
style=3D'color:windowtext;text-decoration:none'>savi@ietf.org</span></a><=
o:p></o:p></span></p><p class=3DMsoPlainText><span lang=3DEN-US>Subject: =
[savi] I-D Action: draft-ietf-savi-dhcp-21.txt<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>A New Internet-Draft is =
available from the on-line Internet-Drafts =
directories.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>This draft is a work item of the Source Address Validation =
Improvements Working Group of the IETF.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
Title&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : SAVI =
Solution for DHCP<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
Authors&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : Jun =
Bi<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp; Jianping Wu<o:p></o:p></span></p><p =
class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp; Guang Yao<o:p></o:p></span></p><p =
class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp; Fred Baker<o:p></o:p></span></p><p =
class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
Filename&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : =
draft-ietf-savi-dhcp-21.txt<o:p></o:p></span></p><p =
class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
Pages&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : =
43<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
Date&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : =
2014-03-30<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Abstract:<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>&nbsp;&nbsp; This document =
specifies the procedure for creating a binding =
between<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp; a DHCPv4/DHCPv6 assigned IP address and a =
binding anchor on a SAVI<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>&nbsp;&nbsp; (Source Address =
Validation Improvements) device.&nbsp; The bindings set =
up<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp; by this procedure can be used to filter out =
packets with forged<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp; source IP address in DHCP scenario.&nbsp; This =
mechanism is proposed as a<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>&nbsp;&nbsp; complement to =
ingress filtering to provide finer-grained source =
IP<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&nbsp;&nbsp; address validation.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>The IETF datatracker status page =
for this draft is:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><a =
href=3D"https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/"><span =
style=3D'color:windowtext;text-decoration:none'>https://datatracker.ietf.=
org/doc/draft-ietf-savi-dhcp/</span></a><o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>There's also a htmlized version =
available at:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><a =
href=3D"http://tools.ietf.org/html/draft-ietf-savi-dhcp-21"><span =
style=3D'color:windowtext;text-decoration:none'>http://tools.ietf.org/htm=
l/draft-ietf-savi-dhcp-21</span></a><o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>A diff from the previous version =
is available at:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><a =
href=3D"http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-savi-dhcp-21"><span=
 =
style=3D'color:windowtext;text-decoration:none'>http://www.ietf.org/rfcdi=
ff?url2=3Ddraft-ietf-savi-dhcp-21</span></a><o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Please note that it may take a =
couple of minutes from the time of submission until the htmlized version =
and diff are available at tools.ietf.org.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Internet-Drafts are also =
available by anonymous FTP at:<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><a =
href=3D"ftp://ftp.ietf.org/internet-drafts/"><span =
style=3D'color:windowtext;text-decoration:none'>ftp://ftp.ietf.org/intern=
et-drafts/</span></a><o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>_______________________________________________<o:p></o:p></=
span></p><p class=3DMsoPlainText><span lang=3DEN-US>savi mailing =
list<o:p></o:p></span></p><p class=3DMsoPlainText><span lang=3DEN-US><a =
href=3D"mailto:savi@ietf.org"><span =
style=3D'color:windowtext;text-decoration:none'>savi@ietf.org</span></a><=
o:p></o:p></span></p><p class=3DMsoPlainText><span lang=3DEN-US><a =
href=3D"https://www.ietf.org/mailman/listinfo/savi"><span =
style=3D'color:windowtext;text-decoration:none'>https://www.ietf.org/mail=
man/listinfo/savi</span></a><o:p></o:p></span></p><p =
class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p></div></body></html>
------=_NextPart_001_0066_01CF4DCF.180FEE60--

------=_NextPart_000_0065_01CF4DCF.180FC750
Content-Type: image/png;
	name="image001.png"
Content-Transfer-Encoding: base64
Content-ID: <image001.png@01CF4DCF.0F8C3690>

iVBORw0KGgoAAAANSUhEUgAAAZMAAADaCAIAAADsXjgmAAAAAXNSR0IArs4c6QAAESBJREFUeF7t
nbt62k4Th5XvWnCK/8MV4CuANKlo3UEJjbuU6dJAaXdpqdIErsC+Aj8pAvfCtzofOK2k0aDdvDS2
hDQz+87qp5FkjT8dj8eADwQgAAGnCPzPqWgJFgIQgEBIAOViHkAAAu4RQLncyxkRQwACKBdzAAIQ
cI8AyuVezogYAhBAuZgDEICAewRQLvdyRsQQgADKxRyAAATcI4ByuZezUsS7+eP64PgYugwfPl3S
vaNtlOuO8HENAQg0JIByNQTHbhCAwD0JmPcW+bhHYL8ancya2daMYzurro9W/2vrL/JxL9VEfJbA
J964vud5o71vcx/n7/PbYtDekp8W4ONnXnlv0dO8MiwI+E2A+1x+55fRQcBPAlwt+plXRgUBvwlQ
c/mdX0YHAT8JoFx+5pVRQcBvAiiX3/lldBDwkwDK5WdeGRUE/CaAcvmdX0YHAT8JoFx+5pVRQcBv
AiiX3/lldBDwkwDK5XZeD+tHutxcSSF83J7fl6NHuXzNLOOCgM8EUC6fs8vYIOArAZTL18wyLgj4
TADl8jm7jA0CvhJAuXzNLOOCgM8EUC6fs8vYIOArAZTL18wyLgj4TADl8jm7jA0CvhJAuXzNLOOC
gM8E6Inqc3YZGwR8JUDN5WtmGRcEfCaAcvmcXcYGAV8JoFy+ZpZxQcBnAiiXz9llbBDwlQDK5Wtm
GRcEfCaAcrmd3a76T+3mn4qfx7WjmLri4ygOj8JGuTxKpuBQxi/71Wi02h+jz3a4bNO/cP043wnG
hikIBAHKxSy4TWD8vAr+7LPt1o9ZPZZIkiltzKp4IS7XEqWLvli+v07SPXINi/eJP4WaLl5rdk+/
R/VuJ+gf3ALl+geTXnvI66fl8Os43s0oy2aa1GLHbTCJRGeweDM1WrzB+MUUabPEh/nieFyNZtu4
eDseXxIzwfopN7OfbjLxCnfYzt6XDw+baVTvBb8o2GpnzP8dUC7/c9x4hEY+4pLIaEyiOIf1Zrh9
WwwSm+OX7XCzPtT3YOy8Z+Y/PSzfg/c/RYEKL1TfFrEQZmJX3w17eEsA5fI2te0HltznCiugH8J1
z+DzcLRK67BKNdY+cCz4TwDl8j/HbUcY3q3/mMS3mwaL6cf3QpG1+/UxzSqwj79R9WVuUE1ey06T
b6J7YLGh8dd2d/3bDor9XSdQPu+x5BiB4hNAydCzG1VpZRTexYp/z25oRVM/v4OVrx+tVuF9ruzR
ZH7bq7C5sZTeGYuPodhS5jg5sHL7jYbXFZ9GwbCTIAF6Rbh96jH1zVPwM7/x5PZo5KOHjzzTfljk
arEfeSAKCECgDgFqrjq02BYCEOgHAWqufuSBKCAAgToEUK46tNgWAhDoBwGUqx95IAoIQKAOAZSr
Di22hQAE+kEA5epHHogCAhCoQwDlqkOrf9vSf+p6TuDTvzkrExHKJcMRKxCAgCYBlEuTNr4gAAEZ
AiiXDEesQAACmgRQLk3a+IIABGQIoFwyHLECAQhoEkC5NGnjCwIQkCGAcslwxAoEIKBJAOXSpI0v
CEBAhgDKJcMRKxCAgCYB+nNp0sYXBCAgQ4CaS4YjViAAAU0CKJcmbXxBAAIyBFAuGY5YgQAENAmg
XJq08QUBCMgQQLlkOGIFAhDQJIByadLGFwQgIEMA5ZLheDcru/nj+nA376eOiadHyfA5FJTL5+wy
Ngj4SgDl8jWzjAsCXhM48nGRwH41OpmWs60ZyXZWXR+t7nq9M/G4mGxiPkOAt38cPy+Z+0p/n98W
g74Mg3j6kgnP4+Bq0fMEMzwIeEkA5fIyrQwKAp4T4GrR8wQzPAh4SYCay8u0MigIeE4A5fI8wQwP
Al4SQLm8TCuDgoDnBFAuzxPM8CDgJQGUy8u0MigIeE4A5fI8wQwPAl4SQLm8TCuDgoDnBFAuzxOs
PLzD+rFfXXeUx487LQIolxZp/EAAAnIEUC45lliCAAS0CKBcWqTxAwEIyBFAueRYYgkCENAigHJp
kcYPBCAgRwDlkmOJJQhAQIsAyqVFGj8QgIAcAZRLjiWWIAABLQIolxZp/EAAAnIE6IkqxxJLEICA
FgFqLi3S+IEABOQIoFxyLLEEAQhoEUC5tEjjBwIQkCOAcsmxxBIEIKBFAOXSIo0fCEBAjgDKJccS
S0FAfy5mgQ4BlEuHM14gAAFJAiiXJE1sQQACOgRQLh3OeIEABCQJoFySNLEFAQjoEEC5dDjjBQIQ
kCSAcknSxBYEIKBDAOXS4YwXCEBAkgDKJUkTWxCAgA4BlEuHM14gAAFJAvTnkqSJLQhAQIcANZcO
Z7xAAAKSBFAuSZrYggAEdAigXDqc8QIBCEgSQLkkaWILAhDQIYBy6XDGCwQgIEkA5ZKkiS36czEH
dAigXDqc8QIBCEgSQLkkaWILAhDQIYBy6XDGCwQgIEkA5ZKkiS0IQECHAMqlwxkvEICAJAGUS5Im
tiAAAR0CKJcOZ7xAAAKSBFAuSZrYggAEdAigXDqc8QIBCEgSoD+XJE1sQQACOgSouXQ44wUCEJAk
gHJJ0sQWBCCgQwDl0uGMFwhAQJIAyiVJE1sQgIAOAZRLhzNeIAABSQIolyRNbEEAAjoETpRrN39c
H3R899qLKxz6FifxNJvWfePWbBTt97LmQM3VHjYWIAABbQIolzZx/EEAAgIEjvFnvxqdGJttzRfb
WXV9tNrX9Rc5JJz68qNv+XImnr4kkOMu1ZVIT+ofd0E1k9vZaLXvWXrvEY4rHPoWJ/E0m61949Zs
FO33subA1aJA3YoJCEBAmQDKpQwcdxCAgAABekUIQMQEBCCgTICaSxk47iAAAQECKJcARExAAALK
BFAuZeC4gwAEBAigXAIQMQEBCCgTQLmUgeMOAhAQIIByCUDEBAQgoEwA5VIGjjsIQECAQFW5DutH
+y4368dPyWc+N81xonB283Tdp2RNEBij6XY7s0m+GLoq7BBtNA83ufunFoc7RmsZZww5zmwRv2zk
PZwPlnxkOTSwZhtnnrz4iEqPlvQoCpeLv1eOSTMD1o/xPnmyIkP2R32D0dnvYsvBWKy8aWTefLR8
b7G4Zfha9miVm4q+K7+BFC4Vfa1G8Zvb+Zunln7bvxplY8Geg4217raxj9MkYJQxj3aTjaqf88Ge
jyyNutZqxGkOtuzQCQ+8ZMFYyI+owjaFTZL3mtPNioaO1sd93ZHV296eg8zV4vjleHxbZMp6+L0Z
fluMvw43v7MmhWZpmZdTu/lm+jy2l2K2lCAwnQaTcyVt4fSbfB2f2k0lnRXVtSph5oNEuixsjF/2
q4/vV1qBHtbfg+3xJTnUBos3IyTpUsn+l2nwZ2/hsTebNFcuQ2G6eUhmdnZhGA3MCNdXwyqSrmyk
4+fVx69k/u9+fUy/DHoD4Z8J5MvLNqjOc6NRm2naHWQbTKJUmuSas9/rq5n14efG4RHxYz7cZRoN
Pg/fU8l5naQnmsnr6L+HMJ79nyD+5dbn98Zyw1uGtL5vrlwmwkjBo5k93eR3tXbzZSRckXQV6qzB
YhqfHsx54GO6QLi0clz0M36ebp7iO5LR57DeDLdvWTLGL9vhJjuFz7bJ6dkcHjbBMh9sKHW3Telq
0cpNrnWb6U+3DslWypXBGSy+zd7/xAXV7tdrkAKZmF/TOitUum/h9WN8LWkFlo3ECQwWP6ebeV4K
izsIDTIfOsF6zujh70dSXp11+fBfULjuOdkk17r87KUWejtHjZXLPMAoPI4w/GZxnWUuBMt34rNL
RPNlWIQ9PKQlWbvI2bshASMrwXL5Hu+dFcKJsfA6vtG5l/nQMB3tdtv9WJoy4PL1i0n2cFk4UMPn
jv14et9u3Gbvps8WK12eoweDeUvW+Dlhtk3+2PD02UG1XXTpkWO9BxOCW9s/4xB02sCUZZzVTJjl
7NliuZFujD9bFy6mO199+NvT+WDJpwF52V1s4zzpemyTr2Kn9uzwKqzs0VN9Ww7HY7U/l3mo9BT8
dK50bC3gVQOucHAlTvEEWRp0hY8rcVpib7yZPYfGV4uNY2NHCEAAAm0J0BO1LUH2hwAE9AlQc+kz
xyMEINCWAMrVliD7QwAC+gRQLn3meIQABNoSQLnaEmR/CEBAnwDKpc8cjxCAQFsCTftzXeoT1DSe
8p9gN7VyZr9z/cIEzbtiypl8hUC76yDmSrouxlnpZlfudHB2rwxmTzpwXU+BfX+upjWX6QxQ6hMU
TNq9VGD6onTz569hw5XwT8JNv7DCu8S3Z/DOtErMWvTc3vxuW1jG6Uy+wr54D5tp9iZ/2yxY8rlb
/lLHlnGGbW3yDnrb0ps958cQd7Y5+dv7uw+4bQBNlavit9gnqHh6T88J2ami1AU1+vbKOSE/wTyu
816t5+zfEPIz/cLagnN7/x7nq9Lby23OHUdvOkflXbXqHhelq5H0JJ0YSc4X2VLH42hiXki5zKu7
aZ+g9VPe7inrfmOmY3yuCAsrsxDXa1EzwkvnBAN2krSHCrvopK8IB2ftXx/62X5hTWh5tE+f85U1
JDbFVzeVuCeJXD/l3QvqHxdfs6bEptFe8hp2VJuPVknHG7MUdlotNA3tEbimb1xHL+IW346OF89U
pcXWs8nvp61jT960rHZ/TjuBFd8ejTHeekW73Nn2xtbnqupol+qL4anfO62/GOflF4FdyVdhBNGL
4WnXw1qvOPubx+LISp0MqqJyq1v6uTftY8Z5X+hyR/ZaGWi2sf0b1417RVSVK3V5QXHiBoQxksoh
lH5VnqOX7FyzfxZWw14U6jlrlmkD0/bYLmPvbb7KHGqnu4rRnk/DBAjtZh1nfmwXO8xH8+BKKGcq
g8JJodTDPjpNx5Oq8s8ihIZ6zYy9ckldLWZ9gsIWXJfuqoadob6vTUfU1e0e9BU7WV+ha/bPlbJX
+4X1qPZVDqW3+Qr/J03WQGo3n7wOPyujccZddLMy/ccCNY+LsCFh2ojtYC46k3ZtydjHL9PNj13P
/1lEw6vFC32C0mqzmP1q1Vq+vLt0tRVXrbmdopXyFePl6z+LfmEX9d/6HKhwIrrmwjJOJ/KVjLMw
Jdr/gyJLPnfOYl7m3Aik0GgtP9ZSSueOi4vHV2FGjGaz8EgrHUilgk6Pjn3NRX8uZ06xBAoBPQLm
rzT+Pus/HqE/l16K8QQBnwgkfywxeX1fpg8cezk8+nP1Mi0EBQEIXCUgdYcezBCAAAT0CKBceqzx
BAEISBFAuaRIYgcCENAjgHLpscYTBCAgRQDlkiKJHQhAQI9A0/5cehHex5N9n6D7xJd6dSXOe1Fy
hY8rcXadR3sO1Fxd5wL7EICAPAGUS54pFiEAga4JoFxdE8Y+BCAgTwDlkmeKRQhAoGsCKFfXhLEP
AQjIE0C55JliEQIQ6JoAytU1YexDAALyBFAueaZYhAAEuiaAcnVNGPsQgIA8AfpzyTPFIgQg0DUB
aq6uCWMfAhCQJ4ByyTPFIgQg0DUBlKtrwtiHAATkCaBc8kyxCAEIdE0A5eqaMPYhAAF5AiiXPFMs
QqAuAfu+VHUt+7r9iXKZ/xC5Pvg62hrjcoWDK3HWQC+6KXxEcXZuzDpf1Fyd5wIHEICAOAGUSxwp
BiEAge4JHOPPfjU68TXbmi+2s+r6aLWv6y9ySDj15Qf5Cq7OQ1fymM4nE+9otS/MLo67JMGXjrig
+sV2VibYl0NVOw5XOLgSp3b+Un+O8DlRrnvxurdf63xxtdh9WYsHCEBAmgDKJU0UexCAQPcE6BXR
PWM8QOAWAfP3XE/Bz7fF4NaGfJ8QoOZiKkAAAu4RoOZyL2dEDAEIUHMxByAAAfcIoFzu5YyIIQAB
lIs5AAEIuEcA5XIvZ0QMAQigXMwBCEDAPQIol3s5I2IIQADlYg5AAALuEfg/yj9sPL+YhQ4AAAAA
SUVORK5CYII=

------=_NextPart_000_0065_01CF4DCF.180FC750--


From nobody Tue Apr  1 08:24:49 2014
Return-Path: <yaoguang@cernet.edu.cn>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E88371A0979 for <savi@ietfa.amsl.com>; Tue,  1 Apr 2014 00:22:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 1.39
X-Spam-Level: *
X-Spam-Status: No, score=1.39 tagged_above=-999 required=5 tests=[BAYES_50=0.8, J_CHICKENPOX_15=0.6, T_RP_MATCHES_RCVD=-0.01] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rsCDXjUFJEWv for <savi@ietfa.amsl.com>; Tue,  1 Apr 2014 00:22:43 -0700 (PDT)
Received: from cernet.edu.cn (mail.cernet.edu.cn [202.112.39.2]) by ietfa.amsl.com (Postfix) with ESMTP id AC2D61A6FFE for <savi@ietf.org>; Tue,  1 Apr 2014 00:22:42 -0700 (PDT)
Received: from AndrewYaoPC (unknown [166.111.132.217]) by centos (Coremail) with SMTP id AQAAf3DbL+c5aTpTTPEbAA--.2170S2; Tue, 01 Apr 2014 15:22:33 +0800 (CST)
From: "Guang Yao" <yaoguang@cernet.edu.cn>
To: "'Leaf Yeh'" <leaf.yeh.sdo@gmail.com>, "'Jun Bi'" <junbi@cernet.edu.cn>, "'Jun Bi'" <junbi@tsinghua.edu.cn>
References: <53345a28.e15f440a.76a1.430a@mx.google.com> <000c01cf4cc4$382c92e0$a885b8a0$@cernet.edu.cn> <5339adef.42e7420a.490c.ffff8eac@mx.google.com>
In-Reply-To: <5339adef.42e7420a.490c.ffff8eac@mx.google.com>
Date: Tue, 1 Apr 2014 15:22:34 +0800
Message-ID: <000401cf4d7b$272ed310$758c7930$@cernet.edu.cn>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AQHXgVSJEKldWHfW8Xp2lGM95er5lwHyrTPzAXgJkiKa0EaGAA==
Content-Language: zh-cn
X-CM-TRANSID: AQAAf3DbL+c5aTpTTPEbAA--.2170S2
X-Coremail-Antispam: 1UD129KBjvAXoWfWr4fZFW7Cw48urW7ZFW3Awb_yoW8KF47Wo Za9w4rA3Z7tr17Grs5GFykGFZ8WFWv9r1xAr18Gr15GFyvqa13Xw4UGayDWF9xJFW5KrZr X34rXas0gFnrtF93n29KB7ZKAUJUUUUU529EdanIXcx71UUUUU7v73VFW2AGmfu7bjvjm3 AaLaJ3UjIYCTnIWjp_UUU597AC8VAFwI0_Jr0_Gr1l1xkIjI8I6I8E6xAIw20EY4v20xva j40_Wr0E3s1l1IIY67AEw4v_Jr0_Jr4l8cAvFVAK0II2c7xJM28EF7xvwVC0I7IYx2IY67 AKxVW8JVW5JwA2z4x0Y4vE2Ix0cI8IcVCY1x0267AKxVW8JVWxJwA2z4x0Y4vEx4A2jsIE 14v26r4UJVWxJr1l84ACjcxK6I8E87Iv6xkF7I0E14v26F4UJVW0owAS0I0E0xvYzxvE52 x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC2z280aVAFwI0_Jr0_Gr1l Ox8S6xCaFVCjc4AY6r1j6r4UM4x0Y48IcxkI7VAKI48JM4x0Y48IcxkI7VAKI48G6xCjnV AKz4kxM4x0x7Aq67IIx4CEVc8vx2IErcIFxwCY02Avz4vE14v_GF4l42xK82IYc2Ij64vI r41lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17 CE14v26r126r1DMIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0 I7IYx2IY6xkF7I0E14v26r1j6r4UMIIF0xvE42xK8VAvwI8IcIk0rVWrZr1j6s0DMIIF0x vEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Jr0_GrUvcSsGvfC2Kfnx nUUI43ZEXa7VUjuOJ5UUUUU==
X-CM-SenderInfo: 51drw3xdqjquphuqv3oohg3hdfq/
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/cxxKHJ0lSzoKRTWqE9k2ZyvNRYs
X-Mailman-Approved-At: Tue, 01 Apr 2014 08:24:47 -0700
Cc: savi@ietf.org, 'Ted Lemon' <ted.lemon@nominum.com>
Subject: Re: [savi] Some findings in the darft-ietf-savi-dhcp-20
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Apr 2014 07:22:47 -0000

Dear Leaf,

Thank you very much for the quick review!

Our responses are as follows:

1. Leaf - As to Fig.1, question for clarification : It sounds to set up =
a filter (as the requirement of DHCP-Trust Attribute) inside the =
SAVI-perimeter. I guess if the Relay or Server B is directly connected =
to SAVI Device and outside the SAVI-perimeter, we still need to set up =
DHCP-Trust Attribute for the port of SAVI Device A and B, right? If yes, =
does it means the Fig.1 can let the Relay or Server B outside the =
SAVI-perimeter?
Guang - R2.2: ...Indeed, there is no problem if letting the Relay or =
Server B outside the perimeter. In fact, in the ealier versions, they =
are outside the perimeter. However, in recent versions, we decide to =
include them into the perimeter.=20

The above decision sounds you make that Relay is the for the connection =
with the upstream network.

Guang:
Thank you for this comment.
 Exactly. The strength of the binding based security is actually very =
weak. Especially, if the DHCP messages are untrustable, the bindings =
will be meaningless. Thus, We prefer the security mechanism enforced =
between DHCP relay and server, if we cannot completely trust traffic =
from upstream.


2. Guang - On one hand, it is used to distinguish the DHCP server =
A(which is outside the perimeter) and the DHCP server B/Relay. On the =
other hand, we think the perimeter should be used to separating the =
trusted area and the untrusted area. The Relay and Server B should be =
trusted, and they are actually the sources of trust.=20


But you still need DHCP-Trust Attribute for them. It seem DHCP-Trust =
Attribute make them to be trust. How about if we just trust the Relay =
and Server B in the SAVI-perimeter without the additional permission, =
because they are connected to the Trust Port, (which was introduced by =
RFC662.)

Guang:=20
Thank you for this comment.

Trust: both data packet and control packet are trusted;
DHCP-Trust: only control packet is trusted.

Actually it is proper to configure Trust on the port of Relay and server =
B, if we also trust the data packet from them. In the scenario, the =
relay and server B are supposed to only send control packets, thus I =
think it makes no difference whether DHCP-Trust or trust is used. (Maybe =
we should specify this point in the doc?)

However, I believe it is necessary to distinguish the two types of =
trusts.  I think the perimeter is only a deployment suggestion. In =
practice it is not always possible to enforce savi as the diagram.  For =
example, we may choose to configure DHCP-trust and validating on the =
same port, which is attached by a DHCP server and some hosts through a =
hub. In such cases, the DHCP server is actually outside the perimeter. =
The DHCP messages are not fully trustable but we have to make use of =
them for there are no other ways.=20

Besides, I think where to draw the perimeter is actually not a critical =
problem. It makes no difference whether placing the relay and server =
inside or outside the perimeter. The savi device works based on port =
configuration, without knowing the perimeter.


3. Guang - Besides, to confirm with other solutions, perimeter is the =
place to perform data packet filtering. Thus, only the attach points =
with validating attribute are on the perimeter.


It make me not quite sure you want to configure Validating attribute for =
the upstream network, which looks outside of the SAVI-perimeter in =
Fig.1.=20

Per the description in section 4 of RFC7039, <quote>The IP source =
addresses in packets passing the protection perimeter are validated by =
the ingress SAVI instance, but no further validation takes place as long =
as the packets remain within or leave the protection perimeter.</quote>, =
I suppose it is not necessary to let upstream network outside the =
SAVI-perimeter.

Guang:
Thank you for this comment.
It's my fault: the upstream port is also on the perimeter.
We choose not to fully trust the traffic from upstream network: both =
data packet and control packet. Thus, I think it is necessary to keep it =
outside the perimeter.=20
However, if the operator chooses to fully trust packet from upstream =
networks, he can use a Trust on the corresponding port. Then in concept =
the upstream network is inside the perimeter.


4. Leaf - What does =E2=80=9CSAVI device B is still protected from =
spoofing from client A=E2=80=9D exactly mean? How can SAVI device B =
protects from spoofing from client A? It sounds a little confused.
Guang - R3:...It means, "SAVI device B can avoid receiving spoofing =
traffic from client A.".


The above statement sounds SAVI device A can avoid receiving spoofing =
traffic from client A, then 'SAVI device B can avoid receiving spoofing =
traffic from client A' because of the SAVI perimeter. I doubt the =
necessary text of 'SAVI device B is still protected from spoofing from =
client A' here.

Guang:
Thank you for this comment.
We will revise this sentence.


5. Leaf -4. Question of clarification on the text in section 4.3.2, =
<quote>(6) Optional: configure filters on the upstream links to filter =
out spoofing of local addresses from other networks.</quote>...
Guang - R4:...We cannot prevent other networks from spoofing each other. =
Thus, we can just requre local addresses (addresses assigned to local =
network) will not be spoofed by the other networks.


Thanks for your explanation here, but that method sounds ingress =
filtering (or uRPF) to me. Meanwhile, the 'other network' in the =
definition of 'Upstream link' seems a little vague for me. I guess it is =
usually we don=E2=80=99t use SAVI-switch to connect to the upstream =
network, we use a gateway or router. So the (6) of SAVI-DHCP Perimeter =
Configuration Guideline seems unnecessary. I mean we don't usually use =
SAVI-switch to form the SAVI-perimeter against the upstream link or =
network.


Guang:
Thank you for this comment.
We do not require the savi switch to connect to upstream network. =
Actually, they are connected to the gateway or router. This =
configuration just specifies how to process the traffic from the gateway =
or router.


6. Leaf - 5. Question of clarification on the text in the last paragraph =
of section 4.3.2, <quote> In this way, the points of attachments with =
Validating attribute (and generally together with attachments of =
upstream devices) on SAVI devices can form a perimeter separating DHCP =
clients and trusted devices.</quote> The above sentence sounds SAVI =
devices always form perimeter for upstream devices. But in general =
thinking, we always trust devices in the upstream network...
Guang - R5:...We should not trust devices in the upstream network by =
default unless some other securty mechanisms are enforced. =20


Why not if the upstream network is in the SAVI-perimeter?

Guang:
Thank you for this comment.
For SAVI-DHCP, a critical problem is that the DHCP Server-Client =
messages should be trustable. However, there can be bogus DHCP servers =
in the upstream network. We should not make assumption that the upstream =
network is always trustable. Thus, they should not be in the perimeter.


7. Guang - R7.1: ...'A' and 'B' do not stand for any element in the =
diagram. They just denote some anchor of the clients.


How about replace A to be 'Port_1' in the instance of Fig.3?

Guang:
Thank you for this comment. This is an excellent advice. We will revise =
the doc accordingly.


8. Leaf - On the other hand, I guess the =E2=80=98Creation Time=E2=80=99 =
of the entry looks like a field in this table per the usage described in =
the section 9. For the reason of consistency, we also have the field of =
=E2=80=98Creation Time=E2=80=99 in the FCFS-SAVI DataBase (i.e. =
SAVI-SLAAC DB, section 3.1 of RFC6620).
Guang - R7.2:...It is a good suggestion. ... For the usage in section 9, =
the system time of the store operation is enough. There is no need to =
recording the "Creation Time" in binding set up. Besides, adding a new =
field in the table will introduce too many modifications...


Per the description in section 9, <quote> Binding entries MAY be saved =
into non-volatile storage whenever a new binding entry changes to BOUND =
state. ... The time when each binding entry is established is also =
saved.</quote>, I suppose 'Creation Time' could support this action.

Guang:
Thank you for this comment. Maybe can the  'Creation Time' field only =
present in the stored table rather than BST?


9. Leaf...though I don=E2=80=99t really like the prefix of =
=E2=80=98EVE_=E2=80=99 here. =E2=98=BA The prefix of =
=E2=80=98EVE_=E2=80=99 must stand for Event here, supposed it really =
means the additional valid check defined in section 6.3.2.
Guang - R8: ...We have changed =E2=80=98EVE_DHCP_SOLICIT_RC=E2=80=99 to =
=E2=80=98EVE_DHCP_OPTION_RC'. Yes, =E2=80=98EVE_=E2=80=99 stands for =
Event. We need some terms to denote events to be handled.


I guess the text in the draft will not cause any misunderstanding if you =
delete the prefix of 'EVE_'. Right?

Guang:
Thank you for this comment. "EVE_" means it is an event instead of a =
packet. For example, not all " DHCP_OPTION_RC'" will trigger an event.


10. Leaf - In Section 7.1, <quote> Data packets without matching binding =
entry may trigger this process to set up bindings.</quote> <quote>This =
process is not intended to set up a binding whenever a data packet =
without matched binding entry is received.</quote> Does the above 2 =
sentence sound a little conflict?
Guang - R10: ... "Data packets without matching binding entry _may_ =
trigger this process to set up bindings." We use a "may" to mean this is =
probable.


Can I say ' This process is intended to set up a binding whenever a data =
packet without matched binding entry is received.' ?


Guang:
Thank you for this comment. Strictly, it is not quite proper. Not all =
the mismatched packet will trigger the process.


11.=20
Leaf -13. In Section 7.5.3.2, about =E2=80=98IPv6 address=E2=80=99 on =
page 32, <quote> Send a Neighbor Solicitation message with the target =
address set to the IP address in the corresponding entry. The Neighbor =
Solicitation is only sent to the attachment which triggers the binding. =
If there is no response after DAD_TIMEOUT, send another Neighbor =
Solicitation.
</quote> Could this additional DAD process be added in Fig.13?
Guang - R12: ... But it is there:...


I am not quite sure it is a good decision to delete this DAD process =
after EVE_DATA_LEASEQUERY (in the state of RECOVERY). It looks not the =
same as that DAD after EVE_DATA_UNMATCH (in the state of DETECTION), if =
you keep the text in section 7.5.2, <quote>The messages MUST NOT be sent =
to the attachment from which the triggering packet is received.</quote>. =
The DAD process after EVE_DATA_LEASEQUERY looks that 'The Neighbor =
Solicitation is only sent to the attachment which triggers the binding.' =
I personally prefer to combine these 2 DAD process, which means to sent =
DAD_NS to all the ports of SAVI-switch.

Guang:
Thank you for this comment.
As I can understand, you mean sending DAD to the attachment which =
triggers the binding after receiving the DHCP leasequery-reply? What is =
the purpose of this step?
And I'm wondering how to combine the 2 DAD processes since they are =
performed at different stages?
May you please give a further explanation? Thank you very much!

Best regards,
Guang


-----Original Message-----
From: Guang Yao [mailto:yaoguang@cernet.edu.cn]
Sent: Monday, March 31, 2014 5:33 PM
To: 'Leaf Yeh'; 'Jun Bi'; 'Jun Bi'
Cc: 'Ted Lemon'; savi@ietf.org
Subject: RE: Some findings in the darft-ietf-savi-dhcp-20

Dear Leaf,

Thank you very much for your comments!

Your comments are very important and valuable. We have revised the doc =
accordingly and submitted a new version. The responses are both at the =
behind of this mail and in the attachment.

If you have any more comments, please let us know.

Best regards,
Guang

1. In the 1st paragraph of Page 11,
<quote>
For example, in Figure 1, the attachment from the Non-SAVI Device 1 to =
the SAVI Device B should be configured with no attribute.
</quote>

But in Fig.1, Non-SAVI Device 1 is not directly connected to SAVI Device =
B. I suppose the draft really means =E2=80=98SAVI Device C=E2=80=99 =
here.
***

R1:
Thank you very much!
We have made some modifications to the scenario diagram. It seems a part =
of the text is not updated accordingly. We have modified such sentences, =
including the following one.


2. In the last paragraph of page 11,
<quote>
In Figure 1, the attachment from the DHCP Relay to the SAVI Device B, =
and the attachment from the DHCP Server B to the SAVI Device B should be =
configured with this attribute.
</quote> (for DHCP-Trust Attribute)

But in Fig.1, DHCP Relay is not directly connected to SAVI Device B. I =
suppose the draft really means =E2=80=98SAVI Device A=E2=80=99 here.
***

R2.1:
Thanks. We have revised the sentence.

As to Fig.1, question for clarification : It sounds to set up a filter =
(as the requirement of DHCP-Trust Attribute) inside the SAVI-perimeter. =
I guess if the Relay or Server B is directly connected to SAVI Device =
and outside the SAVI-perimeter, we still need to set up DHCP-Trust =
Attribute for the port of SAVI Device A and B, right? If yes, does it =
means the Fig.1 can let the Relay or Server B outside the =
SAVI-perimeter?

R2.2:
Thank you for this comment.
Indeed, there is no problem if letting the Relay or Server B outside the =
perimeter. In fact, in the ealier versions, they are outside the =
perimeter.
However, in recent versions, we decide to include them into the =
perimeter. On one hand, it is used to distinguish the DHCP server =
A(which is outside the perimeter) and the DHCP server B/Relay. On the =
other hand, we think the perimeter should be used to separating the =
trusted area and the untrusted area. The Relay and Server B should be =
trusted, and they are actually the sources of trust.
Besides, to confirm with other solutions, perimeter is the place to =
perform data packet filtering. Thus, only the attach points with =
validating attribute are on the perimeter.

3. Question of clarification on the text in the 3rd paragraph of section =
4.3.1, <quote> In this case, SAVI device B doesn=E2=80=99t create a =
binding for client A. SAVI device A doesn=E2=80=99t create a binding for =
client B. But the SAVI device B is still protected from spoofing from =
client A and the SAVI device A is still protected from spoofing from =
client B.
</quote>

What does =E2=80=9CSAVI device B is still protected from spoofing from =
client A=E2=80=9D exactly mean? How can SAVI device B protects from =
spoofing from client A? It sounds a little confused.

R3:
Thank you for this comment.
It means, "SAVI device B can avoid receiving spoofing traffic from =
client A.".


4. Question of clarification on the text in section 4.3.2, <quote>
(6) Optional: configure filters on the upstream links to filter out =
spoofing of local addresses from other networks.
</quote>

Per the definition of =E2=80=98Upstream link=E2=80=99 and =
=E2=80=98Downstream link=E2=80=99 in section 3, upstream is for other =
network (with gateway router), downstream is for local network. I guess =
the text here might mean =E2=80=98filter out spoofing of source =
addresses from other networks.=E2=80=99

R4:
Thank you for this comment.
We cannot prevent other networks from spoofing each other. Thus, we can =
just requre local addresses (addresses assigned to local network) will =
not be spoofed by the other networks.


5. Question of clarification on the text in the last paragraph of =
section 4.3.2, <quote> In this way, the points of attachments with =
Validating attribute (and generally together with attachments of =
upstream devices) on SAVI devices can form a perimeter separating DHCP =
clients and trusted devices.
</quote>

The above sentence sounds SAVI devices always form perimeter for =
upstream devices. But in general thinking, we always trust devices in =
the upstream network. In Fig.1, we should not configure =
=E2=80=98DHCP-Trust attribute=E2=80=99 on the port of SAVI Device C for =
the Server A through Non-SAVI Device 1, which might means the Client A =
and Client B can=E2=80=99t get address assignment from Server A of the =
upstream network. Does the above sounds a little confused?

R5:
Thank you for this comment.
This problem is discussed in section4.3.3 P3.
We should not trust devices in the upstream network by default unless =
some other securty mechanisms are enforced.  Client A and Client B can =
get address assignment from Server A indirectly from the Relay.


6. Question of clarification on the text in the last paragraph of =
section 4.3.2, <quote> DHCP-Trust attribute is only configured on the =
inside links of the perimeter.
</quote>

The above sentence sounds, even in the SAVI-perimeter, we still need set =
up filter for some devices, including relay and server. It sounds we =
couldn=E2=80=99t trust the relay and server in the SAVI-perimeter; and =
after we configure the DHCP-Trust attribute on the port of the =
SAVI-device which connect the relay or server, we start to trust them. =
But in general thinking, we always trust devices in the perimeter, and =
we don=E2=80=99t need additional SAVI-device to connect some kind of =
device in the perimeter. Does the above sounds a little confused?

R6:=20
Thank you for this comment.
Maybe this comment has been responed by R2.2?

7. Question of clarification on table 3 of BST in section 5:
<quote>
+---------+----------+----------+-----------+-------+
| Anchor | Address | State | Lifetime |TID |
+---------+----------+----------+-----------+-------+
| A | IP_1 | BOUND | 65535 |TID_1 |
+---------+----------+----------+-----------+-------+
| A | IP_2 | BOUND | 10000 |TID_2 |
+---------+----------+----------+-----------+-------+
| B | IP_3 |INIT_BIND | 1 |TID_3 |
+---------+----------+----------+-----------+-------+
</quote> for Binding State Table

It is not quite sure about =E2=80=98A=E2=80=99 and =E2=80=98B=E2=80=99 =
in the column of Anchor stands for. Does =E2=80=98A=E2=80=99 stands for =
the Client A? It must not stand for SAVI-Device A. =E2=98=BA Per the =
definition of =E2=80=98Binding anchor=E2=80=99 in section 3, the anchor =
is the link-layer property of Clients. It sound usually be the port of =
SAVI-device which connect Client A, right?

R7.1:
Thank you for this comment.
'A' and 'B' do not stand for any element in the diagram. They just =
denote some anchor of the clients.


On the other hand, I guess the =E2=80=98Creation Time=E2=80=99 of the =
entry looks like a field in this table per the usage described in the =
section 9. For the reason of consistency, we also have the field of =
=E2=80=98Creation Time=E2=80=99 in the FCFS-SAVI DataBase (i.e. =
SAVI-SLAAC DB, section 3.1 of RFC6620).

R7.2:
Thank you for this comment.
It is a good suggestion. But I think "Creation Time" is not requried in =
binding set up and traffic filtering. For the usage in section 9, the =
system time of the store operation is enough. There is no need to =
recording the "Creation Time" in binding set up. Besides, adding a new =
field in the table will introduce too many modifications...


8. In section 6.3,
<quote>
EVE_DHCP_OPTION_RC: A DHCPv6 Solicitation message with Rapid Commit =
option is received.
</quote>

I guess  looks better than =E2=80=98EVE_DHCP_OPTION_RC, though I =
don=E2=80=99t really like the prefix of =E2=80=98EVE_=E2=80=99 here. =
=E2=98=BA The prefix of =E2=80=98EVE_=E2=80=99 must stand for Event =
here, supposed it really means the additional valid check defined in =
section 6.3.2.


R8:
Thank you for this comment.
We have changed =E2=80=98EVE_DHCP_SOLICIT_RC=E2=80=99 to =
=E2=80=98EVE_DHCP_OPTION_RC'. Yes, =E2=80=98EVE_=E2=80=99 stands for =
Event. We need some terms to denote events to be handled.


9. For Section 6.4.1, I think we could replace its title =E2=80=98From =
NO_BIND to Other States=E2=80=99 to be =E2=80=98From NO_BIND to =
INIT_BIND=E2=80=99.

R9:
Thank you for this comment.
Well, we find it is alright to make this modification.


10. In Section 6.4.3.2
<quote>
If the message is DHCPv6 Reply, the SAVI device checks each IA Address =
option in each IA option.
</quote>
<quote>
The related binding entry can be determined based on the address in the =
IAADDR option in the Leasequery-reply message.
</quote>

I personally like =E2=80=98IA Address option=E2=80=99 and =
=E2=80=98IAADDR option=E2=80=99 could written in the same.

R10:
Thank you for this comment.
We have changed them to 'IA Address option'.


11. In Section 7.1,
<quote>
Data packets
without matching binding entry may trigger this process to set up =
bindings.
</quote>
<quote>
This process is not intended to set up a binding whenever a data packet =
without matched binding entry is received.
</quote>

Does the above 2 sentence sound a little conflict?

R10:
Thank you for this comment.
"Data packets
without matching binding entry _may_ trigger this process to set up =
bindings."

We use  a "may" to mean this is probable.


12. For Section 7.5.1, I think we could replace its title =E2=80=98From =
NO_BIND to Other States=E2=80=99 to be =E2=80=98From NO_BIND to =
DETECTION=E2=80=99.

R12:
Thank you for this comment.
Well, we find it is alright to make this modification, too.:)


13. In Section 7.5.3.2, about =E2=80=98IPv6 address=E2=80=99 on page 32, =
<quote> Send a Neighbor Solicitation message with the target address set =
to the IP address in the corresponding entry. The Neighbor Solicitation =
is only sent to the attachment which triggers the binding. If there is =
no response after DAD_TIMEOUT, send another Neighbor Solicitation.
</quote>

Could this additional DAD process be added in Fig.13?

R12:
Thank you for this comment. But it is there:
                               +-------------+
                               |             |
                     /---------|   NO_BIND   |<--------\
                     |  ------>|             |         | TIMEOUT
                     |  |      +-------------+         |(2nd LQ_DELAY)
   EVE_DATA_UNMATCH  |  |                              |
                     |  |                              |
                     |  |                              |
  ***1st DAD_TIMEOUT |  |                              | 1st LQ_DELAY
         /------\    |  |                              |    /---------\
         |      |    |  | EVE_DATA_CONFLICT            |    |         |
         |      v    v  |                              |    v         |
         |    +-------------+        TIMEOUT         +------------+   |
         |    |             | ***(2nd DAD_TIMEOUT)   |            |   |
         \----|  DETECTION  ------------------------>|  RECOVERY  ----/
              |             |                        |            |
              +-------------+                        +------------+
                                      EVE_DATA_LEASEQUERY|
                          /----------\                   |
            EVE_DHCP_RENEW|          |                   |
           EVE_DHCP_REBIND|    +-----v-------+           |
                          |    |             |           |
                          \----|   BOUND     |<----------/
                               |             |
                               +-------------+



14. In Section 7.5.3.2, about =E2=80=98IPv6 address=E2=80=99 in page 32, =
<quote> If there is only one identical response, get the source hardware =
address from the response. Check if the =E2=80=99chaddr=E2=80=99 field =
(hardware address) of the LEASEQUERY-REPLY message matches the source =
hardware address.
If the two addresses do not match, the following actions will not be =
performed. If there is more than one response, if any of the source =
hardware addresses matches the =E2=80=99chaddr=E2=80=99 field (hardware =
address) of the LEASEQUERY-REPLY message, the following actions are to =
be performed.
</quote>

If the LEASEQUERY-REPLY message mentioned here is defined in RFC5007, I =
supposed we can=E2=80=99t find the =E2=80=99chaddr=E2=80=99 field in =
this message.
***

R14:
We are sorry this is a careless copy from IPv4 para. LEASEQUERY-REPLY =
provides no additional information about the link-layer address or =
physical address of the client. Thus we remove this para.

15. Section 7.6, just after Fig. 12
<quote>
LQ_DELAY: MAX_LEASEQUERY_DELAY
</quote>

This =E2=80=98LQ_DELAY=E2=80=99 looks not a note for Fig. 12, but a note =
for Fig. 13, right? If yes, should it be placed after Fig. 13?

R15:
Thank you for this comment.
It has been done.

16. Section 14.2,
<quote>
[savi-fcfs]
Nordmark, E., Bagnulo, M., and E. Levy-Abegnoli, "FCFSSAVI:
First-Come First-Serve Source-Address Validation for Locally Assigned =
Addresses", RFC 6620, May 2012.
</quote>

I prefer to replace [savi-fcfs] to be [RFC 6620].

R16:
Thank you for this comment.
It has been done.


17. Section 14.2,
<quote>
[savi-framework]
Wu, J., Bi, J., Bagnulo, M., Baker, F., and C. Vogt, Ed., "Source =
Address Validation Improvement Framework",
draft-ietf-savi-framework-06 (work in progress), </quote>

I prefer to replace [savi-framework] to be [RFC 7039]. It is not is in =
the status of =E2=80=98work in progress=E2=80=99 any more. =E2=98=BA

R17:
Thank you for this comment.
It is great!

18. I guess the darft-ietf-savi-dhcp-20 has not support DHCPv6-PD =
(RFC3633) for SAVI on the delegated prefix by now, right?

R18:
Thank you for this comment.
Actually, DHCPv6-PD is covered in the very early version of this draft. =
But it is moved to the section 7 of SAVI-Framework.







From nobody Tue Apr  1 08:25:07 2014
Return-Path: <yaoguang@cernet.edu.cn>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F099F1A6FF4 for <savi@ietfa.amsl.com>; Tue,  1 Apr 2014 00:28:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Level: 
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JZkP4LAaJfcZ for <savi@ietfa.amsl.com>; Tue,  1 Apr 2014 00:28:01 -0700 (PDT)
Received: from cernet.edu.cn (mail.cernet.edu.cn [202.112.39.2]) by ietfa.amsl.com (Postfix) with ESMTP id 664831A07CA for <savi@ietf.org>; Tue,  1 Apr 2014 00:28:00 -0700 (PDT)
Received: from AndrewYaoPC (unknown [166.111.132.217]) by centos (Coremail) with SMTP id AQAAf3C7FQRyajpThfEbAA--.2482S2; Tue, 01 Apr 2014 15:27:46 +0800 (CST)
From: "Guang Yao" <yaoguang@cernet.edu.cn>
To: "'Leaf Yeh'" <leaf.yeh.sdo@gmail.com>
References: <20140331054839.12951.1562.idtracker@ietfa.amsl.com> <533a1b73.0382440a.6009.ffffb32a@mx.google.com>
In-Reply-To: <533a1b73.0382440a.6009.ffffb32a@mx.google.com>
Date: Tue, 1 Apr 2014 15:27:47 +0800
Message-ID: <000501cf4d7b$e18af450$a4a0dcf0$@cernet.edu.cn>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AQH2W92cm8JJdKosbkMcCGTh4OHxCgI61sxxmpxn5CA=
Content-Language: zh-cn
X-CM-TRANSID: AQAAf3C7FQRyajpThfEbAA--.2482S2
X-Coremail-Antispam: 1UD129KBjvJXoWxur4furyxAw47Kw1ktw1UWrg_yoWrtw1Upa yftrW7Kw1Dt3WxG397u340vryku3y3XFW7AF15Gr17A398Cas5trWFy3y5A347Xr95G3WI qrZ0934Dt393X3DanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUyG14x267AKxVWUJVW8JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84ACjcxK6xIIjxv20xvE14 v26r4j6ryUM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4j6F4UM28EF7xvwVC2z280aVAF wI0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Cr1j6rxdM2AIxVAIcxkEcVAq07 x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj6xIIjxv20xvE14v26r1j6r18 McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr4 1lF7xvr2IYc2Ij64vIr40E4x8a64kEw24lF7I21c0EjII2zVCS5cI20VAGYxC7MxkIecxE wVAFwVW8CwCF04k20xvY0x0EwIxGrwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4 vE14v26r106r1rMI8E67AF67kF1VAFwI0_JF0_Jw1lIxkGc2Ij64vIr41lIxAIcVC0I7IY x2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Jr0_Gr1lIxAIcVCF04k26c xKx2IYs7xG6rWUJVWrZr1UMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIEc7Cj xVAFwI0_Jr0_GrUvcSsGvfC2KfnxnUUI43ZEXa7VUUiiSPUUUUU==
X-CM-SenderInfo: 51drw3xdqjquphuqv3oohg3hdfq/
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/BpDe_uSNJOCjfnt0AvuNDsYzgJs
X-Mailman-Approved-At: Tue, 01 Apr 2014 08:25:05 -0700
Cc: savi@ietf.org, 'Ted Lemon' <ted.lemon@nominum.com>
Subject: Re: [savi] I-D Action: draft-ietf-savi-dhcp-21.txt
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Apr 2014 07:28:04 -0000

Hi Leaf,

Thank you very much for these comments! The replies are as follows.

1. Q19. I am not sure the reason why there is a new link between SAVI Device
C to SAVI Device B in Fig.1. The relation between the SAVI Device A and the
SAVI Device B looks more like the case described in the Fig.1 of SAVI arch.
(RFC7039).

R19:
We found there is no direct link between SAVI devices, thus we add a new
link to illustrate this situation.


2. Q20. As to DHCP-Trust Attribute,
in section 4.2.2, <quote>
The "DHCP-Trust Attribute" indicates the DHCP Server-Client messages
   from the corresponding attachment is trustable.
...
</quote>
, in section 4.3.2 <quote>
   (5)  Configure DHCP-Trust attribute on the direct attachments of
        trusted DHCP relays/servers.
...
DHCP-Trust
   attribute is only configured on the inside links of the perimeter.
   Only DHCP server-client messages originated in the perimeter is
   trusted.
</quote>


When the port of SAVI-switch connected to the trusted DHCP relays/servers
(in the SAVI-perimeter) is configured DHCP-Trust attribute, how about the
data packet forwarding when it is received on this port? I guess the switch
will forward the packet as the normal without checking, right? May you need
a statement on this case in section 8.1?

R20:
Thank you for this comment. 
Since DHCP relay and server are only supposed to send DHCP messages, data
packets are not expected from them. If they also send data packet, their
roles are changed. How to process the data packet depends on the the role
which sends the data packet.
We will specify this point in the revision.

-----Original Message-----
From: Leaf Yeh [mailto:leaf.yeh.sdo@gmail.com] 
Sent: Tuesday, April 01, 2014 9:51 AM
To: 'Guang Yao'
Cc: savi@ietf.org; 'Jun Bi'; 'Ted Lemon'
Subject: RE: [savi] I-D Action: draft-ietf-savi-dhcp-21.txt

Hi Guang,

Q19. I am not sure the reason why there is a new link between SAVI Device C
to SAVI Device B in Fig.1. The relation between the SAVI Device A and the
SAVI Device B looks more like the case described in the Fig.1 of SAVI arch.
(RFC7039).


Q20. As to DHCP-Trust Attribute,
in section 4.2.2, <quote>
The "DHCP-Trust Attribute" indicates the DHCP Server-Client messages
   from the corresponding attachment is trustable.
...
</quote>
, in section 4.3.2 <quote>
   (5)  Configure DHCP-Trust attribute on the direct attachments of
        trusted DHCP relays/servers.
...
DHCP-Trust
   attribute is only configured on the inside links of the perimeter.
   Only DHCP server-client messages originated in the perimeter is
   trusted.
</quote>


When the port of SAVI-switch connected to the trusted DHCP relays/servers
(in the SAVI-perimeter) is configured DHCP-Trust attribute, how about the
data packet forwarding when it is received on this port? I guess the switch
will forward the packet as the normal without checking, right? May you need
a statement on this case in section 8.1?


Best Regards,
Leaf



-----Original Message-----
From: savi [mailto:savi-bounces@ietf.org] On Behalf Of
internet-drafts@ietf.org
Sent: Monday, March 31, 2014 1:49 PM
To: i-d-announce@ietf.org
Cc: savi@ietf.org
Subject: [savi] I-D Action: draft-ietf-savi-dhcp-21.txt


A New Internet-Draft is available from the on-line Internet-Drafts
directories.
 This draft is a work item of the Source Address Validation Improvements
Working Group of the IETF.

        Title           : SAVI Solution for DHCP
        Authors         : Jun Bi
                          Jianping Wu
                          Guang Yao
                          Fred Baker
	Filename        : draft-ietf-savi-dhcp-21.txt
	Pages           : 43
	Date            : 2014-03-30

Abstract:
   This document specifies the procedure for creating a binding between
   a DHCPv4/DHCPv6 assigned IP address and a binding anchor on a SAVI
   (Source Address Validation Improvements) device.  The bindings set up
   by this procedure can be used to filter out packets with forged
   source IP address in DHCP scenario.  This mechanism is proposed as a
   complement to ingress filtering to provide finer-grained source IP
   address validation.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-savi-dhcp-21

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-savi-dhcp-21


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
savi mailing list
savi@ietf.org
https://www.ietf.org/mailman/listinfo/savi



From nobody Wed Apr  2 02:14:43 2014
Return-Path: <leaf.yeh.sdo@gmail.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F9291A017A for <savi@ietfa.amsl.com>; Wed,  2 Apr 2014 02:14:40 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.002
X-Spam-Level: 
X-Spam-Status: No, score=0.002 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DC_PNG_UNO_LARGO=0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, J_CHICKENPOX_15=0.6, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mdVTgoBiPmCI for <savi@ietfa.amsl.com>; Wed,  2 Apr 2014 02:14:34 -0700 (PDT)
Received: from mail-pd0-x234.google.com (mail-pd0-x234.google.com [IPv6:2607:f8b0:400e:c02::234]) by ietfa.amsl.com (Postfix) with ESMTP id 18C961A017D for <savi@ietf.org>; Wed,  2 Apr 2014 02:14:32 -0700 (PDT)
Received: by mail-pd0-f180.google.com with SMTP id v10so10922091pde.11 for <savi@ietf.org>; Wed, 02 Apr 2014 02:14:28 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=from:to:cc:references:in-reply-to:subject:date:message-id :mime-version:content-type:thread-index:content-language; bh=8TUVMoVH4U4iDG7gjsdiEmnHmhGDZj6G1Vj15GQByOE=; b=N9FsflKVbBV/DQhsZEVQ6NbxITi0GAQ4RiIUo+7qqyPHuFMtuhI7+RUxYd1JnSjbcA ujtxFVMY5BXQX/d/quZPjy8xC8OvfzBe8CAB4Yh9AqIpsT7h5KNYRLsg5UPi8z548Xok b817JGed+KF9RihJYTL2cX64CDeaGvbYD0+5E1WbJmj7rdCY12gvhfdZ9xQIH0lrUm0c rxIuhEGvVBZ2w+E3qBd+nGso/OB1oXTbKCA7HGOV0gg2p3P9d76QJw02NODfUDC0wJf5 4CNYe3oR8xGtJ2IQ2G00/us1UJqAK6wAaYznFwlhFruqNQ7oBr56S/pTqAPZ2MiU0vvv hHFw==
X-Received: by 10.67.22.100 with SMTP id hr4mr19773003pad.112.1396430068316; Wed, 02 Apr 2014 02:14:28 -0700 (PDT)
Received: from PC ([218.241.103.217]) by mx.google.com with ESMTPSA id iq10sm3072072pbc.14.2014.04.02.02.14.22 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 02 Apr 2014 02:14:27 -0700 (PDT)
From: "Leaf Yeh" <leaf.yeh.sdo@gmail.com>
To: "'Guang Yao'" <yaoguang@cernet.edu.cn>, "'Jun Bi'" <junbi@cernet.edu.cn>,  "'Jun Bi'" <junbi@tsinghua.edu.cn>
References: <53345a28.e15f440a.76a1.430a@mx.google.com> <000c01cf4cc4$382c92e0$a885b8a0$@cernet.edu.cn> <5339adef.42e7420a.490c.ffff8eac@mx.google.com> <000401cf4d7b$272ed310$758c7930$@cernet.edu.cn>
In-Reply-To: <000401cf4d7b$272ed310$758c7930$@cernet.edu.cn>
Date: Wed, 2 Apr 2014 17:14:20 +0800
Message-ID: <533bd4f3.0ac5440a.6319.ffff85a6@mx.google.com>
MIME-Version: 1.0
Content-Type: multipart/related; boundary="----=_NextPart_000_0261_01CF4E96.FF66C5A0"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AQHXgVSJEKldWHfW8Xp2lGM95er5lwHyrTPzAXgJkiKa0EaGAIABi2CQ
Content-Language: zh-cn
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/QAEPvU0MyVZBJ5yWpE1bFtmW7sU
Cc: savi@ietf.org, 'Ted Lemon' <ted.lemon@nominum.com>
Subject: Re: [savi] Some findings in the darft-ietf-savi-dhcp-20
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Apr 2014 09:14:40 -0000

This is a multi-part message in MIME format.

------=_NextPart_000_0261_01CF4E96.FF66C5A0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_001_0262_01CF4E96.FF66C5A0"


------=_NextPart_001_0262_01CF4E96.FF66C5A0
Content-Type: text/plain;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable

1. Guang - R2.2: ...Indeed, there is no problem if letting the Relay or =
Server B outside the perimeter. ..., in recent versions, we decide to =
include them into the perimeter.

Leaf - The above decision sounds you make that Relay is the for the =
connection with the upstream network.

Guang - Exactly.=20

=20

=20

The basic questions here sounds : Do we need Server B/Relay work outside =
the perimeter? Per the draft-(ver.)21 of today, I guess the answer is =
'no'. J

=20

=20

2. Guang - Trust: both data packet and control packet are trusted;

DHCP-Trust: only control packet is trusted.

Actually it is proper to configure Trust on the port of Relay and server =
B, if we also trust the data packet from them. In the scenario, the =
relay and server B are supposed to only send control packets, thus I =
think it makes no difference whether DHCP-Trust or trust is used. (Maybe =
we should specify this point in the doc?)=20

However, I believe it is necessary to distinguish the two types of =
trusts. =20

=20

=20

For the thinking of additional modular for the switch, DHCP-Trust =
attribute is designed for anti-bogus DHCP server/Relay. It is only used =
for the access of DHCP server/Relay, just because the default (No =
attribute) is blocking the messages from the Server/Relay on all ports =
(including validating ports) on the SAVI-switch, right?

=20

Can we just use DHCP-Trust take care the DHCP (control) messages from =
the Server/Relay, and not care the data (plane) packet? I mean it might =
be enough for the defense against bogus DHCP server/Relay, right?

=20

=20

Guang - I think the perimeter is only a deployment suggestion. In =
practice it is not always possible to enforce savi as the diagram. =20

=20

=20

Then I suggested to make the Fig.1 in the draft more popular for the =
real practice (or networking deployment). In my mind, the basic =
application scenario looks like the following:

=20



=20

=20

Guang - For example, we may choose to configure DHCP-trust and =
validating on the same port, which is attached by a DHCP server and some =
hosts through a hub. In such cases, the DHCP server is actually outside =
the perimeter. The DHCP messages are not fully trustable but we have to =
make use of them for there are no other ways.

=20

=20

That sounds the DHCP server can be outside SAVI-perimeter and DHCP-Trust =
can be used on the perimeter with Validating port.

=20

=20

Guang - Besides, I think where to draw the perimeter is actually not a =
critical problem. It makes no difference whether placing the relay and =
server inside or outside the perimeter. The savi device works based on =
port configuration, without knowing the perimeter.

=20

=20

The concept of 'perimeter' is defined in section 4 of RFC7039 (SAVI =
arch.) and section 2.5 of RFC6620 (SAVI-SLAAC). It looks to me the =
Validating port of SAVI-Switch (for SLAAC) and the Validating attribute =
of the SAVI devices (for DHCP) forms the perimeter. In another word, the =
binding filters of SAVI form the perimeter, though draft-SAVI-DHCP adds =
more discussion 'On the Placement of DHCP Server/Relay' at section =
4.3.3.

=20

=20

3. Guang - Besides, to confirm with other solutions, perimeter is the =
place to perform data packet filtering. Thus, only the attach points =
with validating attribute are on the perimeter.

...

Guang - It's my fault: the upstream port is also on the perimeter.

We choose not to fully trust the traffic from upstream network: both =
data packet and control packet. Thus, I think it is necessary to keep it =
outside the perimeter.=20

However, if the operator chooses to fully trust packet from upstream =
networks, he can use a Trust on the corresponding port. Then in concept =
the upstream network is inside the perimeter.

=20

=20

That is really my concern:

a.  I don't think we really need SAVI switch (and its validating =
attributes) to form the perimeter against the upstream network in =
practice.

b .  If you don't trust the traffic from the upstream network, then the =
methods, such as ingress filtering or uRPF, other than SAVI might be =
employed.

c.  I guess we have not a clear definition for the upstream network. In =
my mind, the upstream network mention here sounds in the same =
administrative domain of the operator, which we could trust.

=20

=20

5. Leaf -4. Question of clarification on the text in section 4.3.2, =
<quote>(6) Optional: configure filters on the upstream links to filter =
out spoofing of local addresses from other networks.</quote>...

Guang - R4:...We cannot prevent other networks from spoofing each other. =
Thus, we can just requre local addresses (addresses assigned to local =
network) will not be spoofed by the other networks.

Leaf - Thanks for your explanation here, but that method sounds ingress =
filtering (or uRPF) to me. Meanwhile, the 'other network' in the =
definition of 'Upstream link' seems a little vague for me. I guess it is =
usually we don=E2=80=99t use SAVI-switch to connect to the upstream =
network, we use a gateway or router. So the (6) of SAVI-DHCP Perimeter =
Configuration Guideline seems unnecessary. I mean we don't usually use =
SAVI-switch to form the SAVI-perimeter against the upstream link or =
network.

Guang: ... We do not require the savi switch to connect to upstream =
network. Actually, they are connected to the gateway or router. This =
configuration just specifies how to process the traffic from the gateway =
or router.

=20

=20

The draft sounds only about SAVI-switch. The configuration guideline & =
state machines only work for switches (i.e. SAVI devices), right?=20

=20

=20

6. Guang: ...For SAVI-DHCP, a critical problem is that the DHCP =
Server-Client messages should be trustable. However, there can be bogus =
DHCP servers in the upstream network. We should not make assumption that =
the upstream network is always trustable. Thus, they should not be in =
the perimeter.

=20

=20

I suppose the SAVI protection perimeter is not suitable against the =
upstream network, for at least 2 reasons:

a.  we don't use SAVI device to connect the upstream network;

b.  we don't use Validating attribute for the upstream network;

=20

I guess your perimeter (SAVI-DHCP perimeter) here sounds not the same as =
SAVI protection perimeter defined in RFC7039 (SAVI arch.) and RFC6620 =
(SAVI-SLAAC). I can't find words in the above 2 RFCs on that we can't =
trust the data or even control packets from the upstream network, or the =
statement of ' We should not make assumption that the upstream network =
is always trustable '.

=20

If you doubt there is a bogus DHCP server in the upstream network, you =
might employ something like 'DHCP-trust attribute' configure on the =
router (or gateway) to block DHCP server-client messages from the =
upstream network, then you could only use the local trustable DHCP =
server between the SAVI-perimeter and the router, or use DHCP relay to =
connect the remote trustable DHCP server. But the date (plane) packet =
need pass through, from the upstream network, access network, SAVI =
perimeter to the end-user hosts (i.e. DHCP clients).

=20

But this sounds not a feature of SAVI-switch, and might be out-of-scope =
of the draft. I prefer 'DHCP-trust attribute' could only mention for the =
SAVI device in this draft.

=20

=20

8. Guang:'Creation Time' field only present in the stored table rather =
than BST?

=20

=20

I believe the solution in draft-SAVI-DHCP-21 can work, but the solution =
in RFC6620 sounds better. If one want to implement both SAVI-SLAAC & =
SAVI-DHCP, he might want the same binding table. Right?

=20

=20

9. Leaf- I guess the text in the draft will not cause any =
misunderstanding if you delete the prefix of 'EVE_'. Right?

Guang: Thank you for this comment. "EVE_" means it is an event instead =
of a packet. For example, not all " DHCP_OPTION_RC'" will trigger an =
event.

=20

For example, you can=E2=80=99t find =E2=80=98EVE_=E2=80=99 for those =
messages which act as the event to trigger the state-change described in =
RFC6620, you still can understand it.

=20

=20

10. Leaf - In Section 7.1, <quote> Data packets without matching binding =
entry may trigger this process to set up bindings.</quote>

<quote>This process is not intended to set up a binding whenever a data =
packet without matched binding entry is received.</quote>

Does the above 2 sentence sound a little conflict?

Guang - R10: ... "Data packets without matching binding entry _may_ =
trigger this process to set up bindings." We use a "may" to mean this is =
probable.

Leaf - Can I say ' This process is intended to set up a binding whenever =
a data packet without matched binding entry is received.' ?

Guang: =E2=80=A6 Strictly, it is not quite proper. Not all the =
mismatched packet will trigger the process.

=20

=20

Can I say =E2=80=98This process may not intended to set up a binding =
whenever a data packet without matched binding entry is =
received.=E2=80=99 or =E2=80=98This process may intended to set up a =
binding whenever a data packet without matched binding entry is =
received.=E2=80=99? I am just not sure about the wording in =
=E2=80=98This process is not intended to set up a binding whenever a =
data packet without matched binding entry is received.=E2=80=99. Anyway, =
it makes me a little confused. In my mind, the process does intend to do =
something.

=20

=20

11. Leaf - =E2=80=A6if you keep the text in section 7.5.2, <quote>The =
messages MUST NOT be sent to the attachment from which the triggering =
packet is received.</quote>. The DAD process after EVE_DATA_LEASEQUERY =
looks that 'The Neighbor Solicitation is only sent to the attachment =
which triggers the binding.' I personally prefer to combine these 2 DAD =
process, which means to sent DAD_NS to all the ports of SAVI-switch.

Guang: =E2=80=A6As I can understand, you mean sending DAD to the =
attachment which triggers the binding after receiving the DHCP =
leasequery-reply? What is the purpose of this step? And I'm wondering =
how to combine the 2 DAD processes since they are performed at different =
stages? May you please give a further explanation?

=20

=20

Draft-(ver.)20 has the 2nd DAD process after EVE_DATA_LEASEQUERY (in the =
state of RECOVERY). Draft-(ver.)21 also have the 2nd ARP process for =
IPv4 address in same section 7.5.3.2.=20

=20

I guess the purpose of this process is double-check that one client (or =
host) assigned the address (specified in the Lease-query) with the valid =
lease is actively attached on the port which received a data without =
matched binding entry.=20

=20

I suppose the target address in the 2nd DAD process is the same as that =
in the 1st DAD process, which is the source address of the data packet =
received in the EVE_DATA_UNMATCH, right? If yes, that make possible to =
combine these 2 processes.

=20

=20

Best Regards,

Leaf

=20

=20

=20

-----Original Message-----
From: Guang Yao [mailto:yaoguang@cernet.edu.cn]=20
Sent: Tuesday, April 01, 2014 3:23 PM
To: 'Leaf Yeh'; 'Jun Bi'; 'Jun Bi'
Cc: 'Ted Lemon'; savi@ietf.org
Subject: RE: Some findings in the darft-ietf-savi-dhcp-20

=20

Dear Leaf,

=20

Thank you very much for the quick review!

=20

Our responses are as follows:

=20

1. Leaf - As to Fig.1, question for clarification : It sounds to set up =
a filter (as the requirement of DHCP-Trust Attribute) inside the =
SAVI-perimeter. I guess if the Relay or Server B is directly connected =
to SAVI Device and outside the SAVI-perimeter, we still need to set up =
DHCP-Trust Attribute for the port of SAVI Device A and B, right? If yes, =
does it means the Fig.1 can let the Relay or Server B outside the =
SAVI-perimeter?

Guang - R2.2: ...Indeed, there is no problem if letting the Relay or =
Server B outside the perimeter. In fact, in the ealier versions, they =
are outside the perimeter. However, in recent versions, we decide to =
include them into the perimeter.=20

=20

The above decision sounds you make that Relay is the for the connection =
with the upstream network.

=20

Guang:

Thank you for this comment.

Exactly. The strength of the binding based security is actually very =
weak. Especially, if the DHCP messages are untrustable, the bindings =
will be meaningless. Thus, We prefer the security mechanism enforced =
between DHCP relay and server, if we cannot completely trust traffic =
from upstream.

=20

=20

2. Guang - On one hand, it is used to distinguish the DHCP server =
A(which is outside the perimeter) and the DHCP server B/Relay. On the =
other hand, we think the perimeter should be used to separating the =
trusted area and the untrusted area. The Relay and Server B should be =
trusted, and they are actually the sources of trust.=20

=20

=20

But you still need DHCP-Trust Attribute for them. It seem DHCP-Trust =
Attribute make them to be trust. How about if we just trust the Relay =
and Server B in the SAVI-perimeter without the additional permission, =
because they are connected to the Trust Port, (which was introduced by =
RFC662.)

=20

Guang:=20

Thank you for this comment.

=20

Trust: both data packet and control packet are trusted;

DHCP-Trust: only control packet is trusted.

=20

Actually it is proper to configure Trust on the port of Relay and server =
B, if we also trust the data packet from them. In the scenario, the =
relay and server B are supposed to only send control packets, thus I =
think it makes no difference whether DHCP-Trust or trust is used. (Maybe =
we should specify this point in the doc?)

=20

However, I believe it is necessary to distinguish the two types of =
trusts.  I think the perimeter is only a deployment suggestion. In =
practice it is not always possible to enforce savi as the diagram.  For =
example, we may choose to configure DHCP-trust and validating on the =
same port, which is attached by a DHCP server and some hosts through a =
hub. In such cases, the DHCP server is actually outside the perimeter. =
The DHCP messages are not fully trustable but we have to make use of =
them for there are no other ways.=20

=20

Besides, I think where to draw the perimeter is actually not a critical =
problem. It makes no difference whether placing the relay and server =
inside or outside the perimeter. The savi device works based on port =
configuration, without knowing the perimeter.

=20

=20

3. Guang - Besides, to confirm with other solutions, perimeter is the =
place to perform data packet filtering. Thus, only the attach points =
with validating attribute are on the perimeter.

=20

=20

It make me not quite sure you want to configure Validating attribute for =
the upstream network, which looks outside of the SAVI-perimeter in =
Fig.1.=20

=20

Per the description in section 4 of RFC7039, <quote>The IP source =
addresses in packets passing the protection perimeter are validated by =
the ingress SAVI instance, but no further validation takes place as long =
as the packets remain within or leave the protection perimeter.</quote>, =
I suppose it is not necessary to let upstream network outside the =
SAVI-perimeter.

=20

Guang:

Thank you for this comment.

It's my fault: the upstream port is also on the perimeter.

We choose not to fully trust the traffic from upstream network: both =
data packet and control packet. Thus, I think it is necessary to keep it =
outside the perimeter.=20

However, if the operator chooses to fully trust packet from upstream =
networks, he can use a Trust on the corresponding port. Then in concept =
the upstream network is inside the perimeter.

=20

=20

4. Leaf - What does =E2=80=9CSAVI device B is still protected from =
spoofing from client A=E2=80=9D exactly mean? How can SAVI device B =
protects from spoofing from client A? It sounds a little confused.

Guang - R3:...It means, "SAVI device B can avoid receiving spoofing =
traffic from client A.".

=20

=20

The above statement sounds SAVI device A can avoid receiving spoofing =
traffic from client A, then 'SAVI device B can avoid receiving spoofing =
traffic from client A' because of the SAVI perimeter. I doubt the =
necessary text of 'SAVI device B is still protected from spoofing from =
client A' here.

=20

Guang:

Thank you for this comment.

We will revise this sentence.

=20

=20

5. Leaf -4. Question of clarification on the text in section 4.3.2, =
<quote>(6) Optional: configure filters on the upstream links to filter =
out spoofing of local addresses from other networks.</quote>...

Guang - R4:...We cannot prevent other networks from spoofing each other. =
Thus, we can just requre local addresses (addresses assigned to local =
network) will not be spoofed by the other networks.

=20

=20

Thanks for your explanation here, but that method sounds ingress =
filtering (or uRPF) to me. Meanwhile, the 'other network' in the =
definition of 'Upstream link' seems a little vague for me. I guess it is =
usually we don=E2=80=99t use SAVI-switch to connect to the upstream =
network, we use a gateway or router. So the (6) of SAVI-DHCP Perimeter =
Configuration Guideline seems unnecessary. I mean we don't usually use =
SAVI-switch to form the SAVI-perimeter against the upstream link or =
network.

=20

=20

Guang:

Thank you for this comment.

We do not require the savi switch to connect to upstream network. =
Actually, they are connected to the gateway or router. This =
configuration just specifies how to process the traffic from the gateway =
or router.

=20

=20

6. Leaf - 5. Question of clarification on the text in the last paragraph =
of section 4.3.2, <quote> In this way, the points of attachments with =
Validating attribute (and generally together with attachments of =
upstream devices) on SAVI devices can form a perimeter separating DHCP =
clients and trusted devices.</quote> The above sentence sounds SAVI =
devices always form perimeter for upstream devices. But in general =
thinking, we always trust devices in the upstream network...

Guang - R5:...We should not trust devices in the upstream network by =
default unless some other securty mechanisms are enforced. =20

=20

=20

Why not if the upstream network is in the SAVI-perimeter?

=20

Guang:

Thank you for this comment.

For SAVI-DHCP, a critical problem is that the DHCP Server-Client =
messages should be trustable. However, there can be bogus DHCP servers =
in the upstream network. We should not make assumption that the upstream =
network is always trustable. Thus, they should not be in the perimeter.

=20

=20

7. Guang - R7.1: ...'A' and 'B' do not stand for any element in the =
diagram. They just denote some anchor of the clients.

=20

=20

How about replace A to be 'Port_1' in the instance of Fig.3?

=20

Guang:

Thank you for this comment. This is an excellent advice. We will revise =
the doc accordingly.

=20

=20

8. Leaf - On the other hand, I guess the =E2=80=98Creation Time=E2=80=99 =
of the entry looks like a field in this table per the usage described in =
the section 9. For the reason of consistency, we also have the field of =
=E2=80=98Creation Time=E2=80=99 in the FCFS-SAVI DataBase (i.e. =
SAVI-SLAAC DB, section 3.1 of RFC6620).

Guang - R7.2:...It is a good suggestion. ... For the usage in section 9, =
the system time of the store operation is enough. There is no need to =
recording the "Creation Time" in binding set up. Besides, adding a new =
field in the table will introduce too many modifications...

=20

=20

Per the description in section 9, <quote> Binding entries MAY be saved =
into non-volatile storage whenever a new binding entry changes to BOUND =
state. ... The time when each binding entry is established is also =
saved.</quote>, I suppose 'Creation Time' could support this action.

=20

Guang:

Thank you for this comment. Maybe can the  'Creation Time' field only =
present in the stored table rather than BST?

=20

=20

9. Leaf...though I don=E2=80=99t really like the prefix of =
=E2=80=98EVE_=E2=80=99 here. =E2=98=BA The prefix of =
=E2=80=98EVE_=E2=80=99 must stand for Event here, supposed it really =
means the additional valid check defined in section 6.3.2.

Guang - R8: ...We have changed =E2=80=98EVE_DHCP_SOLICIT_RC=E2=80=99 to =
=E2=80=98EVE_DHCP_OPTION_RC'. Yes, =E2=80=98EVE_=E2=80=99 stands for =
Event. We need some terms to denote events to be handled.

=20

=20

I guess the text in the draft will not cause any misunderstanding if you =
delete the prefix of 'EVE_'. Right?

=20

Guang:

Thank you for this comment. "EVE_" means it is an event instead of a =
packet. For example, not all " DHCP_OPTION_RC'" will trigger an event.

=20

=20

10. Leaf - In Section 7.1, <quote> Data packets without matching binding =
entry may trigger this process to set up bindings.</quote> <quote>This =
process is not intended to set up a binding whenever a data packet =
without matched binding entry is received.</quote> Does the above 2 =
sentence sound a little conflict?

Guang - R10: ... "Data packets without matching binding entry _may_ =
trigger this process to set up bindings." We use a "may" to mean this is =
probable.

=20

=20

Can I say ' This process is intended to set up a binding whenever a data =
packet without matched binding entry is received.' ?

=20

=20

Guang:

Thank you for this comment. Strictly, it is not quite proper. Not all =
the mismatched packet will trigger the process.

=20

=20

11.=20

Leaf -13. In Section 7.5.3.2, about =E2=80=98IPv6 address=E2=80=99 on =
page 32, <quote> Send a Neighbor Solicitation message with the target =
address set to the IP address in the corresponding entry. The Neighbor =
Solicitation is only sent to the attachment which triggers the binding. =
If there is no response after DAD_TIMEOUT, send another Neighbor =
Solicitation.

</quote> Could this additional DAD process be added in Fig.13?

Guang - R12: ... But it is there:...

=20

=20

I am not quite sure it is a good decision to delete this DAD process =
after EVE_DATA_LEASEQUERY (in the state of RECOVERY). It looks not the =
same as that DAD after EVE_DATA_UNMATCH (in the state of DETECTION), if =
you keep the text in section 7.5.2, <quote>The messages MUST NOT be sent =
to the attachment from which the triggering packet is received.</quote>. =
The DAD process after EVE_DATA_LEASEQUERY looks that 'The Neighbor =
Solicitation is only sent to the attachment which triggers the binding.' =
I personally prefer to combine these 2 DAD process, which means to sent =
DAD_NS to all the ports of SAVI-switch.

=20

Guang:

Thank you for this comment.

As I can understand, you mean sending DAD to the attachment which =
triggers the binding after receiving the DHCP leasequery-reply? What is =
the purpose of this step?

And I'm wondering how to combine the 2 DAD processes since they are =
performed at different stages?

May you please give a further explanation? Thank you very much!

=20

Best regards,

Guang

=20

=20

=20

=20

=20


------=_NextPart_001_0262_01CF4E96.FF66C5A0
Content-Type: text/html;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; charset=3Dutf-8"><meta =
name=3DGenerator content=3D"Microsoft Word 12 (filtered medium)"><!--[if =
!mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:=E5=AE=8B=E4=BD=93;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:"\@=E5=AE=8B=E4=BD=93";
	panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	text-align:justify;
	text-justify:inter-ideograph;
	font-size:10.5pt;
	font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
	{mso-style-priority:99;
	mso-style-link:"=E7=BA=AF=E6=96=87=E6=9C=AC Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:10.5pt;
	font-family:"Calibri","sans-serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
	{mso-style-priority:99;
	mso-style-link:"=E6=89=B9=E6=B3=A8=E6=A1=86=E6=96=87=E6=9C=AC Char";
	margin:0cm;
	margin-bottom:.0001pt;
	text-align:justify;
	text-justify:inter-ideograph;
	font-size:9.0pt;
	font-family:"Calibri","sans-serif";}
span.Char
	{mso-style-name:"=E7=BA=AF=E6=96=87=E6=9C=AC Char";
	mso-style-priority:99;
	mso-style-link:=E7=BA=AF=E6=96=87=E6=9C=AC;
	font-family:"Calibri","sans-serif";}
span.Char0
	{mso-style-name:"=E6=89=B9=E6=B3=A8=E6=A1=86=E6=96=87=E6=9C=AC Char";
	mso-style-priority:99;
	mso-style-link:=E6=89=B9=E6=B3=A8=E6=A1=86=E6=96=87=E6=9C=AC;}
.MsoChpDefault
	{mso-style-type:export-only;}
/* Page Definitions */
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"2050" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DZH-CN link=3Dblue =
vlink=3Dpurple style=3D'text-justify-trim:punctuation'><div =
class=3DWordSection1><p class=3DMsoPlainText><span lang=3DEN-US>1. Guang =
- R2.2: ...Indeed, there is no problem if letting the Relay or Server B =
outside the perimeter. ..., in recent versions, we decide to include =
them into the perimeter.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Leaf - The above decision sounds =
you make that Relay is the for the connection with the upstream =
network.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang - Exactly. <o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>The basic questions here sounds =
: Do we need Server B/Relay work outside the perimeter? Per the =
draft-(ver.)21 of today, I guess the answer is 'no'. </span><span =
lang=3DEN-US style=3D'font-family:Wingdings'>J</span><span =
lang=3DEN-US><o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>2. Guang - Trust: both data packet and control packet are =
trusted;<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>DHCP-Trust: only control packet is =
trusted.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Actually it is proper to configure Trust on the port of =
Relay and server B, if we also trust the data packet from them. In the =
scenario, the relay and server B are supposed to only send control =
packets, thus I think it makes no difference whether DHCP-Trust or trust =
is used. (Maybe we should specify this point in the doc?) =
<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>However, I believe it is necessary to distinguish the two =
types of trusts.=C2=A0 <o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>For the thinking of additional =
modular for the switch, DHCP-Trust attribute is designed for anti-bogus =
DHCP server/Relay. It is only used for the access of DHCP server/Relay, =
just because the default (No attribute) is blocking the messages from =
the Server/Relay on all ports (including validating ports) on the =
SAVI-switch, right?<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Can we just use DHCP-Trust take care the DHCP (control) =
messages from the Server/Relay, and not care the data (plane) packet? I =
mean it might be enough for the defense against bogus DHCP server/Relay, =
right?<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang - I think the perimeter is only a deployment =
suggestion. In practice it is not always possible to enforce savi as the =
diagram.=C2=A0 <o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Then I suggested to make the Fig.1 in the draft more =
popular for the real practice (or networking deployment). In my mind, =
the basic application scenario looks like the =
following:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><img width=3D452 height=3D595 =
id=3D"=E5=9B=BE=E7=89=87_x0020_1" =
src=3D"cid:image001.png@01CF4E81.B0593DE0"></span><span =
lang=3DEN-US><o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang - For example, we may choose to configure DHCP-trust =
and validating on the same port, which is attached by a DHCP server and =
some hosts through a hub. In such cases, the DHCP server is actually =
outside the perimeter. The DHCP messages are not fully trustable but we =
have to make use of them for there are no other =
ways.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>That sounds the DHCP server can be outside SAVI-perimeter =
and DHCP-Trust can be used on the perimeter with Validating =
port.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang - Besides, I think where to draw the perimeter is =
actually not a critical problem. It makes no difference whether placing =
the relay and server inside or outside the perimeter. The savi device =
works based on port configuration, without knowing the =
perimeter.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>The concept of 'perimeter' is defined in section 4 of =
RFC7039 (SAVI arch.) and section 2.5 of RFC6620 (SAVI-SLAAC). It looks =
to me the Validating port of SAVI-Switch (for SLAAC) and the Validating =
attribute of the SAVI devices (for DHCP) forms the perimeter. In another =
word, the binding filters of SAVI form the perimeter, though =
draft-SAVI-DHCP adds more discussion 'On the Placement of DHCP =
Server/Relay' at section 4.3.3.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>3. Guang - Besides, to confirm =
with other solutions, perimeter is the place to perform data packet =
filtering. Thus, only the attach points with validating attribute are on =
the perimeter.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>...<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang - It's my fault: the upstream port is also on the =
perimeter.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>We choose not to fully trust the traffic from upstream =
network: both data packet and control packet. Thus, I think it is =
necessary to keep it outside the perimeter. <o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>However, if the operator chooses =
to fully trust packet from upstream networks, he can use a Trust on the =
corresponding port. Then in concept the upstream network is inside the =
perimeter.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>That is really my concern:<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>a. =C2=A0I don't think we really =
need SAVI switch (and its validating attributes) to form the perimeter =
against the upstream network in practice.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>b . =C2=A0If you don't trust the =
traffic from the upstream network, then the methods, such as ingress =
filtering or uRPF, other than SAVI might be =
employed.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>c. =C2=A0I guess we have not a clear definition for the =
upstream network. In my mind, the upstream network mention here sounds =
in the same administrative domain of the operator, which we could =
trust.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>5. Leaf -4. Question of clarification on the text in =
section 4.3.2, &lt;quote&gt;(6) Optional: configure filters on the =
upstream links to filter out spoofing of local addresses from other =
networks.&lt;/quote&gt;...<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Guang - R4:...We cannot prevent =
other networks from spoofing each other. Thus, we can just requre local =
addresses (addresses assigned to local network) will not be spoofed by =
the other networks.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Leaf - Thanks for your explanation here, but that method =
sounds ingress filtering (or uRPF) to me. Meanwhile, the 'other network' =
in the definition of 'Upstream link' seems a little vague for me. I =
guess it is usually we don</span><span lang=3DEN-US =
style=3D'font-family:"Courier New"'>=E2=80=99</span><span lang=3DEN-US>t =
use SAVI-switch to connect to the upstream network, we use a gateway or =
router. So the (6) of SAVI-DHCP Perimeter Configuration Guideline seems =
unnecessary. I mean we don't usually use SAVI-switch to form the =
SAVI-perimeter against the upstream link or =
network.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang: ... We do not require the savi switch to connect to =
upstream network. Actually, they are connected to the gateway or router. =
This configuration just specifies how to process the traffic from the =
gateway or router.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>The draft sounds only about SAVI-switch. The configuration =
guideline &amp; state machines only work for switches (i.e. SAVI =
devices), right? <o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>6. Guang: ...For SAVI-DHCP, a critical problem is that the =
DHCP Server-Client messages should be trustable. However, there can be =
bogus DHCP servers in the upstream network. We should not make =
assumption that the upstream network is always trustable. Thus, they =
should not be in the perimeter.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>I suppose the SAVI protection =
perimeter is not suitable against the upstream network, for at least 2 =
reasons:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>a. =C2=A0we don't use SAVI device to connect the upstream =
network;<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>b. =C2=A0we don't use Validating attribute for the upstream =
network;<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>I guess your perimeter (SAVI-DHCP perimeter) here sounds =
not the same as SAVI protection perimeter defined in RFC7039 (SAVI =
arch.) and RFC6620 (SAVI-SLAAC). I can't find words in the above 2 RFCs =
on that we can't trust the data or even control packets from the =
upstream network, or the statement of ' We should not make assumption =
that the upstream network is always trustable '.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>If you doubt there is a bogus =
DHCP server in the upstream network, you might employ something like =
'DHCP-trust attribute' configure on the router (or gateway) to block =
DHCP server-client messages from the upstream network, then you could =
only use the local trustable DHCP server between the SAVI-perimeter and =
the router, or use DHCP relay to connect the remote trustable DHCP =
server. But the date (plane) packet need pass through, from the upstream =
network, access network, SAVI perimeter to the end-user hosts (i.e. DHCP =
clients).<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>But this sounds not a feature of SAVI-switch, and might be =
out-of-scope of the draft. I prefer 'DHCP-trust attribute' could only =
mention for the SAVI device in this draft.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>8. Guang:'Creation Time' field =
only present in the stored table rather than =
BST?<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>I believe the solution in draft-SAVI-DHCP-21 can work, but =
the solution in RFC6620 sounds better. If one want to implement both =
SAVI-SLAAC &amp; SAVI-DHCP, he might want the same binding table. =
Right?<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>9. Leaf- I guess the text in the draft will not cause any =
misunderstanding if you delete the prefix of 'EVE_'. =
Right?<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang: Thank you for this comment. &quot;EVE_&quot; means =
it is an event instead of a packet. For example, not all &quot; =
DHCP_OPTION_RC'&quot; will trigger an event.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>For example, you can</span><span =
lang=3DEN-US style=3D'font-family:"Courier New"'>=E2=80=99</span><span =
lang=3DEN-US>t find </span><span lang=3DEN-US =
style=3D'font-family:"Courier New"'>=E2=80=98</span><span =
lang=3DEN-US>EVE_</span><span lang=3DEN-US style=3D'font-family:"Courier =
New"'>=E2=80=99</span><span lang=3DEN-US> for those messages which act =
as the event to trigger the state-change described in RFC6620, you still =
can understand it.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>10. Leaf - In Section 7.1, &lt;quote&gt; Data packets =
without matching binding entry may trigger this process to set up =
bindings.&lt;/quote&gt;<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US> &lt;quote&gt;This process is =
not intended to set up a binding whenever a data packet without matched =
binding entry is received.&lt;/quote&gt;<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Does the above 2 sentence sound =
a little conflict?<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang - R10: ... &quot;Data packets without matching =
binding entry _may_ trigger this process to set up bindings.&quot; We =
use a &quot;may&quot; to mean this is probable.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Leaf - Can I say ' This process =
is intended to set up a binding whenever a data packet without matched =
binding entry is received.' ?<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Guang: </span><span lang=3DEN-US =
style=3D'font-family:"Courier New"'>=E2=80=A6</span><span lang=3DEN-US> =
Strictly, it is not quite proper. Not all the mismatched packet will =
trigger the process.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Can I say </span><span lang=3DEN-US =
style=3D'font-family:"Courier New"'>=E2=80=98</span><span =
lang=3DEN-US>This process may not intended to set up a binding whenever =
a data packet without matched binding entry is received.</span><span =
lang=3DEN-US style=3D'font-family:"Courier New"'>=E2=80=99</span><span =
lang=3DEN-US> or </span><span lang=3DEN-US style=3D'font-family:"Courier =
New"'>=E2=80=98</span><span lang=3DEN-US>This process may intended to =
set up a binding whenever a data packet without matched binding entry is =
received.</span><span lang=3DEN-US style=3D'font-family:"Courier =
New"'>=E2=80=99</span><span lang=3DEN-US>? I am just not sure about the =
wording in </span><span lang=3DEN-US style=3D'font-family:"Courier =
New"'>=E2=80=98</span><span lang=3DEN-US>This process is not intended to =
set up a binding whenever a data packet without matched binding entry is =
received.</span><span lang=3DEN-US style=3D'font-family:"Courier =
New"'>=E2=80=99</span><span lang=3DEN-US>. Anyway, it makes me a little =
confused. In my mind, the process does intend to do =
something.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>11. Leaf - </span><span lang=3DEN-US =
style=3D'font-family:"Courier New"'>=E2=80=A6</span><span =
lang=3DEN-US>if you keep the text in section 7.5.2, &lt;quote&gt;The =
messages MUST NOT be sent to the attachment from which the triggering =
packet is received.&lt;/quote&gt;. The DAD process after =
EVE_DATA_LEASEQUERY looks that 'The Neighbor Solicitation is only sent =
to the attachment which triggers the binding.' I personally prefer to =
combine these 2 DAD process, which means to sent DAD_NS to all the ports =
of SAVI-switch.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang: </span><span lang=3DEN-US =
style=3D'font-family:"Courier New"'>=E2=80=A6</span><span =
lang=3DEN-US>As I can understand, you mean sending DAD to the attachment =
which triggers the binding after receiving the DHCP leasequery-reply? =
What is the purpose of this step? And I'm wondering how to combine the 2 =
DAD processes since they are performed at different stages? May you =
please give a further explanation?<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Draft-(ver.)20 has the =
2<sup>nd</sup> DAD process after EVE_DATA_LEASEQUERY (in the state of =
RECOVERY). Draft-(ver.)21 also have the 2<sup>nd</sup> ARP process for =
IPv4 address in same section 7.5.3.2. <o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>I guess the purpose of this =
process is double-check that one client (or host) assigned the address =
(specified in the Lease-query) with the valid lease is actively attached =
on the port which received a data without matched binding entry. =
<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>I suppose the target address in the 2<sup>nd</sup> DAD =
process is the same as that in the 1<sup>st</sup> DAD process, which is =
the source address of the data packet received in the EVE_DATA_UNMATCH, =
right? If yes, that make possible to combine these 2 =
processes.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Best Regards,<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Leaf<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>-----Original =
Message-----<br>From: Guang Yao [mailto:yaoguang@cernet.edu.cn] =
<br>Sent: Tuesday, April 01, 2014 3:23 PM<br>To: 'Leaf Yeh'; 'Jun Bi'; =
'Jun Bi'<br>Cc: 'Ted Lemon'; savi@ietf.org<br>Subject: RE: Some findings =
in the darft-ietf-savi-dhcp-20<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Dear =
Leaf,<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Thank you very much for the quick =
review!<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Our responses are as follows:<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>1. Leaf - As to Fig.1, question =
for clarification : It sounds to set up a filter (as the requirement of =
DHCP-Trust Attribute) inside the SAVI-perimeter. I guess if the Relay or =
Server B is directly connected to SAVI Device and outside the =
SAVI-perimeter, we still need to set up DHCP-Trust Attribute for the =
port of SAVI Device A and B, right? If yes, does it means the Fig.1 can =
let the Relay or Server B outside the =
SAVI-perimeter?<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang - R2.2: ...Indeed, there is no problem if letting the =
Relay or Server B outside the perimeter. In fact, in the ealier =
versions, they are outside the perimeter. However, in recent versions, =
we decide to include them into the perimeter. <o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>The above decision sounds you =
make that Relay is the for the connection with the upstream =
network.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Thank you for this comment.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US> Exactly. The strength of the =
binding based security is actually very weak. Especially, if the DHCP =
messages are untrustable, the bindings will be meaningless. Thus, We =
prefer the security mechanism enforced between DHCP relay and server, if =
we cannot completely trust traffic from =
upstream.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>2. Guang - On one hand, it is used to distinguish the DHCP =
server A(which is outside the perimeter) and the DHCP server B/Relay. On =
the other hand, we think the perimeter should be used to separating the =
trusted area and the untrusted area. The Relay and Server B should be =
trusted, and they are actually the sources of trust. =
<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>But you still need DHCP-Trust Attribute for them. It seem =
DHCP-Trust Attribute make them to be trust. How about if we just trust =
the Relay and Server B in the SAVI-perimeter without the additional =
permission, because they are connected to the Trust Port, (which was =
introduced by RFC662.)<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Guang: <o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Thank you for this =
comment.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Trust: both data packet and control packet are =
trusted;<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>DHCP-Trust: only control packet is =
trusted.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Actually it is proper to configure Trust on the port of =
Relay and server B, if we also trust the data packet from them. In the =
scenario, the relay and server B are supposed to only send control =
packets, thus I think it makes no difference whether DHCP-Trust or trust =
is used. (Maybe we should specify this point in the =
doc?)<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>However, I believe it is necessary to distinguish the two =
types of trusts.=C2=A0 I think the perimeter is only a deployment =
suggestion. In practice it is not always possible to enforce savi as the =
diagram.=C2=A0 For example, we may choose to configure DHCP-trust and =
validating on the same port, which is attached by a DHCP server and some =
hosts through a hub. In such cases, the DHCP server is actually outside =
the perimeter. The DHCP messages are not fully trustable but we have to =
make use of them for there are no other ways. <o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Besides, I think where to draw =
the perimeter is actually not a critical problem. It makes no difference =
whether placing the relay and server inside or outside the perimeter. =
The savi device works based on port configuration, without knowing the =
perimeter.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>3. Guang - Besides, to confirm with other solutions, =
perimeter is the place to perform data packet filtering. Thus, only the =
attach points with validating attribute are on the =
perimeter.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>It make me not quite sure you want to configure Validating =
attribute for the upstream network, which looks outside of the =
SAVI-perimeter in Fig.1. <o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Per the description in section 4 =
of RFC7039, &lt;quote&gt;The IP source addresses in packets passing the =
protection perimeter are validated by the ingress SAVI instance, but no =
further validation takes place as long as the packets remain within or =
leave the protection perimeter.&lt;/quote&gt;, I suppose it is not =
necessary to let upstream network outside the =
SAVI-perimeter.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Thank you for this comment.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>It's my fault: the upstream port =
is also on the perimeter.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>We choose not to fully trust the =
traffic from upstream network: both data packet and control packet. =
Thus, I think it is necessary to keep it outside the perimeter. =
<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>However, if the operator chooses to fully trust packet from =
upstream networks, he can use a Trust on the corresponding port. Then in =
concept the upstream network is inside the =
perimeter.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>4. Leaf - What does </span><span lang=3DEN-US =
style=3D'font-family:"Courier New"'>=E2=80=9C</span><span =
lang=3DEN-US>SAVI device B is still protected from spoofing from client =
A</span><span lang=3DEN-US style=3D'font-family:"Courier =
New"'>=E2=80=9D</span><span lang=3DEN-US> exactly mean? How can SAVI =
device B protects from spoofing from client A? It sounds a little =
confused.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang - R3:...It means, &quot;SAVI device B can avoid =
receiving spoofing traffic from client A.&quot;.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>The above statement sounds SAVI =
device A can avoid receiving spoofing traffic from client A, then 'SAVI =
device B can avoid receiving spoofing traffic from client A' because of =
the SAVI perimeter. I doubt the necessary text of 'SAVI device B is =
still protected from spoofing from client A' =
here.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Thank you for this comment.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>We will revise this =
sentence.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>5. Leaf -4. Question of clarification on the text in =
section 4.3.2, &lt;quote&gt;(6) Optional: configure filters on the =
upstream links to filter out spoofing of local addresses from other =
networks.&lt;/quote&gt;...<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Guang - R4:...We cannot prevent =
other networks from spoofing each other. Thus, we can just requre local =
addresses (addresses assigned to local network) will not be spoofed by =
the other networks.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Thanks for your explanation here, but that method sounds =
ingress filtering (or uRPF) to me. Meanwhile, the 'other network' in the =
definition of 'Upstream link' seems a little vague for me. I guess it is =
usually we don</span><span lang=3DEN-US style=3D'font-family:"Courier =
New"'>=E2=80=99</span><span lang=3DEN-US>t use SAVI-switch to connect to =
the upstream network, we use a gateway or router. So the (6) of =
SAVI-DHCP Perimeter Configuration Guideline seems unnecessary. I mean we =
don't usually use SAVI-switch to form the SAVI-perimeter against the =
upstream link or network.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Guang:<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Thank you for this =
comment.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>We do not require the savi switch to connect to upstream =
network. Actually, they are connected to the gateway or router. This =
configuration just specifies how to process the traffic from the gateway =
or router.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>6. Leaf - 5. Question of clarification on the text in the =
last paragraph of section 4.3.2, &lt;quote&gt; In this way, the points =
of attachments with Validating attribute (and generally together with =
attachments of upstream devices) on SAVI devices can form a perimeter =
separating DHCP clients and trusted devices.&lt;/quote&gt; The above =
sentence sounds SAVI devices always form perimeter for upstream devices. =
But in general thinking, we always trust devices in the upstream =
network...<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang - R5:...We should not trust devices in the upstream =
network by default unless some other securty mechanisms are =
enforced.=C2=A0 <o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Why not if the upstream network is in the =
SAVI-perimeter?<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Thank you for this comment.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>For SAVI-DHCP, a critical =
problem is that the DHCP Server-Client messages should be trustable. =
However, there can be bogus DHCP servers in the upstream network. We =
should not make assumption that the upstream network is always =
trustable. Thus, they should not be in the =
perimeter.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>7. Guang - R7.1: ...'A' and 'B' do not stand for any =
element in the diagram. They just denote some anchor of the =
clients.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>How about replace A to be 'Port_1' in the instance of =
Fig.3?<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Thank you for this comment. This is an excellent advice. We =
will revise the doc accordingly.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>8. Leaf - On the other hand, I =
guess the </span><span lang=3DEN-US style=3D'font-family:"Courier =
New"'>=E2=80=98</span><span lang=3DEN-US>Creation Time</span><span =
lang=3DEN-US style=3D'font-family:"Courier New"'>=E2=80=99</span><span =
lang=3DEN-US> of the entry looks like a field in this table per the =
usage described in the section 9. For the reason of consistency, we also =
have the field of </span><span lang=3DEN-US =
style=3D'font-family:"Courier New"'>=E2=80=98</span><span =
lang=3DEN-US>Creation Time</span><span lang=3DEN-US =
style=3D'font-family:"Courier New"'>=E2=80=99</span><span lang=3DEN-US> =
in the FCFS-SAVI DataBase (i.e. SAVI-SLAAC DB, section 3.1 of =
RFC6620).<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang - R7.2:...It is a good suggestion. ... For the usage =
in section 9, the system time of the store operation is enough. There is =
no need to recording the &quot;Creation Time&quot; in binding set up. =
Besides, adding a new field in the table will introduce too many =
modifications...<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Per the description in section 9, &lt;quote&gt; Binding =
entries MAY be saved into non-volatile storage whenever a new binding =
entry changes to BOUND state. ... The time when each binding entry is =
established is also saved.&lt;/quote&gt;, I suppose 'Creation Time' =
could support this action.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Guang:<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Thank you for this comment. =
Maybe can the=C2=A0 'Creation Time' field only present in the stored =
table rather than BST?<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>9. Leaf...though I =
don</span><span lang=3DEN-US style=3D'font-family:"Courier =
New"'>=E2=80=99</span><span lang=3DEN-US>t really like the prefix of =
</span><span lang=3DEN-US style=3D'font-family:"Courier =
New"'>=E2=80=98</span><span lang=3DEN-US>EVE_</span><span lang=3DEN-US =
style=3D'font-family:"Courier New"'>=E2=80=99</span><span lang=3DEN-US> =
here. </span><span lang=3DEN-US style=3D'font-family:"Courier =
New"'>=E2=98=BA</span><span lang=3DEN-US> The prefix of </span><span =
lang=3DEN-US style=3D'font-family:"Courier New"'>=E2=80=98</span><span =
lang=3DEN-US>EVE_</span><span lang=3DEN-US style=3D'font-family:"Courier =
New"'>=E2=80=99</span><span lang=3DEN-US> must stand for Event here, =
supposed it really means the additional valid check defined in section =
6.3.2.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang - R8: ...We have changed </span><span lang=3DEN-US =
style=3D'font-family:"Courier New"'>=E2=80=98</span><span =
lang=3DEN-US>EVE_DHCP_SOLICIT_RC</span><span lang=3DEN-US =
style=3D'font-family:"Courier New"'>=E2=80=99</span><span lang=3DEN-US> =
to </span><span lang=3DEN-US style=3D'font-family:"Courier =
New"'>=E2=80=98</span><span lang=3DEN-US>EVE_DHCP_OPTION_RC'. Yes, =
</span><span lang=3DEN-US style=3D'font-family:"Courier =
New"'>=E2=80=98</span><span lang=3DEN-US>EVE_</span><span lang=3DEN-US =
style=3D'font-family:"Courier New"'>=E2=80=99</span><span lang=3DEN-US> =
stands for Event. We need some terms to denote events to be =
handled.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>I guess the text in the draft will not cause any =
misunderstanding if you delete the prefix of 'EVE_'. =
Right?<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Thank you for this comment. &quot;EVE_&quot; means it is an =
event instead of a packet. For example, not all &quot; =
DHCP_OPTION_RC'&quot; will trigger an event.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>10. Leaf - In Section 7.1, =
&lt;quote&gt; Data packets without matching binding entry may trigger =
this process to set up bindings.&lt;/quote&gt; &lt;quote&gt;This process =
is not intended to set up a binding whenever a data packet without =
matched binding entry is received.&lt;/quote&gt; Does the above 2 =
sentence sound a little conflict?<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Guang - R10: ... &quot;Data =
packets without matching binding entry _may_ trigger this process to set =
up bindings.&quot; We use a &quot;may&quot; to mean this is =
probable.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Can I say ' This process is intended to set up a binding =
whenever a data packet without matched binding entry is received.' =
?<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Thank you for this comment. Strictly, it is not quite =
proper. Not all the mismatched packet will trigger the =
process.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>11. <o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Leaf -13. In Section 7.5.3.2, about </span><span =
lang=3DEN-US style=3D'font-family:"Courier New"'>=E2=80=98</span><span =
lang=3DEN-US>IPv6 address</span><span lang=3DEN-US =
style=3D'font-family:"Courier New"'>=E2=80=99</span><span lang=3DEN-US> =
on page 32, &lt;quote&gt; Send a Neighbor Solicitation message with the =
target address set to the IP address in the corresponding entry. The =
Neighbor Solicitation is only sent to the attachment which triggers the =
binding. If there is no response after DAD_TIMEOUT, send another =
Neighbor Solicitation.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>&lt;/quote&gt; Could this =
additional DAD process be added in Fig.13?<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Guang - R12: ... But it is =
there:...<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>I am not quite sure it is a good decision to delete this =
DAD process after EVE_DATA_LEASEQUERY (in the state of RECOVERY). It =
looks not the same as that DAD after EVE_DATA_UNMATCH (in the state of =
DETECTION), if you keep the text in section 7.5.2, &lt;quote&gt;The =
messages MUST NOT be sent to the attachment from which the triggering =
packet is received.&lt;/quote&gt;. The DAD process after =
EVE_DATA_LEASEQUERY looks that 'The Neighbor Solicitation is only sent =
to the attachment which triggers the binding.' I personally prefer to =
combine these 2 DAD process, which means to sent DAD_NS to all the ports =
of SAVI-switch.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Thank you for this comment.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>As I can understand, you mean =
sending DAD to the attachment which triggers the binding after receiving =
the DHCP leasequery-reply? What is the purpose of this =
step?<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>And I'm wondering how to combine the 2 DAD processes since =
they are performed at different stages?<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>May you please give a further =
explanation? Thank you very much!<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Best =
regards,<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Guang<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p></div></body></html>
------=_NextPart_001_0262_01CF4E96.FF66C5A0--

------=_NextPart_000_0261_01CF4E96.FF66C5A0
Content-Type: image/png;
	name="image001.png"
Content-Transfer-Encoding: base64
Content-ID: <image001.png@01CF4E81.B0593DE0>

iVBORw0KGgoAAAANSUhEUgAAAcQAAAJTCAIAAAAZtvEuAAAAAXNSR0IArs4c6QAAMVNJREFUeF7t
3Tt64swSgGH5rAX+YB5WACuASSYidQYhJM4cOpsEQpNNSjTJwArMCvw4sNkLp1qtG5iLQK1GKn1K
xoDUl7c05UaY0sNutwvYEEAAAQSKCfyv2OEcjQACCCBgBEimnAcIIICAAwGSqQNEmkAAAQRIppwD
CCCAgAMB1cl0Pe7Ntw6QtDaBj9bIMq97CKhOpvcApU8EEGimAMm0mXFn1ggg4FhAYzLdznsP4TZY
bKZt++N4LXDrsX2QbuHTTXv+pI/jc4vmEGiUwIPmP9qXa4KfT2+TVqMiesVk8bkCi10RuCCgcWVK
0BFAAAHvAiRT7+R0iAACGgVUv83XGDDmhAAC1RRgZVrNuDAqBBComQDJtGYBY7gIIFBNAZJpNePC
qBBAoGYCJNOaBYzhIoBANQVIptWMC6NCAIGaCZBMaxYwhosAAtUUIJlWMy6MCgEEaiagOZnKd9Dz
lOBLvrEvOydfW3/ozWsWyeuHm9Pn+oY5AoEmCmhOpjnj2X/drUbd2ddOvsXfmrztwkfyIOfhB7vN
e7Z4ChsCCDRLgGR6Mt5h7anefJ6Umtpb5saVqWQX2cJlbLisnW4Wg7gqVZJW7c6ZlW/8SroSNi+n
Q8nUt4p6tXv2euFoxutoBxJ3s/67MtsqC5BMT0ZHFqmz7mY6DVZSWUu2r+GyHSUvyWzL4Zd9etXZ
bGwb4bJ21h1F++92r/2ocbvelXqA7eUwPCb4Gy5f549JM6b5TD79lTQS9SqNf8lwNmY0q2AwMP9+
zd5tO2wIIHB3AZLphRCMVnFKbE3+xMmrNXnuxJVSB4vRKt81AXspwfTXfzWNbufLTVJw9aE93QSb
jyg3tj9f4uWtPJ1u3Vk0mtGvOFHf/RRiAAggYARIpt/Og+3neyZ7/WgfPVHkQmu8yTrxtk+rWv91
5OLs3mZT5XosK9ho4SvLzy6nKgIIVF+AZGpi1P4RTH9Hi8Ltv+Wm818cuc30Mb2U+W/ZsQvCwz8T
SPeXF98/7U38zGXN89c0+7860yN/byDZvDuMSlpv5497S9Pqn1GMEIGmCuyvjFQ9kjWdeWedb1uN
4jMgs1qUBkajdGGYtLa/WEwvkobXQ5OGkufTp2wf2QOONpVZjUYDGM3iHeXgsD0ZjN1tv/t8s7UX
ga/xuaJddkWgkQKa65nKx0SPwZ8ity2RFWixBir9K7q4T6Wnx+AQ8CvA2/yT3vK3SFP7AdFtl0T9
BpLeEEDgvgKaV6b3laV3BBBolAAr00aFm8kigEBZAiTTsmRpFwEEGiVAMm1UuJksAgiUJUAyLUuW
dhFAoFECJNNGhZvJIoBAWQKak2nBep22MJP9hlJF6pxGhazsN6wKbwV9CvdPAwioEtCcTAsGytY5
DZbme6amIFT4haGLdU5LrWcaFrIqOC0ORwCBUgRIphdYh8Ng8P0b9kfrkJ6oZxpVPo0biSqRxl8E
SOuiZr7If7L+aTzYTP+UNC3lPwaNInCtAMn0ktjP11XwEr7XT7fjdUhP1DOVyn2mxmlcyS8q7P/H
1OKTpJmWh8pUnzpV/3R/rPZL+UnR1EsT4XUEEChTgGR6Wbf/NFxmakedq0N6tLHWZBgWcTbrTbMg
Xf99D4tCST3TjpRClZ/Crf+66iyzWfuw/mm0n/mGa1hkmjR6OXbsgYA3AZJpDmopCz1cjv/Fe56s
Q3qyqf86Updv/RHMTLpcf77vlezLMYCDFelolJaRvvpoDkAAgVIESKa5WKW0fjBNCoueqEMatXSk
nqkc8PFb1qM/5YflS1wV1axYsxcQ4hXrhRF1fzzJR2PB4EKx1FzzYicEEHAlQDI9KSmfFA0W5j11
+NdR8iY8KVQqD3Zya6b4xiLhHe7iZtIbmpjbNMXvxNs/3heSS1uBZNNNkFTvNyvetJlB8GxviRp+
RmX7DrfsjflsRl//XQSBuXNfnntZuzpXaAcBBM4IaK4aRb3O86c+PqQGBBwKsDJ1iElTCCDQXAHN
K9PmRpWZI4CAdwFWpt7J6RABBDQKkEw1RpU5IYCAdwGSqXdyOkQAAY0CJFONUWVOCCDgXYBk6p2c
DhFAQKOA5mRKvc7zZyw+Gv9HM6e7CWhOpndDpWMEEGieAMm0eTFnxgggUIIAybQEVJpEAIHmCZBM
mxdzZowAAiUIkExLQKVJBBBongDJtHkxZ8YIIFCCAMm0BFSaRACB5gmQTJsXc2aMAAIlCJBMS0Cl
SQQQaJ4A9UybF3NmjAACJQiwMi0BlSYRQKB5AiTT5sWcGSOAQAkCJNMSUGkSAQSaJ0AybV7MmTEC
CJQgQDItAZUmEUCgeQIk0+bFnBkjgEAJAqqT6Xrcm29LQLu1ScZzqxzHIVB9AdXJtPr8jBABBLQI
kEy1RJJ5IIDAfQV2+ravWfeb6Wgl81yNDp8Pny77+dqMR9+pwIwQ8Ceg+uukco3y8+lt0rrvr6u0
d8ZTlUgwDgTcC/A2370pLSKAQAMFSKYNDDpTRgAB9wKq3+a756JFBBBA4LgAK1PODAQQQMCBAMnU
ASJNIIAAAiRTzgEEEEDAgQDJ1AEiTSCAAAIkU84BBBBAwIEAydQBIk0ggAACJFPOAQQQQMCBAMnU
AWLOJrbzXrVKAuYcN7shgEAOAZJpDiR2QQABBC4JkEwvCfE6AgggkEOAZJoDiV0QQACBSwIk00tC
vI4AAgjkECCZ5kBiFwQQQOCSAMn0khCvI4AAAjkESKY5kNgFAQQQuCRAMr0kxOsIIIBADgGSaQ4k
dkEAAQQuCVBp/5IQryOAAAI5BFiZ5kBiFwQQQOCSAMn0khCvI4AAAjkESKY5kNgFAQQQuCRAMr0k
xOsIIIBADgGSaQ4kdkEAAQQuCZBMLwm5e516pu4saQmBygmQTCsXEgaEAAJ1FCCZ1jFqjBkBBCon
QDKtXEgYEAII1FGAZFrHqDFmBBConADJtHIhYUAIIFBHAZJpHaPGmBFAoHICJNPKhYQBIYBAHQVI
pnWMGmNGAIHKCZBMKxcSBoQAAnUUoJ5pHaPGmBFAoHICrEwrFxIGhAACdRQgmdYxaowZAQQqJ0Ay
rVxIGBACCNRRgGRax6gxZgQQqJwAybRyIWFACCBQRwGSqb+oUc/UnzU9IeBdgGTqnZwOEUBAowDJ
VGNUmRMCCHgXIJl6J6dDBBDQKEAy1RhV5oQAAt4FSKbeyekQAQQ0CpBMNUaVOSGAgHcBkql3cjpE
AAGNAiRTjVFlTggg4F2AZOqdnA4RQECjAPVMNUaVOSGAgHcBVqbeyekQAQQ0CpBMNUaVOSGAgHcB
kql3cjpEAAGNAiRTjVFlTggg4F2AZOqdnA4RQECjAMlUY1SZEwIIeBdQnUzX49586530dIeMp0LB
YCgIOBZQnUwdW9EcAgggcFKAZMrJgQACCLgQ2OnbvmbdbzKjlcxzNTp8Pny67OdrMx59pwIzQsCf
gOqvk8o1ys+nt0nLxS8dF20wHheKtIFANQV4m1/NuDAqBBComQDJtGYBY7gIIFBNAdVv86tJzqgQ
QECjACtTjVFlTggg4F2AZOqdnA4RQECjAMlUY1SZEwIIeBcgmXonp0MEENAoQDLVGFXmhAAC3gVI
pt7J6RABBDQKkEw1RpU5IYCAdwHNyXQ771WrBJ/36J7vsKiPHP+Q3cZr2996bJ81j7M/77348CCx
mffsMQcNXYha3GbUd29+0TUZKefDRSt2uFlAczK9GYUDcwm0Jm9SOsbWijHlYoJBmD+D/quUdpGn
X/vmZ1NGZrQyP4epdRBE+38Nl+3pxna039BuuHw8V4c2bL87+4q67UwvpkgZqex8rOBMromyEwJ5
BEimeZTYJ4eAyXHvL2ey4Hb+IpnUptUgsAkufrTX/s9h8PGVo8dwl/7TLN07u1jOsWJNFs6yyE0z
ctRI9ETyKO+A2K+pAiTTpka+hHm3/uts4iy4GMRXAAaL7o+26e3rI7A/XNr+LXPuaBqaP047v6IE
PX9cDqMF605WvpIgL3X1K15Xy3K4HV2nCFfc3dkfW25MHpl19tvkUlO83nQBkmnTz4CS5p+8+z9S
LfZ4l2n6XQ6jRHZmbJtp22ZrSZ/R8nY7X26Spx/MNYTNR3QZ91RD7c+XOOfHlxzscvd1uPydXAJe
Dp+ibF0SFs2qECCZqghjNSax/XyPFqFHx9P+ESz/nR5pmn7zlKCNrpmuRptpnPVkYdyd7ZcCPnoV
IRnCetzOrGT3S4pPngN7yUKuTTxXpyRuNQLNKI4KkEw5MVwJrH9PO+fyTmvyvPdhkflUPv4LgFvH
EF6oHUSt9H/l+DAq7cnk/mGUJ7dytSD6NCzawS5O12OWpbfGpnnH+Svq772n7Ge+3juvQYdFfb59
Om7XlsnT5mF8p5jkw/fs+i9Zi2aeTHY8DZjcfSZeh5rDsz+n/4vP35Ym+/l+dzQyN7tJl8fR7Wz2
nqhBUBni/QQ01zOVz2Efgz953jM273eomTE+F+JetdvMNPM0rc+seZtfn1gxUl8C0dcCBgv5PKvo
hQhfY6afuwtoXpneHZcBIIBAcwRYmTYn1swUAQRKFCCZlohL0wgg0BwBkmlzYs1MEUCgRAGSaYm4
NI0AAs0RIJk2J9bMFAEEShTQnEyL1us8xX59Pc0SA1ig6bJ8CgyJQxGor4DmZFpWVK6vp3lmJHF9
5LIGS7sIIOBHgGRa1HmvnuZe0fjoz71tQUz7wC5qs5Uyp5u0WlL69+En6nLaivRyePy6/r8ozxTh
TyfbQIeipynHly9AMi1qvFdPs2cqwqWV58N6mlIQM/m6uhSeT0vSheWRw5r00ZbUODpVl9McYOok
taXakS1u//dCjbmis7vv8ZI0v3vKkJrmcN8o0HtOAZJpTqjD3Y7X0+xIEeGwpLBs/ddVZ3nu9hun
er5Ul9PUArG1ivuv52vM3Ti3ihwmDmc9m+JQkXAwjEsCJNNLQideP1JP88aWvh12dV1OVx3TDgII
3C5AMr3dzq4N03qarclw7x5I67/vcbnMIHj/NJWGTaWmwWK/y+iV8HqqvSx4ZV3OYjOo7tFnPas7
bEbWWIH7Vf8rveei9TpPDfBMPc39Ep/p1dD0+e5sNpKTLS3bmbS2X0tzv+778bqcBWttluXjMLDH
PVMy+9+2oIPD8dJUkwU0V42iXuf5JQI+jV1CMfEyBHibX4YqbSKAQOMENK9MGxdMJowAAvcTYGV6
P3t6RgABRQIkU0XBZCoIIHA/AZLp/ezpGQEEFAmQTBUFk6kggMD9BEim97OnZwQQUCSgOZlSr/P8
iVrUJ1vaylSziqs6xfVezePsz+Fo0mKwUvwqrj+YKQ2Vqap1dvTpIePxOCwow4bAfQU0J9P7yurv
XapeyXeRkq8frYKBzadhvVd52hRhkTJZ4T62IItk0kEQFcn6Gi7b041V2m9oN1w+ni8QI1k4qSa1
ChYH38/VL88MKylAMq1kWOo4qLBMwcuZLLidv0gmjetchQUIk0d7E/45DD6+8hKYqoa2hpZs19SB
TdbIprxs5sG17eQdKPtpFyCZao+wx/lJuatNnAXTkteDRfdH24zi6yOwP1za/i0v7CiJWNa15opA
WCs7ae+qOrCShW11AlM1MV5B27x8VTuXZsPrTREgmTYl0p7nmRYfOSxLcmogafpdDv8kVWFP7R2u
a80mlwuifHp9HdjW5Lkz/W3ra89f3mdP4cWI69vxbEt31RQgmVYzLrUc1fbzPVqEHh1++0ew/Hd6
Ymn6TQts52CQhDjafJiEeEsdWLnpzLu5W8F6PO08Rxn8lnZyDJRdtAuQTLVH2N/81r/ThHSs13Ad
GN3/yryeFnC9coxyYKYZSeGjX+GS8pY6sDKo4GWeLktvbefKKbC7RgHF9QdrUK/zrvpFffaLjcp/
Dru2TJ42D+P3+En91myd1mQtmnkyLfR62ubgwsHeITfUgTUD/lYS9YZ27hpMOr+/gOaqUdTrPP/b
Hx+NqyPmdDcB3ubfjZ6OEUBAk4DmlammODEXBBCouAAr04oHiOEhgEA9BEim9YgTo0QAgYoLkEwr
HiCGhwAC9RAgmdYjTowSAQQqLkAyrXiAGB4CCNRDgGRajzgxSgQQqLiA6mS6lqrB2woFgPFUKBgM
BQHHAqqTqWMrmkMAAQROCpBMOTkQQAABFwL3Lw/gfATfCnCIU1jI4ntlTVvfouTnazMe55GgQQQa
JKD666RyjfLz6arimC5+PZ1ug/GU60vrCNxTgLf599SnbwQQUCNAMlUTSiaCAAL3FFD9Nv+esPSN
AALNEmBl2qx4M1sEEChJgGRaEizNIoBAswRIps2KN7NFAIGSBEimJcHSLAIINEuAZNqseDNbBBAo
SYBkWhIszSKAQLMESKbNijezRQCBkgRIpiXBHmlW7lNfrZKA/qZOTwjoFyCZ6o8xM0QAAQ8CJFMP
yHSBAAL6BUim+mPMDBFAwIMAydQDMl0ggIB+AZKp/hgzQwQQ8CBAMvWATBcIIKBfgGSqP8bMEAEE
PAiQTD0g0wUCCOgXIJnqjzEzRAABDwJU2veATBcIIKBfgJWp/hgzQwQQ8CBAMvWATBcIIKBfgGSq
P8bMEAEEPAiQTD0g0wUCCOgXIJnqjzEzRAABDwIkUw/IURfUM/VnTU8IeBcgmXonp0MEENAoQDLV
GFXmhAAC3gVIpt7J6RABBDQKkEw1RpU5IYCAdwGSqXdyOkQAAY0CJFONUWVOCCDgXYBk6p2cDhFA
QKMAyVRjVJkTAgh4FyCZeienQwQQ0ChAPVONUWVOCCDgXYCVqXdyOkQAAY0CJFONUWVOCCDgXYBk
6p2cDhFAQKMAyVRjVJkTAgh4FyCZeienQwQQ0ChAMvUXVeqZ+rOmJwS8C5BMvZPTIQIIaBQgmWqM
KnNCAAHvAiRT7+R0iAACGgVIphqjypwQQMC7AMnUOzkdIoCARgGSqcaoMicEEPAuQDL1Tk6HCCCg
UYBkqjGqzAkBBLwLkEy9k9MhAghoFKCeqcaoMicEEPAuwMrUOzkdIoCARgGSqcaoMicEEPAuQDL1
Tk6HCCCgUYBkqjGqzAkBBLwLkEy9k9MhAghoFCCZaowqc0IAAe8CqpPpetybb72Tnu6Q8VQoGAwF
AccCqpOpYyuaQwABBE4KkEw5ORBAAAEXAjt929es+01mtJJ5rkaHz4dPl/18bcaj71RgRgj4E1D9
dVK5Rvn59DZpufil46INxuNCkTYQqKYAb/OrGRdGhQACNRMgmdYsYAwXAQSqKaD6bX41yRkVAgho
FGBlqjGqzAkBBLwLkEy9k9MhAghoFCCZaowqc0IAAe8CJFPv5HSIAAIaBUimGqPKnBBAwLsAydQ7
OR0igIBGAZKpxqgyJwQQ8C6gOZlu570iJfjW4wfZbAvSlHkQPnYbo6Thh/FYKgaGjdue97tLRzBe
Hwxomz0gPCrc5eJW0Odi++yAQKMENCfTgoHsv0oFlG6w/C2ZqTV520m9ku5s9zYp2Gz2cElny+GX
rcSwChaL6DXpeWe7W3WWUUVWMwIZzmy3e+3LbubhbtaVQi2m9kB4gD0ibC3chQ0BBHwKkEwvaA+H
weDYQi9dUcbrQLt2lPVlvKrMtz6M+zcJMZOpt/+WnedJ/1dn+S+pby2Ppmmj6/Fy+ETW9Pm/hb4Q
OCNAMr10evx8XQUvBwX7JW0mK0pZUg7Ct+eyWJS1oSwvw7J+sk58PzzsW1dyyHDZPnoBQXLpL8mU
YTZNjus/zd7/Rm/h13/fhz8rUxDrkiKvI6BegGR6OcT9p+HyMXOpdDtfdlZpZb/+a/pmPAhGq+g9
duu/zuWmg8C8XbfJd7hML8iux9Mwl4bZNLMabU2GNkVv5y/vw+oUF8wzU/ZBQLcAyTRHfFuTP8Pl
OF0g5jjk+l1ak+fR5sMuO9d/F8FiYFesA/kxXo3KS5Nn88bfXgS4vhOOQACBsgRIprlkJdMF0+nG
7pssD6NDzRvumxaJ8ql95s8Ntp/vI7salQblg6Z0S9/bR0vVdjteuOYaPTshgIAHAX9F/b33lH66
fVPXyU1Ooo/I5bH5MD26IJq9M4q9+UlydxLzMD44Ovb4AA5uoxLum97jxB56OIq9T+3jZg/vx2IH
dGkr6HOpeV5HoFkCmuuZysfrj8GfCt22xMPvxmu6wOcaLfZF4IIAb/M5RRBAAAEHAppXpg54aAIB
BBDIJ8DKNJ8TeyGAAAJnBUimnCAIIICAAwGSqQNEmkAAAQRIppwDCCCAgAMBkqkDRJpAAAEENCfT
ovU60xKi9oud11WB+n5u7X/h6f7nXlGf+8+AESBQIQHNybQos9R0kq8WJd8mkupQxfKpFNnjGwRF
g8LxCFRVgGSaOzL917SqXnbRGtfeT+rjm+/bZx5IB8nu3yv/p1X1e/P0zgDH2s89UHZEAIE7CJBM
r0CXqnqbjy85YP6YljNNSufJwtN+2z2qfW9XtWG957AufuZr93GfkkkHUflTU4IvrqRyvP0rBsqu
CCDgXYBkej251DPdbKZxTee2pMC4dJ4Ul+pMzW1OTMJ9eZ9dKIQfVoeKbzESJtzwMsDp9q8fK0cg
gIAnAZLpFdBSJK/7ox3IAjUpHxWVxUluuhTXwjfVnZ9vqssn69gz7V8xWnZFAAGfAiTT/Nrr31GC
NNXvT9331FQ+fZnnWJZKvwftmMun4V8MnGs//3DZEwEEvAoorjhYtF5nWlo0iki2TOgsW9A0/cg/
Lmy6V1H0sNyoublJ7J5tJ2f7rkJW1MfVOGgHARUCmqtGUa/z/K9lfLwuW+hMuwBv87VHmPkhgIAX
Ac0rUy+AdIIAAggYAVamnAcIIICAAwGSqQNEmkAAAQRIppwDCCCAgAMBkqkDRJpAAAEESKacAwgg
gIADAc3JlHqd508QfBz8B6IJBGIBzcmUKCOAAALeBEim3qjpCAEENAuQTDVHl7khgIA3AZKpN2o6
QgABzQIkU83RZW4IIOBNgGTqjZqOEEBAswDJVHN0mRsCCHgTIJl6o6YjBBDQLEAy1Rxd5oYAAt4E
qGfqjZqOEEBAswArU83RZW4IIOBNgGTqjZqOEEBAswDJVHN0mRsCCHgTIJl6o6YjBBDQLEAy1Rxd
5oYAAt4ESKbeqOkIAQQ0C6hOputxb76tUPQYT4WCwVAQcCygOpk6tqI5BBBA4KQAyZSTAwEEEHAh
sNO3fc2632RGK5nnanT4fPh02c/XZjz6TgVmhIA/AdVfJ5VrlJ9Pb5OWi186LtpgPC4UaQOBagrw
Nr+acWFUCCBQMwGSac0CxnARQKCaAqrf5leTnFEhgIBGAVamGqPKnBBAwLsAydQ7OR0igIBGAZKp
xqgyJwQQ8C5AMvVOTocIIKBRgGSqMarMCQEEvAuQTL2T0yECCGgUIJlqjCpzQgAB7wIkU3/k23mv
WiUB/U2dnhDQL0Ay1R9jZogAAh4ESKYekOkCAQT0C5BM9ceYGSKAgAcBkqkHZLpAAAH9AiRT/TFm
hggg4EGAZOoBmS4QQEC/AMlUf4yZIQIIeBAgmXpApgsEENAvQDLVH2NmiAACHgSotO8BmS4QQEC/
ACtT/TFmhggg4EGAZOoBmS4QQEC/AMlUf4yZIQIIeBAgmXpApgsEENAvQDLVH2NmiAACHgRIph6Q
oy6oZ+rPmp4Q8C5AMvVOTocIIKBRgGSqMarMCQEEvAuQTL2T0yECCGgUIJlqjCpzQgAB7wIkU+/k
dIgAAhoFSKYao8qcEEDAuwDJ1Ds5HSKAgEYBkqnGqDInBBDwLkAy9U5OhwggoFGAeqYao8qcEEDA
uwArU+/kdIgAAhoFSKYao8qcEEDAuwDJ1Ds5HSKAgEYBkqnGqDInBBDwLkAy9U5OhwggoFGAZOov
qgXrmcrhD4dbb771N356QgCBMwIk0zqdHt3Z1263W42C0Ur+3c267gc/743X7lulRQT0C5BMaxPj
1uTtbdLKDjd5wq5ZZZkar15NQrQ/29S4Hkc7JIeny9yebHPzfHjAdLMYxOtf0mptTg4GWgEBkmkF
glB4CJM3s17dTNvt5dAsWVfB33UgyfcrXrv2X8MFbbxJ2lwOzSLX7NvZbOzzcoBZ7dpVr9le+4VH
RgMINEaAZKon1OYiwNvEzKf/ej4PtibPnWnbLkAHi9HKHsWGAAIFBEimBfBqfKhZqkbbKhjYt/ls
CCBQQIBkWgCvDoe+f4af98sb+8EiGe9crpJm/wyg819mKtER4XVWrprWIcaMsSICyQKFH8oWkCuY
9uP4m7fkGmh48iQXNzNXQ/df2KUHdGczc83UDmD/zwDSi6ThNdTk0ur+8zcPmgMRaIYAVaP8/VKT
1eFj8OfgE3l/3dMTAgiUKcDb/DJ1aRsBBBojwMq0MaFmogggUKYAK9MydWkbAQQaI0AybUyomSgC
CJQpQDItU5e2EUCgMQIk08aEmokigECZAiTTMnVpGwEEGiNAMm1MqJkoAgiUKaA6ma7H1SqezHjK
PJVpG4H7CqhOpvelpXcEEGiSAMm0SdFmrgggUJ6AwhIE++VALF1YtOOwIEhcK6Tk52szHoXnAlNC
wJuA6q+TyjXKz6cKFRZhPOUtCmgZgXsL8Db/3hGgfwQQUCFAMlURRiaBAAL3FlD9Nv/euPSPAALN
EWBl2pxYM1MEEChRgGRaIi5NI4BAcwRIps2JNTNFAIESBUimJeLSNAIINEeAZNqcWDNTBBAoUYBk
WiIuTSOAQHMESKbNiTUzRQCBEgU0J1O5T315JfjmvYdoG4+l0l8YovU4fu4heiYIZBDxfmvZJX1o
hpY5INxpbHbxtpXq420WdIRARQQ0J9PyiCUNLYdftoDCKlgsop76r/JYypp0Z6vOUnKl2VqTNymw
0p3tdq/96OFu1pW6K6ZmQHiAPSJsLdyFDQEE6ihAMi0aNZMQ3yZJK9t/y87zpP+rs/xns6ls8mia
LjrX4+XwiaxZ1J3jEaiYAMn0loDIcnO4bEdv35N39GFLkkt/SaYMs2nSdP9p9v43egu//vs+/Nm6
pVeOQQCBCguQTG8Mjrx7t9vXcJleIV2Pp2EuPVyNtibD9xfzxn87f3kfyht8NgQQUCZAMi0a0Nbk
ebT5sMvO9d9FsBjYFetAfoxXo/LS5Nm88bcXAYp2yfEIIFA9AZLpDTGRD+Ezfyaw/Xwf2dWovIOX
D5rSLX1vHy1V2+144XpDrxyCAAJVFiCZ3hadzTS+ZPrQDj9PMn/zNFhspg9RnjV/9TTdyDI1Sbty
4VQ+td/76Mn+aVR7uoma8/unUbfNnKMQQOCogOZ6ppLfHoM/FbptScXOQXwqFhCGU28BVqb1jh+j
RwCBighoXplWhJhhIIBAEwRYmTYhyswRAQRKFyCZlk5MBwgg0AQBkmkToswcEUCgdAGSaenEdIAA
Ak0QIJk2IcrMEQEEShfQnEzLqteZ1iS1Xxwt+qf2+1+oKj3kSQdl+fibAT0hUCEBzcm0LGapGbUa
BVKSNC5oOiiWT6WIH98sKCtYtIuALwGSaWHp/uvXzJaEyhbSN18rtU0n5fT3auuHryZr3O93BEiL
8Pfm6R0Dsovi/dJ/hadBAwggUEiAZFqIzx7c+q+z+fiSH+aPSQH+tDSfLDxtLf2otr5d1Yb1pE0Z
/rDS/sEgJJMOgmjlKyX+ppvo9aPtO5gATSCAQGEBkmlhwqSB7XwZVyyx5UuCuDSflOnrTH/bMn1S
0HS/2sn3AYTVp+JbmIQJN7wMcLp9d3OgJQQQuFGAZHojXPYwKcLX/dE2C1Rzr6fsltzUKa61b6pH
P99YHPpc+w5mQRMIIFBEgGRaRM8eu/4dJUhzr6dT90OVxWnwMs+xLJUGD9oxl0/Dvxg4137xadAC
AggUEthfSal6lN710+20vl3jTD7Yl372r39mXwmvje49IVdPD7b05Ww7Odu/dpZl+Vw7DvZHQIWA
5qpR1Os8/2sWn0LLEA5GYF+At/mcEQgggIADAc0rUwc8NIEAAgjkE2Blms+JvRBAAIGzAiRTThAE
EEDAgQDJ1AEiTSCAAAIkU84BBBBAwIEAydQBIk0ggAACmpMp9TrPn9/48P8fAYcCmpOpQyaaQgAB
BM4LkEw5QxBAAAEHAiRTB4g0gQACCJBMOQcQQAABBwIkUweINIEAAgiQTDkHEEAAAQcCJFMHiDSB
AAIIkEw5BxBAAAEHAiRTB4g0gQACCFDPlHMAAQQQcCDAytQBIk0ggAACJFPOAQQQQMCBAMnUASJN
IIAAAiRTzgEEEEDAgQDJ1AEiTSCAAAIkU84BBBBAwIGA6mS6HvfmWwdIrppgPK4kaQeB6gmoTqbV
42ZECCCgVYBkqjWyzAsBBPwK7PRtX7PuN8PRSua5Gh0+Hz5d9vO1GY++U4EZIeBPQPXXSeUa5efT
26Tl99fT6d4YT1UiwTgQcC/A23z3prSIAAINFCCZNjDoTBkBBNwLqH6b756LFhFAAIHjAqxMOTMQ
QAABBwIkUweINIEAAgiQTDkHEEAAAQcCJFMHiDSBAAIIkEw5BxBAAAEHAiRTB4g0gQACCJBMOQcQ
QAABBwIkUweIOZvYznu3lwSUgx/sNl5Lf+nDc00mex3daT1+OH2wvPggL+ec2tHdzrZfpGGORaCK
AiTTKkblyJhakzcpyNKd7XavfXnZPNzNulKo5VztgXCv3bFCK6aH/uuZg+XF73Vhjoxr3guT+7Ht
bPs1YWeYCOQWIJnmprr/jv1fnWmautbj5fDJJFbZwnWk3fIsfk+uWNMFr10Ax9vR9sOdp5vFIO46
OeRo+/bJ8TgZaraHpIPefG7XxFWq6n3/0DOCGgiQTGsQpGSI/afZ+98oya3/vg9/JgWxfoW1BM02
XLZPrhXjhk6sWNfj9nL4ZZtZBYPBIrU51n66Oo66DtfMZjvavjwpa+TFIrBD/Zq9v8QZc94bxM8O
l9NFd/ZVoVpfdTpBGOs9BUim99S/uu/WZGhT0Hb+8j5Miwu2P1/i5eF0c3Wr0QGSnmd/4jb7r9mr
A07aD7sZraKU2/qvE/W7nS+DWfzs5M+RarS3zojjEPAoQDL1iO2iq8lzZ/lvu/237DxP0jfh6Yry
5BXSAp1nV6xltL83tDTJFhgxhyLgX4Bk6t+8WI/mwmm7Pe38it9TB9vP9268St3OH29empqWfydX
Ste/44YutP/+aS9vmsueFy8wHJu7LLeDZXKNdP6SubpQjIqjEfAq4K+of+N7kvfNcjWwOMP3djLv
yLujkblpy023adm/gctoZO7yYv5+ILsazbZvL64m94Kx94A5eRuYZJBmv/ioCCQ7ga4bpeLOtIDA
VQLUM/X3q0s+zn4M/vDRynlxlPydkfTkVIC3+U45aexWgeQ7CXL5l983typy3D0FWJneU5++EUBA
jQArUzWhZCIIIHBPAZLpPfXpGwEE1AiQTNWEkokggMA9BUim99SnbwQQUCNAMlUTSiaCAAL3FCCZ
+tMvVM/U3zDr3VPyJ1amPlVUj3Wv5lU0vbP1YTMHpCVk6+2SGX1d6szWZZwp7VV/4s/ORQRcfQOq
yBh0H5sVNt+xCr++FW3ha6YibPodNFsfNt3C+rAHRzj4xtpV5gdjuOrYM3O5uZ26H+jKM48DK1M1
Cw4msicgpaml9nXylC0NI+UHpExM/OTp+rDXWIZr4agM60FFWbtMltqs8To4rV2QrqCTggan68Nm
bqxwePuDdBEtQ7B3criyzqyd6/fxnK0/ewTojMOp8Z/yOVIP1z7V64XVcMfraNqxZ6YOb3p7iOs9
z8Qr1xmRJ+OyjxMBVqZOGM83khbwO77q3F+NSkjixej+otV0kj9eYadxQ6bOQGaFa6sQ2MGsRvYF
2SNdIcsOmaEeXUllizqY5uP9TdvZbjOtnlmRfZ/XqfGEJROiDvJonHI4NX5r8t3Hhviwx2Q08bST
6J1p/yrP8+O5ePYGF/dgB1cCeU5HV33RTjbpmP+xadLMpjrJa2FaC2NzgJY/Xvvp0zSWZtOjSXrv
ckJ4O5r4csKR//xHbjtjjz+8TJHzbf6RJHViPBcm8u0kO+5wcvzh8d994maPjDP+nWRDGA3vbPvX
eF4Yz8X/U7zNz7V+Z6faCbQmz6PNh60ouP67COK7q8j9Axbx3QrkpWP1YW+Ya/dH+4aj8h0iFV4P
E31yT4N8Lfjb65hD2eO/tv1r98+t5zCZ2ssY3yta8vz5aOBjfU455D6XTQuZe0dJGdaRLfpqbiGw
t2pL7v0iL36vD5u/w3TPzfQxvZOrXJ5Nq81+by25XUL0krkBTXrThOB7fVgzxGM3xTp4/qCgbO46
sxfGcxXHUYdT47+q5TM7n28/v2fR8ThMpkWHwvEIFBbYTNvx/Vuk/JTcb9B8CjFYbKbxPfpMxglv
AphkJ7mxlrzFj29NmMnr7ekmau5yzevuqLNM7mkY3+gw/PVgOo/GlDQz+SN36kp2HwTpTRPMSjna
3dwWK1qByodp2QOSJcv+85kDwhX3t3aiT23SecVLn6PjETnZU6TMsOXQcCKXbnR41MHcB/fY+E/5
HBunHY3E0SIuBnYkdninfOw7j9yeJ+OV87SkalROKAe7UanTAWIlm5CP0SlUK5FpuAMr00r+72RQ
9RGQpW+0hI2+I1CfoTsdKQ6sTJ2eUDSGAAJNFWBl2tTIM28EEHAqQDJ1ykljCCDQVAGSaVMjz7wR
QMCpAMnUKSeNIYBAUwVIpk2NPPNGAAGnAiRTp5xnG6OeqT9rekLAuwDJ1Ds5HSKAgEYBkqnGqDIn
BBDwLkAy9U5OhwggoFGAZKoxqswJAQS8C5BMvZPTIQIIaBQgmWqMKnNCAAHvAiRT7+R0iAACGgVI
phqjypwQQMC7AMnUOzkdIoCARgHqmWqMKnNCAAHvAqxMvZPTIQIIaBQgmWqMKnNCAAHvAiRT7+R0
iAACGgVIphqjypwQQMC7AMnUOzkdIoCARgGSqcaoMicEEPAuoDqZrse9+dY76ekOGU+FgsFQEHAs
oDqZOraiOQQQQOCkAMmUkwMBBBBwIbDTt33Nut9kRiuZ52p0+Hz4dNnP12Y8+k4FZoSAPwHVXyeV
a5SfT2+TlotfOi7aYDwuFGkDgWoK8Da/mnFhVAggUDMBkmnNAsZwEUCgmgKq3+ZXk5xRIYCARgFW
phqjypwQQMC7AMnUOzkdIoCARgGSqcaoMicEEPAuQDL1Tk6HCCCgUYBkqjGqzAkBBLwLkEy9k9Mh
AghoFCCZaowqc0IAAe8CmpPpdt4rpQSftPuQ3cZrG7b12D5rHmd/3nvx4UHGNO/ZYw4aKmW0p0+p
sny8n8R0iEAVBDQn07J8W5M3KZlia6SYMinBIMyfQf9VSprI069987MpnzJamZ/D1DoIov2/hsv2
dGPHtt/Qbrh8rFT91bIAaRcBjQIk08JRNTn0/eVMFtzOXyST2rQaBJKKJQPHj/Z6/zkMPr4Kj4cG
EEDgHgIkUwfqrf86mzgLLgbxFYDBovujbVr/+gjsD5e2f8ucO15qiNcRQMC7AMnUMXny7v9IldTj
XaXpdzn8U516gY5daA4B7QIkUwcR3n6+R4vQo421fwTLf6e7SdNvhUqvOlChCQSaJUAyLR7v9e9p
5/nMkrI1ee5MM5/Um0/6478AKN47LSCAQCUESKbXh0H+pGiwCDIXR4PwQ3t5Wj6ml6ejP40aLDbT
ts2h8tm+fIafXExNPo7KNOT5z6KunzVHIIDAWQHN9Uwluz0Gf3jvfOoEwIfkgIBDAVamDjFpCgEE
miugeWXa3KgycwQQ8C7AytQ7OR0igIBGAZKpxqgyJwQQ8C5AMvVOTocIIKBRgGSqMarMCQEEvAuQ
TL2T0yECCGgU0JxMndTrjAuT7tUhTSqaHv1TezmkFn+C78RH438K5oTALQKak+ktHvvHnKpDasvo
SfXSo13I952Kf1Mgrh9dfBK0gAACPgRIpqeVc9chTZo4uWLNFufvze3+9rnxOKrPn35fP3wh/GJq
tPFFfh//FegDgWICJNPTfrnrkCZNnFqxzh+Xw6+oML9U2perAHKI7Cxr28UiKsGfVpgOWwlr9kfb
0UrSxeLO0Qgg4FiAZOoY9Ehz2/lyIzVPomWmuWfJ5iO6bVSQ3NkkkArT5Q+FHhBAoCwBkulp2Qt1
SHOHRNJkdxavMu2/rDVz67EjAjURIJmeDpSzOqT9X3v1THOeGu+fpnqfvdEpV01zorEbAvcT2F8x
qXokVyS7s/hS5a0zy35iH1/FlPuOHmz2lVPPm9f2P/k3+yd/DGAexIemA04bSy+e3jqJ48c58XE7
JFpDoL4CmqtGUa/z/O9ofO63hqFnhQK8zVcYVKaEAAL+BTSvTP1r0iMCCDRWgJVpY0PPxBFAwKUA
ydSlJm0hgEBjBUimjQ09E0cAAZcCJFOXmrSFAAKNFSCZNjb0TBwBBFwKaE6m1Os8f6bg4/J/Em01
XkBzMm18cAFAAAF/AiRTf9b0hAACigVIpoqDy9QQQMCfAMnUnzU9IYCAYgGSqeLgMjUEEPAnQDL1
Z01PCCCgWIBkqji4TA0BBPwJkEz9WdMTAggoFiCZKg4uU0MAAX8C1DP1Z01PCCCgWICVqeLgMjUE
EPAnQDL1Z01PCCCgWIBkqji4TA0BBPwJkEz9WdMTAggoFiCZKg4uU0MAAX8CJFN/1vSEAAKKBVQn
0/W4N99WKHiMp0LBYCgIOBZQnUwdW9EcAgggcFKAZMrJgQACCLgQ2OnbvmbdbzKjlcxzNTp8Pny6
7OdrMx59pwIzQsCfgOqvk8o1ys+nt0nLxS8dF20wHheKtIFANQV4m1/NuDAqBBComQDJtGYBY7gI
IFBNAdVv86tJzqgQQECjACtTjVFlTggg4F2AZOqdnA4RQECjAMlUY1SZEwIIeBcgmXonp0MEENAo
QDLVGFXmhAAC3gVIpt7J6RABBDQK/B+rCO9hLbq4BgAAAABJRU5ErkJggg==

------=_NextPart_000_0261_01CF4E96.FF66C5A0--


From nobody Thu Apr  3 21:07:47 2014
Return-Path: <internet-drafts@ietf.org>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67EC41A0349; Thu,  3 Apr 2014 21:07:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AOWBsJHwpeh7; Thu,  3 Apr 2014 21:07:35 -0700 (PDT)
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id A3D641A00A9; Thu,  3 Apr 2014 21:07:31 -0700 (PDT)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: internet-drafts@ietf.org
To: i-d-announce@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 5.2.0
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <20140404040731.14648.7709.idtracker@ietfa.amsl.com>
Date: Thu, 03 Apr 2014 21:07:31 -0700
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/oUGB4EPvcXY437qzsgNMDVK-C3Q
Cc: savi@ietf.org
Subject: [savi] I-D Action: draft-ietf-savi-dhcp-22.txt
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 04 Apr 2014 04:07:41 -0000

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Source Address Validation Improvements Working Group of the IETF.

        Title           : SAVI Solution for DHCP
        Authors         : Jun Bi
                          Jianping Wu
                          Guang Yao
                          Fred Baker
	Filename        : draft-ietf-savi-dhcp-22.txt
	Pages           : 43
	Date            : 2014-04-03

Abstract:
   This document specifies the procedure for creating a binding between
   a DHCPv4/DHCPv6 assigned IP address and a binding anchor on a SAVI
   (Source Address Validation Improvements) device.  The bindings set up
   by this procedure can be used to filter out packets with forged
   source IP address in DHCP scenario.  This mechanism is proposed as a
   complement to ingress filtering to provide finer-grained source IP
   address validation.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-savi-dhcp-22

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-savi-dhcp-22


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


From nobody Fri Apr  4 08:09:25 2014
Return-Path: <yaoguang@cernet.edu.cn>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59E4C1A0076 for <savi@ietfa.amsl.com>; Thu,  3 Apr 2014 19:48:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.909
X-Spam-Level: 
X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1RMoZXLDQVuv for <savi@ietfa.amsl.com>; Thu,  3 Apr 2014 19:48:49 -0700 (PDT)
Received: from cernet.edu.cn (cernet.edu.cn [202.112.39.2]) by ietfa.amsl.com (Postfix) with ESMTP id 7BFCE1A0064 for <savi@ietf.org>; Thu,  3 Apr 2014 19:48:48 -0700 (PDT)
Received: from AndrewYaoPC (unknown [166.111.132.217]) by centos (Coremail) with SMTP id AQAAf3CLMgOAHT5TNbgcAA--.2594S2; Fri, 04 Apr 2014 10:48:32 +0800 (CST)
From: "Guang Yao" <yaoguang@cernet.edu.cn>
To: "'Leaf Yeh'" <leaf.yeh.sdo@gmail.com>
References: <20140331054839.12951.1562.idtracker@ietfa.amsl.com> <533a1b73.0382440a.6009.ffffb32a@mx.google.com> <000501cf4d7b$e18af450$a4a0dcf0$@cernet.edu.cn> <533a8591.2ac5440a.0da6.1ee7@mx.google.com>
In-Reply-To: <533a8591.2ac5440a.0da6.1ee7@mx.google.com>
Date: Fri, 4 Apr 2014 10:48:34 +0800
Message-ID: <002601cf4fb0$5f0d0180$1d270480$@cernet.edu.cn>
MIME-Version: 1.0
Content-Type: multipart/related; boundary="----=_NextPart_000_0027_01CF4FF3.6D3300A0"
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AQH2W92cm8JJdKosbkMcCGTh4OHxCgI61sxxAfzvUxcCgsquP5p8z5Ag
Content-Language: zh-cn
X-CM-TRANSID: AQAAf3CLMgOAHT5TNbgcAA--.2594S2
X-Coremail-Antispam: 1UD129KBjvJXoWxtFykKr4DWrWxJryrXw4DCFg_yoW3Xw43pa yftrW7Kw1DJa4xG397Cw10vr1ku39xXrW7AF15G347A398Zas3KrW8tw15C347Xr95GayI qrWq934DJasxWrJanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUH014x267AKxVWUJVW8JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84ACjcxK6xIIjxv20xvE14 v26r1j6r1xM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r1j6r4UM28EF7xvwVC2z280aVAF wI0_Cr0_Gr1UM28EF7xvwVC2z280aVCY1x0267AKxVW8Jr0_Cr1UM2vj62AExVA0xI801c 8C04v26x02cVCv0xWle2I262IYc4CY6c8Ij28IcVAaY2xG8wASzI0EjI02j7AqF2xKxwAq x4xG67k08I80eVW7JVWxJwAqx4xG6c804VAFz4xC04v7Mc02F40Ew4AK048IF2xKxVWUJV W8JwAqx4xG6xAIxVCFxsxG0wAqx4xG6I80eVA0xI0YY7vIx2IE14AGzxvEb7x7McIj6I8E 87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41lF7xvr2 IYc2Ij64vIr40E4x8a64kEw24lF7I21c0EjII2zVCS5cI20VAGYxC7Mx8GjcxK6IxK0xII j40E5I8CrwCY02Avz4vE14v_Gr1l42xK82IYc2Ij64vIr41lx2IqxVAqx4xG67AKxVWUGV WUWwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r126r1DMIIYrxkI7VAK I48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I0E14v26r1j6r 4UMIIF0xvE42xK8VAvwI8IcIk0rVWrZr1j6s0DMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF 0xvEx4A2jsIEc7CjxVAFwI0_Jr0_GrUvcSsGvfC2KfnxnUUI43ZEXa7VUbtrcDUUUUU==
X-CM-SenderInfo: 51drw3xdqjquphuqv3oohg3hdfq/
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/BugP4m6C26JPostgymzV7bOMxjo
X-Mailman-Approved-At: Fri, 04 Apr 2014 08:09:23 -0700
Cc: savi@ietf.org, 'Ted Lemon' <ted.lemon@nominum.com>
Subject: Re: [savi] I-D Action: draft-ietf-savi-dhcp-21.txt
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 04 Apr 2014 02:48:55 -0000

This is a multipart message in MIME format.

------=_NextPart_000_0027_01CF4FF3.6D3300A0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_001_0028_01CF4FF3.6D3300A0"


------=_NextPart_001_0028_01CF4FF3.6D3300A0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Dear Leaf,

 

Thank you for these advanced comments. Our responses are  as follows:

 

1.

Guang - R19: We found there is no direct link between SAVI devices, thus we
add a new link to illustrate this situation.

 

 

I guess we could live with the case of 'no direct link between SAVI
devices', just because the connection (i.e. Non-SAVI device) between them
are in the perimeter. 

 

Guang: You are right such a link is not necessary for real cases. But we
think it will be weird if we state "trust" is mainly used between direct
connected SAVI devices, but there is no such a case in the diagram.

 

2. 

 

Guang - R20: Since DHCP relay and server are only supposed to send DHCP
messages, data packets are not expected from them. If they also send data
packet, their roles are changed. How to process the data packet depends on
the the role which sends the data packet.

 

 

DHCP messages is only a kind of control plane packet. 

DHCP-Trust Attribute sounds only deactivate the blocking against the message
from server/relay.

 

If you let the data packet pass, then you will get a more flexible
application case as follows within the perimeter:



Right? I can't see the negative effect yet when you let the data packet pass
through the trust port of SAVI-switch.

 

 

Guang: Indeed, if only DHCP-trust if configured, the data packet will be
forwarded without checking. This point is specified in the doc. Thus, the
current design can survived in your case. However, this case is not secure;
thus, it is not a suggested deployment case. 



 

Best regards,

Guang

 

From: Leaf Yeh [mailto:leaf.yeh.sdo@gmail.com] 
Sent: Tuesday, April 01, 2014 5:23 PM
To: 'Guang Yao'
Cc: savi@ietf.org; 'Jun Bi'; 'Ted Lemon'
Subject: RE: [savi] I-D Action: draft-ietf-savi-dhcp-21.txt

 

Guang - R19: We found there is no direct link between SAVI devices, thus we
add a new link to illustrate this situation.

 

 

I guess we could live with the case of 'no direct link between SAVI
devices', just because the connection (i.e. Non-SAVI device) between them
are in the perimeter. 

 

 

Guang - R20: Since DHCP relay and server are only supposed to send DHCP
messages, data packets are not expected from them. If they also send data
packet, their roles are changed. How to process the data packet depends on
the the role which sends the data packet.

 

 

DHCP messages is only a kind of control plane packet. 

DHCP-Trust Attribute sounds only deactivate the blocking against the message
from server/relay.

 

If you let the data packet pass, then you will get a more flexible
application case as follows within the perimeter:



Right? I can't see the negative effect yet when you let the data packet pass
through the trust port of SAVI-switch.

 

 

Best Regards,

Leaf

 

 

 

-----Original Message-----
From: Guang Yao [mailto:yaoguang@cernet.edu.cn] 
Sent: Tuesday, April 01, 2014 3:28 PM
To: 'Leaf Yeh'
Cc: savi@ietf.org <mailto:savi@ietf.org> ; 'Jun Bi'; 'Ted Lemon'
Subject: RE: [savi] I-D Action: draft-ietf-savi-dhcp-21.txt

 

Hi Leaf,

 

Thank you very much for these comments! The replies are as follows.

 

1. Q19. I am not sure the reason why there is a new link between SAVI Device
C to SAVI Device B in Fig.1. The relation between the SAVI Device A and the
SAVI Device B looks more like the case described in the Fig.1 of SAVI arch.

(RFC7039).

 

R19:

We found there is no direct link between SAVI devices, thus we add a new
link to illustrate this situation.

 

 

2. Q20. As to DHCP-Trust Attribute,

in section 4.2.2, <quote>

The "DHCP-Trust Attribute" indicates the DHCP Server-Client messages

   from the corresponding attachment is trustable.

...

</quote>

, in section 4.3.2 <quote>

   (5)  Configure DHCP-Trust attribute on the direct attachments of

        trusted DHCP relays/servers.

...

DHCP-Trust

  attribute is only configured on the inside links of the perimeter.

   Only DHCP server-client messages originated in the perimeter is

   trusted.

</quote>

 

 

When the port of SAVI-switch connected to the trusted DHCP relays/servers
(in the SAVI-perimeter) is configured DHCP-Trust attribute, how about the
data packet forwarding when it is received on this port? I guess the switch
will forward the packet as the normal without checking, right? May you need
a statement on this case in section 8.1?

 

R20:

Thank you for this comment. 

Since DHCP relay and server are only supposed to send DHCP messages, data
packets are not expected from them. If they also send data packet, their
roles are changed. How to process the data packet depends on the the role
which sends the data packet.

We will specify this point in the revision.

 

-----Original Message-----

From: Leaf Yeh [ <mailto:leaf.yeh.sdo@gmail.com>
mailto:leaf.yeh.sdo@gmail.com]

Sent: Tuesday, April 01, 2014 9:51 AM

To: 'Guang Yao'

Cc:  <mailto:savi@ietf.org> savi@ietf.org; 'Jun Bi'; 'Ted Lemon'

Subject: RE: [savi] I-D Action: draft-ietf-savi-dhcp-21.txt

 

Hi Guang,

 

Q19. I am not sure the reason why there is a new link between SAVI Device C
to SAVI Device B in Fig.1. The relation between the SAVI Device A and the
SAVI Device B looks more like the case described in the Fig.1 of SAVI arch.

(RFC7039).

 

 

Q20. As to DHCP-Trust Attribute,

in section 4.2.2, <quote>

The "DHCP-Trust Attribute" indicates the DHCP Server-Client messages

   from the corresponding attachment is trustable.

...

</quote>

, in section 4.3.2 <quote>

  (5)  Configure DHCP-Trust attribute on the direct attachments of

        trusted DHCP relays/servers.

...

DHCP-Trust

   attribute is only configured on the inside links of the perimeter.

   Only DHCP server-client messages originated in the perimeter is

   trusted.

</quote>

 

 

When the port of SAVI-switch connected to the trusted DHCP relays/servers
(in the SAVI-perimeter) is configured DHCP-Trust attribute, how about the
data packet forwarding when it is received on this port? I guess the switch
will forward the packet as the normal without checking, right? May you need
a statement on this case in section 8.1?

 

 

Best Regards,

Leaf

 

 

 

-----Original Message-----

From: savi [ <mailto:savi-bounces@ietf.org> mailto:savi-bounces@ietf.org] On
Behalf Of  <mailto:internet-drafts@ietf.org> internet-drafts@ietf.org

Sent: Monday, March 31, 2014 1:49 PM

To:  <mailto:i-d-announce@ietf.org> i-d-announce@ietf.org

Cc:  <mailto:savi@ietf.org> savi@ietf.org

Subject: [savi] I-D Action: draft-ietf-savi-dhcp-21.txt

 

 

A New Internet-Draft is available from the on-line Internet-Drafts
directories.

This draft is a work item of the Source Address Validation Improvements
Working Group of the IETF.

 

        Title           : SAVI Solution for DHCP

        Authors         : Jun Bi

                          Jianping Wu

                          Guang Yao

                          Fred Baker

         Filename        : draft-ietf-savi-dhcp-21.txt

         Pages           : 43

         Date            : 2014-03-30

 

Abstract:

   This document specifies the procedure for creating a binding between

   a DHCPv4/DHCPv6 assigned IP address and a binding anchor on a SAVI

   (Source Address Validation Improvements) device.  The bindings set up

   by this procedure can be used to filter out packets with forged

   source IP address in DHCP scenario.  This mechanism is proposed as a

   complement to ingress filtering to provide finer-grained source IP

   address validation.

 

 

The IETF datatracker status page for this draft is:

 <https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/>
https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/

 

There's also a htmlized version available at:

 <http://tools.ietf.org/html/draft-ietf-savi-dhcp-21>
http://tools.ietf.org/html/draft-ietf-savi-dhcp-21

 

A diff from the previous version is available at:

 <http://www.ietf.org/rfcdiff?url2=draft-ietf-savi-dhcp-21>
http://www.ietf.org/rfcdiff?url2=draft-ietf-savi-dhcp-21

 

 

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

 

Internet-Drafts are also available by anonymous FTP at:

 <ftp://ftp.ietf.org/internet-drafts/> ftp://ftp.ietf.org/internet-drafts/

 

_______________________________________________

savi mailing list

 <mailto:savi@ietf.org> savi@ietf.org

 <https://www.ietf.org/mailman/listinfo/savi>
https://www.ietf.org/mailman/listinfo/savi

 


------=_NextPart_001_0028_01CF4FF3.6D3300A0
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 =
(filtered medium)"><!--[if !mso]><style>v\:* =
{behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	text-align:justify;
	font-size:10.5pt;
	font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
	{mso-style-priority:99;
	mso-style-link:"\7EAF\6587\672C Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:10.5pt;
	font-family:"Calibri","sans-serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
	{mso-style-priority:99;
	mso-style-link:"\6279\6CE8\6846\6587\672C Char";
	margin:0cm;
	margin-bottom:.0001pt;
	text-align:justify;
	font-size:9.0pt;
	font-family:"Calibri","sans-serif";}
span.Char
	{mso-style-name:"\7EAF\6587\672C Char";
	mso-style-priority:99;
	mso-style-link:\7EAF\6587\672C;
	font-family:"Calibri","sans-serif";}
span.Char0
	{mso-style-name:"\6279\6CE8\6846\6587\672C Char";
	mso-style-priority:99;
	mso-style-link:\6279\6CE8\6846\6587\672C;}
span.EmailStyle21
	{mso-style-type:personal;}
span.EmailStyle22
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue =
vlink=3Dpurple style=3D'text-justify-trim:punctuation'><div =
class=3DWordSection1><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'>Dear =
Leaf,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>Thank =
you for these advanced comments. Our responses are&nbsp; as =
follows:<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'>1.<o:p></o:p></span></p><p =
class=3DMsoPlainText>Guang - R19: We found there is no direct link =
between SAVI devices, thus we add a new link to illustrate this =
situation.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>I =
guess we could live with the case of 'no direct link between SAVI =
devices', just because the connection (i.e. Non-SAVI device) between =
them are in the perimeter. <o:p></o:p></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>Guang: =
You are right such a link is not necessary for real cases. But we think =
it will be weird if we state &#8220;trust&#8221; is mainly used between =
direct connected SAVI devices, but there is no such a case in the =
diagram.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>2. =
<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText>Guang - R20: Since DHCP relay and server are only =
supposed to send DHCP messages, data packets are not expected from them. =
If they also send data packet, their roles are changed. How to process =
the data packet depends on the the role which sends the data =
packet.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>DHCP =
messages is only a kind of control plane packet. <o:p></o:p></p><p =
class=3DMsoPlainText>DHCP-Trust Attribute sounds only deactivate the =
blocking against the message from server/relay.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>If you =
let the data packet pass, then you will get a more flexible application =
case as follows within the perimeter:<o:p></o:p></p><p =
class=3DMsoPlainText><img width=3D403 height=3D218 id=3D"_x0000_i1026" =
src=3D"cid:image001.png@01CF4FF1.16B3F9C0"><o:p></o:p></p><p =
class=3DMsoPlainText>Right? I can&#8217;t see the negative effect yet =
when you let the data packet pass through the trust port of =
SAVI-switch.<o:p></o:p></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>Guang: =
Indeed, if only DHCP-trust if configured, the data packet will be =
forwarded without checking. This point is specified in the doc. Thus, =
the current design can survived in your case. However, this case is not =
secure; thus, it is not a suggested deployment case. =
<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><img width=3D484 height=3D236 =
id=3D"_x56fe__x7247__x0020_1" =
src=3D"cid:image002.png@01CF4FF3.6CE94D70"></span><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>Best =
regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'>Guang<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><div=
><div style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt =
0cm 0cm 0cm'><p class=3DMsoNormal align=3Dleft =
style=3D'text-align:left'><b><span =
style=3D'font-size:11.0pt'>From:</span></b><span =
style=3D'font-size:11.0pt'> Leaf Yeh [mailto:leaf.yeh.sdo@gmail.com] =
<br><b>Sent:</b> Tuesday, April 01, 2014 5:23 PM<br><b>To:</b> 'Guang =
Yao'<br><b>Cc:</b> savi@ietf.org; 'Jun Bi'; 'Ted =
Lemon'<br><b>Subject:</b> RE: [savi] I-D Action: =
draft-ietf-savi-dhcp-21.txt<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal align=3Dleft =
style=3D'text-align:left'><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang - R19: We found there is no direct link =
between SAVI devices, thus we add a new link to illustrate this =
situation.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>I =
guess we could live with the case of 'no direct link between SAVI =
devices', just because the connection (i.e. Non-SAVI device) between =
them are in the perimeter. <o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Guang =
- R20: Since DHCP relay and server are only supposed to send DHCP =
messages, data packets are not expected from them. If they also send =
data packet, their roles are changed. How to process the data packet =
depends on the the role which sends the data packet.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>DHCP =
messages is only a kind of control plane packet. <o:p></o:p></p><p =
class=3DMsoPlainText>DHCP-Trust Attribute sounds only deactivate the =
blocking against the message from server/relay.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>If you =
let the data packet pass, then you will get a more flexible application =
case as follows within the perimeter:<o:p></o:p></p><p =
class=3DMsoPlainText><img width=3D403 height=3D218 =
id=3D"_x56fe__x7247__x0020_3" =
src=3D"cid:image001.png@01CF4FF1.16B3F9C0"><o:p></o:p></p><p =
class=3DMsoPlainText>Right? I can&#8217;t see the negative effect yet =
when you let the data packet pass through the trust port of =
SAVI-switch.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Best =
Regards,<o:p></o:p></p><p class=3DMsoPlainText>Leaf<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>-----Original Message-----<br>From: Guang Yao [<a =
href=3D"mailto:yaoguang@cernet.edu.cn">mailto:yaoguang@cernet.edu.cn</a>]=
 <br>Sent: Tuesday, April 01, 2014 3:28 PM<br>To: 'Leaf Yeh'<br>Cc: <a =
href=3D"mailto:savi@ietf.org">savi@ietf.org</a>; 'Jun Bi'; 'Ted =
Lemon'<br>Subject: RE: [savi] I-D Action: =
draft-ietf-savi-dhcp-21.txt<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Hi =
Leaf,<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Thank you very much for these comments! The replies =
are as follows.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>1. =
Q19. I am not sure the reason why there is a new link between SAVI =
Device C to SAVI Device B in Fig.1. The relation between the SAVI Device =
A and the SAVI Device B looks more like the case described in the Fig.1 =
of SAVI arch.<o:p></o:p></p><p =
class=3DMsoPlainText>(RFC7039).<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>R19:<o:p></o:p></p><p class=3DMsoPlainText>We found =
there is no direct link between SAVI devices, thus we add a new link to =
illustrate this situation.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>2. =
Q20. As to DHCP-Trust Attribute,<o:p></o:p></p><p =
class=3DMsoPlainText>in section 4.2.2, &lt;quote&gt;<o:p></o:p></p><p =
class=3DMsoPlainText>The &quot;DHCP-Trust Attribute&quot; indicates the =
DHCP Server-Client messages<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp; from the corresponding attachment is =
trustable.<o:p></o:p></p><p class=3DMsoPlainText>...<o:p></o:p></p><p =
class=3DMsoPlainText>&lt;/quote&gt;<o:p></o:p></p><p =
class=3DMsoPlainText>, in section 4.3.2 &lt;quote&gt;<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp; (5)&nbsp; Configure DHCP-Trust =
attribute on the direct attachments of<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; trusted =
DHCP relays/servers.<o:p></o:p></p><p =
class=3DMsoPlainText>...<o:p></o:p></p><p =
class=3DMsoPlainText>DHCP-Trust<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp;attribute is only configured on the =
inside links of the perimeter.<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp; Only DHCP server-client messages =
originated in the perimeter is<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp; trusted.<o:p></o:p></p><p =
class=3DMsoPlainText>&lt;/quote&gt;<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>When =
the port of SAVI-switch connected to the trusted DHCP relays/servers (in =
the SAVI-perimeter) is configured DHCP-Trust attribute, how about the =
data packet forwarding when it is received on this port? I guess the =
switch will forward the packet as the normal without checking, right? =
May you need a statement on this case in section 8.1?<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>R20:<o:p></o:p></p><p class=3DMsoPlainText>Thank =
you for this comment. <o:p></o:p></p><p class=3DMsoPlainText>Since DHCP =
relay and server are only supposed to send DHCP messages, data packets =
are not expected from them. If they also send data packet, their roles =
are changed. How to process the data packet depends on the the role =
which sends the data packet.<o:p></o:p></p><p class=3DMsoPlainText>We =
will specify this point in the revision.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>-----Original Message-----<o:p></o:p></p><p =
class=3DMsoPlainText>From: Leaf Yeh [<a =
href=3D"mailto:leaf.yeh.sdo@gmail.com"><span =
style=3D'color:windowtext;text-decoration:none'>mailto:leaf.yeh.sdo@gmail=
.com</span></a>]<o:p></o:p></p><p class=3DMsoPlainText>Sent: Tuesday, =
April 01, 2014 9:51 AM<o:p></o:p></p><p class=3DMsoPlainText>To: 'Guang =
Yao'<o:p></o:p></p><p class=3DMsoPlainText>Cc: <a =
href=3D"mailto:savi@ietf.org"><span =
style=3D'color:windowtext;text-decoration:none'>savi@ietf.org</span></a>;=
 'Jun Bi'; 'Ted Lemon'<o:p></o:p></p><p class=3DMsoPlainText>Subject: =
RE: [savi] I-D Action: draft-ietf-savi-dhcp-21.txt<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Hi =
Guang,<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Q19. I am not sure the reason why there is a new =
link between SAVI Device C to SAVI Device B in Fig.1. The relation =
between the SAVI Device A and the SAVI Device B looks more like the case =
described in the Fig.1 of SAVI arch.<o:p></o:p></p><p =
class=3DMsoPlainText>(RFC7039).<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Q20. =
As to DHCP-Trust Attribute,<o:p></o:p></p><p class=3DMsoPlainText>in =
section 4.2.2, &lt;quote&gt;<o:p></o:p></p><p class=3DMsoPlainText>The =
&quot;DHCP-Trust Attribute&quot; indicates the DHCP Server-Client =
messages<o:p></o:p></p><p class=3DMsoPlainText>&nbsp;&nbsp; from the =
corresponding attachment is trustable.<o:p></o:p></p><p =
class=3DMsoPlainText>...<o:p></o:p></p><p =
class=3DMsoPlainText>&lt;/quote&gt;<o:p></o:p></p><p =
class=3DMsoPlainText>, in section 4.3.2 &lt;quote&gt;<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp;(5)&nbsp; Configure DHCP-Trust =
attribute on the direct attachments of<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; trusted =
DHCP relays/servers.<o:p></o:p></p><p =
class=3DMsoPlainText>...<o:p></o:p></p><p =
class=3DMsoPlainText>DHCP-Trust<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp; attribute is only configured on the =
inside links of the perimeter.<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp; Only DHCP server-client messages =
originated in the perimeter is<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp; trusted.<o:p></o:p></p><p =
class=3DMsoPlainText>&lt;/quote&gt;<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>When =
the port of SAVI-switch connected to the trusted DHCP relays/servers (in =
the SAVI-perimeter) is configured DHCP-Trust attribute, how about the =
data packet forwarding when it is received on this port? I guess the =
switch will forward the packet as the normal without checking, right? =
May you need a statement on this case in section 8.1?<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Best =
Regards,<o:p></o:p></p><p class=3DMsoPlainText>Leaf<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>-----Original Message-----<o:p></o:p></p><p =
class=3DMsoPlainText>From: savi [<a =
href=3D"mailto:savi-bounces@ietf.org"><span =
style=3D'color:windowtext;text-decoration:none'>mailto:savi-bounces@ietf.=
org</span></a>] On Behalf Of <a =
href=3D"mailto:internet-drafts@ietf.org"><span =
style=3D'color:windowtext;text-decoration:none'>internet-drafts@ietf.org<=
/span></a><o:p></o:p></p><p class=3DMsoPlainText>Sent: Monday, March 31, =
2014 1:49 PM<o:p></o:p></p><p class=3DMsoPlainText>To: <a =
href=3D"mailto:i-d-announce@ietf.org"><span =
style=3D'color:windowtext;text-decoration:none'>i-d-announce@ietf.org</sp=
an></a><o:p></o:p></p><p class=3DMsoPlainText>Cc: <a =
href=3D"mailto:savi@ietf.org"><span =
style=3D'color:windowtext;text-decoration:none'>savi@ietf.org</span></a><=
o:p></o:p></p><p class=3DMsoPlainText>Subject: [savi] I-D Action: =
draft-ietf-savi-dhcp-21.txt<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>A New =
Internet-Draft is available from the on-line Internet-Drafts =
directories.<o:p></o:p></p><p class=3DMsoPlainText>This draft is a work =
item of the Source Address Validation Improvements Working Group of the =
IETF.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
Title&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : SAVI =
Solution for DHCP<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
Authors&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : Jun =
Bi<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp; Jianping Wu<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp; Guang Yao<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp; Fred Baker<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
Filename&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : =
draft-ietf-savi-dhcp-21.txt<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
Pages&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : =
43<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
Date&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : =
2014-03-30<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Abstract:<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp; This document specifies the procedure =
for creating a binding between<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp; a DHCPv4/DHCPv6 assigned IP address =
and a binding anchor on a SAVI<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp; (Source Address Validation =
Improvements) device.&nbsp; The bindings set up<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp; by this procedure can be used to =
filter out packets with forged<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp; source IP address in DHCP =
scenario.&nbsp; This mechanism is proposed as a<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp; complement to ingress filtering to =
provide finer-grained source IP<o:p></o:p></p><p =
class=3DMsoPlainText>&nbsp;&nbsp; address validation.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>The =
IETF datatracker status page for this draft is:<o:p></o:p></p><p =
class=3DMsoPlainText><a =
href=3D"https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/"><span =
style=3D'color:windowtext;text-decoration:none'>https://datatracker.ietf.=
org/doc/draft-ietf-savi-dhcp/</span></a><o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>There's also a htmlized version available =
at:<o:p></o:p></p><p class=3DMsoPlainText><a =
href=3D"http://tools.ietf.org/html/draft-ietf-savi-dhcp-21"><span =
style=3D'color:windowtext;text-decoration:none'>http://tools.ietf.org/htm=
l/draft-ietf-savi-dhcp-21</span></a><o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>A diff =
from the previous version is available at:<o:p></o:p></p><p =
class=3DMsoPlainText><a =
href=3D"http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-savi-dhcp-21"><span=
 =
style=3D'color:windowtext;text-decoration:none'>http://www.ietf.org/rfcdi=
ff?url2=3Ddraft-ietf-savi-dhcp-21</span></a><o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Please =
note that it may take a couple of minutes from the time of submission =
until the htmlized version and diff are available at =
tools.ietf.org.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Internet-Drafts are also available by anonymous FTP =
at:<o:p></o:p></p><p class=3DMsoPlainText><a =
href=3D"ftp://ftp.ietf.org/internet-drafts/"><span =
style=3D'color:windowtext;text-decoration:none'>ftp://ftp.ietf.org/intern=
et-drafts/</span></a><o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>_______________________________________________<o:p>=
</o:p></p><p class=3DMsoPlainText>savi mailing list<o:p></o:p></p><p =
class=3DMsoPlainText><a href=3D"mailto:savi@ietf.org"><span =
style=3D'color:windowtext;text-decoration:none'>savi@ietf.org</span></a><=
o:p></o:p></p><p class=3DMsoPlainText><a =
href=3D"https://www.ietf.org/mailman/listinfo/savi"><span =
style=3D'color:windowtext;text-decoration:none'>https://www.ietf.org/mail=
man/listinfo/savi</span></a><o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p></div></body></html>
------=_NextPart_001_0028_01CF4FF3.6D3300A0--

------=_NextPart_000_0027_01CF4FF3.6D3300A0
Content-Type: image/png;
	name="image001.png"
Content-Transfer-Encoding: base64
Content-ID: <image001.png@01CF4FF1.16B3F9C0>

iVBORw0KGgoAAAANSUhEUgAAAZMAAADaCAIAAADsXjgmAAAAAXNSR0IArs4c6QAAESBJREFUeF7t
nbt62k4Th5XvWnCK/8MV4CuANKlo3UEJjbuU6dJAaXdpqdIErsC+Aj8pAvfCtzofOK2k0aDdvDS2
hDQz+87qp5FkjT8dj8eADwQgAAGnCPzPqWgJFgIQgEBIAOViHkAAAu4RQLncyxkRQwACKBdzAAIQ
cI8AyuVezogYAhBAuZgDEICAewRQLvdyRsQQgADKxRyAAATcI4ByuZezUsS7+eP64PgYugwfPl3S
vaNtlOuO8HENAQg0JIByNQTHbhCAwD0JmPcW+bhHYL8ancya2daMYzurro9W/2vrL/JxL9VEfJbA
J964vud5o71vcx/n7/PbYtDekp8W4ONnXnlv0dO8MiwI+E2A+1x+55fRQcBPAlwt+plXRgUBvwlQ
c/mdX0YHAT8JoFx+5pVRQcBvAiiX3/lldBDwkwDK5WdeGRUE/CaAcvmdX0YHAT8JoFx+5pVRQcBv
AiiX3/lldBDwkwDK5XZeD+tHutxcSSF83J7fl6NHuXzNLOOCgM8EUC6fs8vYIOArAZTL18wyLgj4
TADl8jm7jA0CvhJAuXzNLOOCgM8EUC6fs8vYIOArAZTL18wyLgj4TADl8jm7jA0CvhJAuXzNLOOC
gM8E6Inqc3YZGwR8JUDN5WtmGRcEfCaAcvmcXcYGAV8JoFy+ZpZxQcBnAiiXz9llbBDwlQDK5Wtm
GRcEfCaAcrmd3a76T+3mn4qfx7WjmLri4ygOj8JGuTxKpuBQxi/71Wi02h+jz3a4bNO/cP043wnG
hikIBAHKxSy4TWD8vAr+7LPt1o9ZPZZIkiltzKp4IS7XEqWLvli+v07SPXINi/eJP4WaLl5rdk+/
R/VuJ+gf3ALl+geTXnvI66fl8Os43s0oy2aa1GLHbTCJRGeweDM1WrzB+MUUabPEh/nieFyNZtu4
eDseXxIzwfopN7OfbjLxCnfYzt6XDw+baVTvBb8o2GpnzP8dUC7/c9x4hEY+4pLIaEyiOIf1Zrh9
WwwSm+OX7XCzPtT3YOy8Z+Y/PSzfg/c/RYEKL1TfFrEQZmJX3w17eEsA5fI2te0HltznCiugH8J1
z+DzcLRK67BKNdY+cCz4TwDl8j/HbUcY3q3/mMS3mwaL6cf3QpG1+/UxzSqwj79R9WVuUE1ey06T
b6J7YLGh8dd2d/3bDor9XSdQPu+x5BiB4hNAydCzG1VpZRTexYp/z25oRVM/v4OVrx+tVuF9ruzR
ZH7bq7C5sZTeGYuPodhS5jg5sHL7jYbXFZ9GwbCTIAF6Rbh96jH1zVPwM7/x5PZo5KOHjzzTfljk
arEfeSAKCECgDgFqrjq02BYCEOgHAWqufuSBKCAAgToEUK46tNgWAhDoBwGUqx95IAoIQKAOAZSr
Di22hQAE+kEA5epHHogCAhCoQwDlqkOrf9vSf+p6TuDTvzkrExHKJcMRKxCAgCYBlEuTNr4gAAEZ
AiiXDEesQAACmgRQLk3a+IIABGQIoFwyHLECAQhoEkC5NGnjCwIQkCGAcslwxAoEIKBJAOXSpI0v
CEBAhgDKJcMRKxCAgCYB+nNp0sYXBCAgQ4CaS4YjViAAAU0CKJcmbXxBAAIyBFAuGY5YgQAENAmg
XJq08QUBCMgQQLlkOGIFAhDQJIByadLGFwQgIEMA5ZLheDcru/nj+nA376eOiadHyfA5FJTL5+wy
Ngj4SgDl8jWzjAsCXhM48nGRwH41OpmWs60ZyXZWXR+t7nq9M/G4mGxiPkOAt38cPy+Z+0p/n98W
g74Mg3j6kgnP4+Bq0fMEMzwIeEkA5fIyrQwKAp4T4GrR8wQzPAh4SYCay8u0MigIeE4A5fI8wQwP
Al4SQLm8TCuDgoDnBFAuzxPM8CDgJQGUy8u0MigIeE4A5fI8wQwPAl4SQLm8TCuDgoDnBFAuzxOs
PLzD+rFfXXeUx487LQIolxZp/EAAAnIEUC45lliCAAS0CKBcWqTxAwEIyBFAueRYYgkCENAigHJp
kcYPBCAgRwDlkmOJJQhAQIsAyqVFGj8QgIAcAZRLjiWWIAABLQIolxZp/EAAAnIE6IkqxxJLEICA
FgFqLi3S+IEABOQIoFxyLLEEAQhoEUC5tEjjBwIQkCOAcsmxxBIEIKBFAOXSIo0fCEBAjgDKJccS
S0FAfy5mgQ4BlEuHM14gAAFJAiiXJE1sQQACOgRQLh3OeIEABCQJoFySNLEFAQjoEEC5dDjjBQIQ
kCSAcknSxBYEIKBDAOXS4YwXCEBAkgDKJUkTWxCAgA4BlEuHM14gAAFJAvTnkqSJLQhAQIcANZcO
Z7xAAAKSBFAuSZrYggAEdAigXDqc8QIBCEgSQLkkaWILAhDQIYBy6XDGCwQgIEkA5ZKkiS36czEH
dAigXDqc8QIBCEgSQLkkaWILAhDQIYBy6XDGCwQgIEkA5ZKkiS0IQECHAMqlwxkvEICAJAGUS5Im
tiAAAR0CKJcOZ7xAAAKSBFAuSZrYggAEdAigXDqc8QIBCEgSoD+XJE1sQQACOgSouXQ44wUCEJAk
gHJJ0sQWBCCgQwDl0uGMFwhAQJIAyiVJE1sQgIAOAZRLhzNeIAABSQIolyRNbEEAAjoETpRrN39c
H3R899qLKxz6FifxNJvWfePWbBTt97LmQM3VHjYWIAABbQIolzZx/EEAAgIEjvFnvxqdGJttzRfb
WXV9tNrX9Rc5JJz68qNv+XImnr4kkOMu1ZVIT+ofd0E1k9vZaLXvWXrvEY4rHPoWJ/E0m61949Zs
FO33subA1aJA3YoJCEBAmQDKpQwcdxCAgAABekUIQMQEBCCgTICaSxk47iAAAQECKJcARExAAALK
BFAuZeC4gwAEBAigXAIQMQEBCCgTQLmUgeMOAhAQIIByCUDEBAQgoEwA5VIGjjsIQECAQFW5DutH
+y4368dPyWc+N81xonB283Tdp2RNEBij6XY7s0m+GLoq7BBtNA83ufunFoc7RmsZZww5zmwRv2zk
PZwPlnxkOTSwZhtnnrz4iEqPlvQoCpeLv1eOSTMD1o/xPnmyIkP2R32D0dnvYsvBWKy8aWTefLR8
b7G4Zfha9miVm4q+K7+BFC4Vfa1G8Zvb+Zunln7bvxplY8Geg4217raxj9MkYJQxj3aTjaqf88Ge
jyyNutZqxGkOtuzQCQ+8ZMFYyI+owjaFTZL3mtPNioaO1sd93ZHV296eg8zV4vjleHxbZMp6+L0Z
fluMvw43v7MmhWZpmZdTu/lm+jy2l2K2lCAwnQaTcyVt4fSbfB2f2k0lnRXVtSph5oNEuixsjF/2
q4/vV1qBHtbfg+3xJTnUBos3IyTpUsn+l2nwZ2/hsTebNFcuQ2G6eUhmdnZhGA3MCNdXwyqSrmyk
4+fVx69k/u9+fUy/DHoD4Z8J5MvLNqjOc6NRm2naHWQbTKJUmuSas9/rq5n14efG4RHxYz7cZRoN
Pg/fU8l5naQnmsnr6L+HMJ79nyD+5dbn98Zyw1uGtL5vrlwmwkjBo5k93eR3tXbzZSRckXQV6qzB
YhqfHsx54GO6QLi0clz0M36ebp7iO5LR57DeDLdvWTLGL9vhJjuFz7bJ6dkcHjbBMh9sKHW3Telq
0cpNrnWb6U+3DslWypXBGSy+zd7/xAXV7tdrkAKZmF/TOitUum/h9WN8LWkFlo3ECQwWP6ebeV4K
izsIDTIfOsF6zujh70dSXp11+fBfULjuOdkk17r87KUWejtHjZXLPMAoPI4w/GZxnWUuBMt34rNL
RPNlWIQ9PKQlWbvI2bshASMrwXL5Hu+dFcKJsfA6vtG5l/nQMB3tdtv9WJoy4PL1i0n2cFk4UMPn
jv14et9u3Gbvps8WK12eoweDeUvW+Dlhtk3+2PD02UG1XXTpkWO9BxOCW9s/4xB02sCUZZzVTJjl
7NliuZFujD9bFy6mO199+NvT+WDJpwF52V1s4zzpemyTr2Kn9uzwKqzs0VN9Ww7HY7U/l3mo9BT8
dK50bC3gVQOucHAlTvEEWRp0hY8rcVpib7yZPYfGV4uNY2NHCEAAAm0J0BO1LUH2hwAE9AlQc+kz
xyMEINCWAMrVliD7QwAC+gRQLn3meIQABNoSQLnaEmR/CEBAnwDKpc8cjxCAQFsCTftzXeoT1DSe
8p9gN7VyZr9z/cIEzbtiypl8hUC76yDmSrouxlnpZlfudHB2rwxmTzpwXU+BfX+upjWX6QxQ6hMU
TNq9VGD6onTz569hw5XwT8JNv7DCu8S3Z/DOtErMWvTc3vxuW1jG6Uy+wr54D5tp9iZ/2yxY8rlb
/lLHlnGGbW3yDnrb0ps958cQd7Y5+dv7uw+4bQBNlavit9gnqHh6T88J2ami1AU1+vbKOSE/wTyu
816t5+zfEPIz/cLagnN7/x7nq9Lby23OHUdvOkflXbXqHhelq5H0JJ0YSc4X2VLH42hiXki5zKu7
aZ+g9VPe7inrfmOmY3yuCAsrsxDXa1EzwkvnBAN2krSHCrvopK8IB2ftXx/62X5hTWh5tE+f85U1
JDbFVzeVuCeJXD/l3QvqHxdfs6bEptFe8hp2VJuPVknHG7MUdlotNA3tEbimb1xHL+IW346OF89U
pcXWs8nvp61jT960rHZ/TjuBFd8ejTHeekW73Nn2xtbnqupol+qL4anfO62/GOflF4FdyVdhBNGL
4WnXw1qvOPubx+LISp0MqqJyq1v6uTftY8Z5X+hyR/ZaGWi2sf0b1417RVSVK3V5QXHiBoQxksoh
lH5VnqOX7FyzfxZWw14U6jlrlmkD0/bYLmPvbb7KHGqnu4rRnk/DBAjtZh1nfmwXO8xH8+BKKGcq
g8JJodTDPjpNx5Oq8s8ihIZ6zYy9ckldLWZ9gsIWXJfuqoadob6vTUfU1e0e9BU7WV+ha/bPlbJX
+4X1qPZVDqW3+Qr/J03WQGo3n7wOPyujccZddLMy/ccCNY+LsCFh2ojtYC46k3ZtydjHL9PNj13P
/1lEw6vFC32C0mqzmP1q1Vq+vLt0tRVXrbmdopXyFePl6z+LfmEX9d/6HKhwIrrmwjJOJ/KVjLMw
Jdr/gyJLPnfOYl7m3Aik0GgtP9ZSSueOi4vHV2FGjGaz8EgrHUilgk6Pjn3NRX8uZ06xBAoBPQLm
rzT+Pus/HqE/l16K8QQBnwgkfywxeX1fpg8cezk8+nP1Mi0EBQEIXCUgdYcezBCAAAT0CKBceqzx
BAEISBFAuaRIYgcCENAjgHLpscYTBCAgRQDlkiKJHQhAQI9A0/5cehHex5N9n6D7xJd6dSXOe1Fy
hY8rcXadR3sO1Fxd5wL7EICAPAGUS54pFiEAga4JoFxdE8Y+BCAgTwDlkmeKRQhAoGsCKFfXhLEP
AQjIE0C55JliEQIQ6JoAytU1YexDAALyBFAueaZYhAAEuiaAcnVNGPsQgIA8AfpzyTPFIgQg0DUB
aq6uCWMfAhCQJ4ByyTPFIgQg0DUBlKtrwtiHAATkCaBc8kyxCAEIdE0A5eqaMPYhAAF5AiiXPFMs
QqAuAfu+VHUt+7r9iXKZ/xC5Pvg62hrjcoWDK3HWQC+6KXxEcXZuzDpf1Fyd5wIHEICAOAGUSxwp
BiEAge4JHOPPfjU68TXbmi+2s+r6aLWv6y9ySDj15Qf5Cq7OQ1fymM4nE+9otS/MLo67JMGXjrig
+sV2VibYl0NVOw5XOLgSp3b+Un+O8DlRrnvxurdf63xxtdh9WYsHCEBAmgDKJU0UexCAQPcE6BXR
PWM8QOAWAfP3XE/Bz7fF4NaGfJ8QoOZiKkAAAu4RoOZyL2dEDAEIUHMxByAAAfcIoFzu5YyIIQAB
lIs5AAEIuEcA5XIvZ0QMAQigXMwBCEDAPQIol3s5I2IIQADlYg5AAALuEfg/yj9sPL+YhQ4AAAAA
SUVORK5CYII=

------=_NextPart_000_0027_01CF4FF3.6D3300A0
Content-Type: image/png;
	name="image002.png"
Content-Transfer-Encoding: base64
Content-ID: <image002.png@01CF4FF3.6CE94D70>

iVBORw0KGgoAAAANSUhEUgAAAeQAAADsCAIAAAAq6EJ3AAAAAXNSR0IArs4c6QAAAAlwSFlzAAAO
wwAADsQBiC4+owAAGSNJREFUeF7t3c9rG9fawPHJjyvSNLSQ9ZtFXCtcivAfYC8KuW0utuElzULb
EAhWN8F+bwneeOlNKH2vRTavTSBkq0UaCra4aW4gi+QPCKJcLMdZZP0GUvy2wdeJ3zO/Z2RJ8+uc
mTnjryk0kmaeOfN5Zh4dHY3OnDg8PDT4QwABBBAot8DJcjeP1iGAAAIImAIUa44DBBBAQAMBirUG
SaKJCCCAAMWaYwABBBDQQIBirUGSaCICCCBAseYYQAABBDQQoFhrkCSaiAACCFCsOQYQQAABDQQo
1hokaVwTu62Z9o7m+6Cy+fio1CV2ngIU6zy12RYCCCCQUoBinRKO1RBAAIE8BSjWeWrL29ZOe+aE
9Te38WKpbv+z1RXxuy37gf9nPX3cnh/pIy8FREIgX4ETTOSUL7jsrYkx2e3bzxcnZcetSjx8qpJJ
9oOeNccAAgggoIEAxVqDJNFEBBBAgGEQjgEEEEBAAwF61hokiSYigAACFGuOAQQQQEADAYq1Bkmi
iQgggABj1hwDCOQt8PZCPe9Nsr3RAuff9LXgoWetRZpoJAIIHHcBivVxPwLYfwQQ0EKAYRAt0kQj
KyXgDYOM+QC+/31971/Ln2/ePFWmXf+w/u271V6gRY2zz346M+E/YS1w6dybO7VQs5/uXWh9XHn8
Weti4GnzyX33ce1+/9zX5oPBTUypQoiThTLZc3fzUmUjeWPEHBhMkTqGDZ/kx1TUGqJ6vumLtxnz
v2fz+1/V337/NGqdwddFRX57oWXcd+O86de6377fdRfzN/H4rHHn3fy9D0k3UMXlGQapYlbZJwTy
EZi4+dmb9Vqn9dv66wQbfLL8btU4+8zpStsr1n4M9dDdaBfP3F0+/fLOH08ShK/qohTrqmaW/aqE
wO693y7UxQd287+BDmzwpQv1vYFy9mTZWetC/bf1p+/nvdXF4IN4xq+tYrzlrd91NV+1VxwMOJLz
8icrjYPV//EGNKLcX7//+8PTK/8dHDwZt8rEBEXK9sEh6tDidQSKEnh5590t41NnwGH5dLADK2rx
V3dOesMIz5Y/3vBLsDnIcOOhGAW2ByvObLd+fxlnH5yRZXut2qu4gw+nvpk/bWx/9AYxxm9q95/7
L42TXwQHr8eusLv70WicDgyLx9mTSi5Dsa5kWtmpaghcO+d9wThx81O/A/t074bonD62v5Ez/8Kv
/rHaC75a+/Hx2akYIGZZ9MtorZXou83egV+sH3rdc7d373+RaLUjfvF9uvfVnYPmrbjd8Bh7qe8i
FGt9c0fLqy4wVQ9eCnLqi0uG3YENV1VbYfyrsaQm/lKbMvZvBEdFYq13pP5eO+d9A+n8Yz18cUhU
WPGRwhmNMa8hOf/j5agVjsXrFOtjkWZ2EoEYAhfPbIoLPMwv9MxaGfsajA+/bB4Yl07GHKkwx6B7
+7+M/UIycMFJ+Gq/GDtR3UUo1tXNLXumu8DLfvCStf3uQ2Nq/k+iJlrfuX18Fap3H15tG3bFHPLq
6wN/zPri6SnjYHt0rTQv8Oifv3/NiHsNxlNr1OW72H3ny7WmkeQLSd2zKK39FGtplARCQLbAwz3v
CpAny3sdo/Zf9jiyfQHGFf+CDfNiuF7tvv1TFLsa/s27bHn/++CQ8cWTfzaMzj+cizessM7f7r29
0BV4MUaWzWtOWvvN9UT9X2sMXYxrBy6sNl6/nw8+lA1ZiXgU60qkkZ2opMDU8rlLd53v6KyrO7xv
FE+1fhKdX3N82R7bvbEdvGy59mP/XLP3u/i5ivXq/mzoC0a3Vlqvdv96runaTdysbV8JBBx64bMh
etzugLLYrmEOTyceUzbHWz5fMbwWvr3wN+PuiM1VMrOpdoqfm6diYyUEMgjk/kNn0W+98vuf15NX
1Qw7WfpVc89CVhF61lkFWR+BsgtYlzbXZrmmouyJGt8+irXe+aP1CBwVED+KCfxG0bpUeWr5E++i
bMj0FGAYRM+80WqdBXL4AG5O2ud9c9hkAGTI4ZJDFuQepBRruZ5EQyBaQLsyEb1LGi6hXRYYBtHw
KKPJCCBw/AQo1nrnXNV8zd3WieDfTFtTJlU+mnLQbJ0FGAbROXuGIYrRdePB88VJ6bsRjCxK9+qX
/dRbac+0Lj1fn5XexLEBdbkprS53a803e3lsjWGQPJTZRs4Cs7fXjF/9O0C3Z7xed6trNUVUdvGU
/cDulDv3r7FeWHqxMeeu4azgrWM/H+i528HF6nZMN2rOe8zmECidAMMgpUtJCRvUvr7UuOr0jEUJ
7TT7h/bfljFn1dnJxef9tWm75bPr4vkFZy/EC4eHa9MLW84Kh14Hu33dD9Nvdrx6ba6wtfBiqV7v
NO1NPLLfEPhD4JgLuCcR/9dSQJTI6TW3dErdA6/4ihPE34R41i+8Vi1dcF4MveI9azVpcB3xVDC6
cwYG4oZXz7Jb6nyytOp//2PS/i9LENbNKKBdFuhZH/M363G775Rhs5/7g+Te7eSlxvRa+GTLe1Cb
xCOglwDFWq98FdHa2fX+Wm/OHmyeXGz2Vts7XjO6j3pN79vN3rb1ghhsntsIN9R5xRrPtgPNXm0s
cV/2ItLJNnUVoFjrmjm17e626ksvxMCxPZQsRp5Fubb/vfig2al7XzDOGSuLdksm55uGWF78icHm
NXPQ2avFiysN+5UTc8aWO2othraDgUJfT85tmJvm60W1OSa6ZgJcuqdZwgaaq+7SPb1d3NaX00e7
i8aqcTAM7IV2WaBnXcnjkJ1CAIGqCdCzrlpG2Z/yC2jXpys/aYoWapcFetYpsswqCCCAQN4CFOu8
xdkeAvEEnu7Zt+y6UPfvtSjW3L33m/t88AbkYk5U8XB//Vtzlfl7762HofvtBp+JFyS4erw2s5RC
AYq1QlxCI5BWQFTq1seVx2LmEPFf7ZVbdsUNar/arD0znzz/5vFZ4867YEV+eWdv+5b50ubNM7Pi
9uSb/951t7977713v93YQayb8/JXFgGKdVkyQTsQ8AV2dz8axskvLtrP1Fr2Tc1fv/+7uG2ud2PZ
i2fuLp8OVmTj2jnv3rVff3d2qrf/y2s7wodfNg+MazXzZjFJgpCSMglQrMuUDdqCgC0w8ZfalGHe
vDzYcbZupejf0VwMd4j7dRm9A6/7PFUP9IUv/uk/Gwc//9Maynj97597p1e+q4l/JgtCPkokQLEu
UTJSNIX5msejaetz8cxm//wz0XG+884ag/aGj2v37TEQ/79zI26ueOqbebH6H0/sAt2ofeP0082u
euwgKY5JVlEkQLFWBEtYBDILTNz8TBTl+2L02aq5ExPidP34yhnZiI4+cfNM09jvPjXHQJq3zkzY
ffaEQaI3wxI5CVCsc4JmMwgkENi9t7ceLMqN02apvfzJSuNg9Yp/cYi4qOP7p2PC1sTXjJ27//dz
rzZ72V0scZAEzWZRlQIUa5W6xEYgncDEzdr2Ffu6vbc3ts8+c75UPNX66fOVhj9sfcv41PtGceiG
vv5rTQxqG8ufBIZKEgdJtwusJVuAXzDKFs03XjnnvsjXYNzWyumj3W/nypNQiS3RLgv0rCVmn1AI
IICAKgF61qpk84lbzp5jPvseZyvl9NHlZr5xhCuwjC73LKZnXYGDjV1AAIHqC1Csq59j9hABBCog
wDCI3kks58f88pjiU55c0JKMAhTrjICsjgACCOQhwDBIHspsAwEEEMgoQLHOCMjqCCCAQB4CFOs8
lNkGAgggkFGAYp0RkNURQACBPAQo1nkosw0EEEAgowDFOiMgqyOAAAJ5CFCs81BWuI1ua6a9ozB+
0tC0J6kYyyMQT4BiHc+JpRBAAIFCBSjWhfKzcQQQQCCmwCF/Ogr016aPJHhhS+zJ1sLg89bTqp/X
pj06Jps2I2AK8HPzmG9qZV1MjBFv336+OFmW9tGesmSCdlRNgGGQqmWU/UEAgUoKUKwrmVZ2CgEE
qibAMEjVMsr+IIBAJQXoWVcyrewUAghUTYBiXbWMsj8IIFBJAYp1JdPKTiGAQNUEKNZVyyj7gwAC
lRSgWFcyrewUAghUTYBiXbWMsj8IIFBJAYp1JdPKTiGAQNUEKNZVy2ix+7PTninXlK3FcrB1BOQJ
UKzlWRIJAQQQUCZAsVZGS2AEEEBAngDFWp4lkRBAAAFlAhRrZbQERgABBOQJUKzlWRIJAQQQUCZA
sVZGS2AEEEBAngDFWp4lkRBAAAFlAhRrZbQERgABBOQJUKzlWRIJAQQQUCbAnWKU0RIYAQQQkCdA
z1qeJZEQQAABZQIUa2W0BEYAAQTkCVCs5VkSCQEEEFAmQLFWRktgBBBAQJ4AxVqeJZEQQAABZQIU
a2W0xzIw81kfy7Sz03kIUKzzUGYbCCCAQEYBinVGQFZHAAEE8hCgWOehzDYQQACBjAIU64yArI4A
AgjkIUCxzkOZbSCAAAIZBSjWGQFZHQEEEMhDgGKdhzLbQAABBDIKUKwzArI6AgggkIcAxToPZbaB
AAIIZBRgPuuMgKyOAAII5CFAzzoPZbaBAAIIZBSgWGcEZHUEEEAgDwGKdR7KbAMBBBDIKECxzgjI
6ggggEAeAhTrPJTZBgIIIJBRgGKdEZDVQwLMZ80BgYAiAYq1IljCIoAAAjIFKNYyNYmFAAIIKBKg
WCuCJSwCCCAgU4BiLVOTWAgggIAiAYq1IljCIoAAAjIFKNYyNYmFAAIIKBKgWCuCJSwCCCAgU4Bi
LVOTWAgggIAiAYq1IljCIoAAAjIFmM9apiaxEEAAAUUC9KwVwRIWAQQQkClAsZapSSwEEEBAkQDF
WhEsYRFAAAGZAhRrmZrEQgABBBQJUKwVwRIWAQQQkClAsZapSSwEEEBAkcCRYt1tzbR3FG1Mp7C6
OJStnbQn3VFeNrd0e5F9LRxGG9Kzzn58EQEBBBBQLkCxVk7MBhBAAAEJAof2X39t+kiwhS3xwtbC
4PPW01V9fqSD41SW/5UtX9q0pywJ5Lxz64pVT3Q57wo9fIzBrW8tTK/1C21SOTaui0PZ2kl70h2/
ZXNLtxfZ18JhtCHDIBI+nRACAQQQUC1AsVYtTHwEEEBAggCz7klAJAQCCCCgWoCetWph4iOAAAIS
BCjWEhAJgQACCKgWoFirFiY+AgggIEGAYi0BkRAIIICAagGKtWph4iOAAAISBCjWEhAJgQACCKgW
oFirFiY+AgggIEFgsFjvtGfiT5Hanjnh/LVaYmZVqzndlvvcCecZwxBB3eW6YhH/obmpwArWQi1z
kcL/EjkU2NqY7bSR7cwG+eW2vITHQ0wfuQ4posVtp588+4xyzxb3LDIfB/89cE6KI6A9Y6/jJ8sK
FP+sT7F38VeJ6xA/YpWWHPgluphQJebcIMElzdmeptf8UNZr4V/5m4+C21qbtieE8ie0ibnd7NMP
xIkQ3yFONHXLxG+nSMC0Z26tJrdV5Twe4vvI1UgaLUE7xcnmnTrmiec8EBH8MyqwTGARZ7okd7Fg
oMPY533SPUu2fAKHZIGrsLScYZDZ9cPD54vee9jOZqexsjh7tdHZ9O5jIB4t+Z3mbqvTvD1bpTc9
Hfal2TTmhn1wCXSynJftDpz4vOR9dEr0eYfjIafDYXa9v9ZbHXO3kJ32qrF1uO6capOLz0XRch+F
2jjfNH7t59RqNpNOIH2xFolvdurOyeyNeFitELX6qjg8rGrtNWv29lrvkXPKdx/1mvOT6VrMWukF
5te3jMFTW5TlTtOdZ3HLmLNSKZIr+jgbG+JEN/8iKoLVII6H9HnJsObkpcYLt8puzLnvrXMb01/W
zaj9Xw37H1F/m52YC0YF4nVlAumLtWiS9T5tnczNjj9C3W0tWbXaqtaB3vTkYtPuBIh3+15zkVqt
LKljAs/ebnau298uWH877U5j67mXjNn1rUbH66gtbDmdMFER4jSW4yGOkrplQsMgsTbjl/dO8wGn
ZCyz4hbKVKy9Zk8uriy8+NXuNncfbRjuMTAn/un2ps3ivmIOjNiDJMXt8vHe8uTig2an5X/gUaLB
8aCEdVjQne2e04keusn6l0bg0+2RRfzy7r9h59Z0NpRQIHWxFl85B75AFofMgt2bFiMc4S8SvbEP
8aLZ1a7X3Y53wqayuBwBUUmNpaUXdjDv444T2xygStXD4niQk52EUbo/LImez+hPqSLZjaXAiWpe
KVKO660S7iiLC4G0V4MM3O7LupTDvzePfWWHt4x/ocfRb3sH7xsWukiksO9wdflWOmY7BzMhHntX
g4TvqGTze8+ZD92Vx16uU9LjIaZPYcdZ0quhjtz+Kk6+grfs806vwJMlug5Ll3wVcsAMzmctLgO4
bjzgM5EuDrq0s6iOkS4+urRTdR5xGCOcehhEddaIjwACCCDgC3CnGI4GBBBAQAMBetYaJIkmIoAA
AhRrjgEEEEBAAwGKtQZJookIIIAAxZpjAAEEENBAgGKtQZJoIgIIIJB2PutR8+qmFQ3/AC5tlCHr
DZtfW2J4XUJpky8TVN2M27qka2Q7B2Z/D0+gNnQtD7MkM1aPTwHzWY/xSduzFnOshebVNeay/YpV
TKqp5pc45myd5g/yxPzagSmKok/arribgje/a/TihS0Rs53a5MucOr/eaXoThGXNQkyfwvLnbjhm
O805Uf0Z57dCPyUfvg/2tKhHfvlY+A7TgMQCaYv1wIaC8+oGO3HuO7/XIQjdG8Z6dcw7v9+NmGn7
d7AZFj/i7XrI/NqJpSq1QonzNTAXdqXYZe+MmHbYn4U66XkR+szp9kucIM5bpPdIdsOJl0ZAUrEW
MwK58+q2r/vTI3tTp4oz0O4RmN1n8cDulVv3Kxj1zi+OpTlnOmVzClZ35iFjaPzxuz50fu00WhVa
p8z58u5MJbrYaj5vVSSR7ev+pGjJz4ur3q2axMT0zuxO1iew6TVnulTxyLz/TOC+IhWB03Q30k7k
ZM3vE5x0yX445ONW8B5Ezr+P3kPoyAQug7cBc2fODk5KY5NHzfwUvsVRxNLDPi5aqwzON+Vut6Dn
R7Zz9AwzuuQrsAfWfFPujRESzZ1T3TwG9yw0QdpgAYq6bd6wCbxsY/8GYeFb8yXKQLqFmchpjFvq
WfcGi7WrPKLIOjccsW4TN1A13JfCp+WoOOPiD93PlLP65X6Ypju4BWbcchZmL22+wg6J0z3IGN8n
ZQIkrRa7nX45C95d0ToOxjRlSGco8D4Yun+j1TOxD6qBG6VK2tVxYSjWY3RkDYN48+qaU1aP+lLI
nEl5tS3uE7MWff/FgTjePLzj4g/7cDN2fm1NPw1JaHZp82XeddubcLnbmttoXJKwu5UMYX3x4N5U
M+F5Yd6zwJ24fEeMpjjTmztOs+vNzg9dbpRatsMm5TDIiHl13Y9Rwb0c/DgWHrcYNYxgfxzz4wSj
hIdCRg9sxJhfe+T7WOyeTg7djXGbiNlOLfLl7GfgkMh+C/aYPgVn0e/MRjQkMDG5f665SsPOi5Hn
V+CImF5YMM+00IkU6rbnp0PPeow181mX7d2T9iBQAgFxKeH27fy/3WU+6zG5lzUMUoLDiyYggEBm
AeeKvrmNF0vuJSKZYxJAigDzWUthJAgCCCCgVoCetVpfoiOAAAJSBCjWUhgJggACCKgVoFir9SU6
AgggIEWAYi2FkSAIIICAWgGKtVpfoiOAAAJSBNLOZy1l4yUOosu8urq0s6hU6+KjSztV5xGHMcL0
rFUffsRHAAEEJAhQrCUgEgIBBBBQLUCxVi1MfAQQQECCAMVaAiIhEEAAAdUCFGvVwsRHAAEEJAhQ
rCUgEgIBBBBQLUCxVi1MfAQQQECCAMVaAiIhEEAAAdUCFGvVwsRHAAEEJAgwn7UEREIggAACqgXo
WasWJj4CCCAgQYBiLQGREAgggIBqAYq1amHiI4AAAhIEKNYSEAmBAAIIqBagWKsWJj4CCCAgQYBi
LQGREAhkFGAe54yAx2H1I8W625pp7xyHPY/YR10cdGlnUYcUPkXJp9su+RrtRs863THFWggggECu
AhTrXLnZGAIIIJBS4ND+669NHwmwsCVe2FoYfN56uqrPj3RwnMryP/JljD0OdcmjezyJ9k6v9QNH
F+edk+CynHElaMeRn5uLMaPt288XJ1PW/sqspouDLu0s6sDQxEd8wXjdeMB5Z2iSr0IOZ4ZBCmFn
owgggEAyAYp1Mi+WRgABBAoRYNa9QtjZKAIhAYZBOCAiBehZRxKxAAIIIFC8AD3r4nNACxBAAIFI
AXrWkUQsgAACCBQvQLEuPge0AAEEEIgUoFhHErEAAgggULwAxbr4HNACBBBAIFKAYh1JxAIIIIBA
8QIU6+JzQAsQQACBSAGKdSQRCyCAAALFC1Csi88BLUAAAQQiBSjWkUQsgAACCBQvQLEuPge0AAEE
EIgUoFhHErEAAgggULwAxbr4HNACBBBAIFKAYh1JxAIIIIBA8QIU6+JzQAsQQACBSAGKdSQRCyCA
AALFC1Csi88BLUAAAQQiBSjWkUQsgAACCBQvQLEuPge0AAEEEIgUoFhHErEAAgggULwAxbr4HNAC
BBBAIFKAYh1JxAIIIIBA8QIU6+JzQAsQQACBSAGKdSQRCyCAAALFC1Csi88BLUAAAQQiBSjWkUQs
gAACCBQv8P/wjRY/RRETXAAAAABJRU5ErkJggg==

------=_NextPart_000_0027_01CF4FF3.6D3300A0--




From nobody Fri Apr  4 08:09:27 2014
Return-Path: <yaoguang@cernet.edu.cn>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F2DD1A038D for <savi@ietfa.amsl.com>; Thu,  3 Apr 2014 20:42:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.298
X-Spam-Level: 
X-Spam-Status: No, score=-1.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DC_PNG_UNO_LARGO=0.001, HTML_MESSAGE=0.001, J_CHICKENPOX_15=0.6] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A8MzvSmsXd88 for <savi@ietfa.amsl.com>; Thu,  3 Apr 2014 20:42:49 -0700 (PDT)
Received: from cernet.edu.cn (sea.net.edu.cn [202.112.39.2]) by ietfa.amsl.com (Postfix) with ESMTP id CB43B1A02FE for <savi@ietf.org>; Thu,  3 Apr 2014 20:42:47 -0700 (PDT)
Received: from AndrewYaoPC (unknown [166.111.132.217]) by centos (Coremail) with SMTP id AQAAf3CLMgMrKj5TZ7scAA--.2597S2; Fri, 04 Apr 2014 11:42:35 +0800 (CST)
From: "Guang Yao" <yaoguang@cernet.edu.cn>
To: "'Leaf Yeh'" <leaf.yeh.sdo@gmail.com>, "'Jun Bi'" <junbi@cernet.edu.cn>, "'Jun Bi'" <junbi@tsinghua.edu.cn>
References: <53345a28.e15f440a.76a1.430a@mx.google.com> <000c01cf4cc4$382c92e0$a885b8a0$@cernet.edu.cn> <5339adef.42e7420a.490c.ffff8eac@mx.google.com> <000401cf4d7b$272ed310$758c7930$@cernet.edu.cn> <533bd4f3.0ac5440a.6319.ffff85a6@mx.google.com>
In-Reply-To: <533bd4f3.0ac5440a.6319.ffff85a6@mx.google.com>
Date: Fri, 4 Apr 2014 11:42:37 +0800
Message-ID: <003001cf4fb7$ec252320$c46f6960$@cernet.edu.cn>
MIME-Version: 1.0
Content-Type: multipart/related; boundary="----=_NextPart_000_0031_01CF4FFA.FA4E2F80"
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AQHXgVSJEKldWHfW8Xp2lGM95er5lwHyrTPzAXgJkiIBWdK84gJhQ7LxmrcvvTA=
Content-Language: zh-cn
X-CM-TRANSID: AQAAf3CLMgMrKj5TZ7scAA--.2597S2
X-Coremail-Antispam: 1UD129KBjvAXoWfWryUZw13uF47XF13JryDtrb_yoW5Cw1UXo Za93yaq3WDtr47Jr1kCF4kWFWDWFWv9r1xAr4UWrn8JF92qrsxWw4UC3yxJFZrJFW29rZx Xa4UXasYgFsayF93n29KB7ZKAUJUUUU8529EdanIXcx71UUUUU7v73VFW2AGmfu7bjvjm3 AaLaJ3UjIYCTnIWjp_UUUYc7AC8VAFwI0_Jr0_Gr1l1xkIjI8I6I8E6xAIw20EY4v20xva j40_Wr0E3s1l1IIY67AEw4v_Jr0_Jr4l8cAvFVAK0II2c7xJM28EF7xvwVC0I7IYx2IY67 AKxVWUCVW8JwA2z4x0Y4vE2Ix0cI8IcVCY1x0267AKxVW8JVWxJwA2z4x0Y4vEx4A2jsIE 14v26r4UJVWxJr1l84ACjcxK6I8E87Iv6xkF7I0E14v26r4UJVWxJr1lnx0Ee4C267I2x7 xF54xIwI0E7I0Y6sxI4wAS0I0E0xvYzxvE52x082IY62kv0487M2AExVA0xI801c8C04v7 Mc02F40Eb7x2x7xS6F1j6F4UMc02F40E57IF67AEF4xIwI1l5I8CrVAKz4kIr2xC04v26r 1j6r4UMc02F40E42I26xC2a48xMcIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_ Jr0_Gr1lF7I21c0EjII2zVCS5cI20VAGYxC7MxkF7I0En4kS14v26r126r1DMxkIecxEwV AFwVW8GwC20s026c02F40E14v26r106r1rMI8I3I0E7480Y4vE14v26r106r1rMI8E67AF 67kF1VAFwI0_JF0_Jw1lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7 CjxVAFwI0_Jr0_Gr1lIxAIcVCF04k26cxKx2IYs7xG6rW3Jr0E3s1lIxAIcVC2z280aVAF wI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVWUJVW8JbIYCTnIWIevJa73UjIFyTuYvj fUYg4SDUUUU
X-CM-SenderInfo: 51drw3xdqjquphuqv3oohg3hdfq/
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/Ui7skY1upyRCHmN69TEf8U-oQdY
X-Mailman-Approved-At: Fri, 04 Apr 2014 08:09:23 -0700
Cc: savi@ietf.org, 'Ted Lemon' <ted.lemon@nominum.com>
Subject: Re: [savi] Some findings in the darft-ietf-savi-dhcp-20
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 04 Apr 2014 03:42:55 -0000

This is a multipart message in MIME format.

------=_NextPart_000_0031_01CF4FFA.FA4E2F80
Content-Type: multipart/alternative;
	boundary="----=_NextPart_001_0032_01CF4FFA.FA4E5690"


------=_NextPart_001_0032_01CF4FFA.FA4E5690
Content-Type: text/plain;
	charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Dear Leaf,

=20

Thank you very much for these comments! Our responses are as follows:

=20

1.=20

1. Guang - R2.2: ...Indeed, there is no problem if letting the Relay or =
Server B outside the perimeter. ..., in recent versions, we decide to =
include them into the perimeter.

Leaf - The above decision sounds you make that Relay is the for the =
connection with the upstream network.

Guang - Exactly.=20

=20

=20

The basic questions here sounds : Do we need Server B/Relay work outside =
the perimeter? Per the draft-(ver.)21 of today, I guess the answer is =
'no'. :)

=20

Guang: cheers!

=20

2.=20

=20

For the thinking of additional modular for the switch, DHCP-Trust =
attribute is designed for anti-bogus DHCP server/Relay. It is only used =
for the access of DHCP server/Relay, just because the default (No =
attribute) is blocking the messages from the Server/Relay on all ports =
(including validating ports) on the SAVI-switch, right?

=20

Guang:

Yes.

=20

Can we just use DHCP-Trust take care the DHCP (control) messages from =
the Server/Relay, and not care the data (plane) packet? I mean it might =
be enough for the defense against bogus DHCP server/Relay, right?

=20

Guang:

If DHCP-Trust is used alone, data packet will not be checked. Maybe =
there is some misunderstanding here? Data packet check is only performed =
on =E2=80=9CValidating=E2=80=9D port.

=20

3.=20



=20

Guang: I can understand your scenario. Actually, this is the original =
scenario of SAVI-DHCP. However, from some reviewers, bogus DHCP servers =
from the upstream networks are possible security threat. If we choose =
fully trust traffic from upstream networks, this mechanism is actually =
fragile. Thus, at last, we choose the current design.

=20

Anyway, the guidelines are just suggestions to make the deployment =
secure. If the operator chooses trust the upstream networks, it is =
alright to configure Trust on the upstream port. But it should =
understand this security threat.

=20

4.=20

That sounds the DHCP server can be outside SAVI-perimeter and DHCP-Trust =
can be used on the perimeter with Validating port.

=20

Guang: Exactly. But such a case will introduce security problem. If we =
have no better choices, such a configuration is possible.

=20

5.=20

The concept of 'perimeter' is defined in section 4 of RFC7039 (SAVI =
arch.) and section 2.5 of RFC6620 (SAVI-SLAAC). It looks to me the =
Validating port of SAVI-Switch (for SLAAC) and the Validating attribute =
of the SAVI devices (for DHCP) forms the perimeter. In another word, the =
binding filters of SAVI form the perimeter, though draft-SAVI-DHCP adds =
more discussion 'On the Placement of DHCP Server/Relay' at section =
4.3.3.

=20

Guang:

Exactly. A difference is that SAVI-DHCP choose not trust DHCP messages =
from upstream network. For SAVI-FCFS, there is no such a problem.

=20

6.

=20

That is really my concern:

a.  I don't think we really need SAVI switch (and its validating =
attributes) to form the perimeter against the upstream network in =
practice.

b .  If you don't trust the traffic from the upstream network, then the =
methods, such as ingress filtering or uRPF, other than SAVI might be =
employed.

c.  I guess we have not a clear definition for the upstream network. In =
my mind, the upstream network mention here sounds in the same =
administrative domain of the operator, which we could trust.

=20

Guang:

As we specified in the doc, the upstream network is actually all the =
other networks, i.e., the other part of the Internet.

In this mechanism, we make no assumption on how the upstream networks =
are operated, and whether filtering is performed on the gateway or =
router(actually, ingress filtering or uRPF is not able to filter bogus =
DHCP messages). It is a too strong assumption that the traffic from all =
the other networks can be trust.

Again, we must claim that the guidelines are just suggestions.

=20

7.

I suppose the SAVI protection perimeter is not suitable against the =
upstream network, for at least 2 reasons:

a.  we don't use SAVI device to connect the upstream network;

b.  we don't use Validating attribute for the upstream network;

=20

Guang:

a.       As we state, it is a suggestion. Besides, the gateway/router =
itself can be regarded as SAVI device if  it helps filtering bogus DHCP =
messages.

b.       We don=E2=80=99t use this, either. :)

=20

I guess your perimeter (SAVI-DHCP perimeter) here sounds not the same as =
SAVI protection perimeter defined in RFC7039 (SAVI arch.) and RFC6620 =
(SAVI-SLAAC). I can't find words in the above 2 RFCs on that we can't =
trust the data or even control packets from the upstream network, or the =
statement of ' We should not make assumption that the upstream network =
is always trustable '.

=20

Guang:

For SAVI-FCFS, it is totally OK if the upstream network is untrustable, =
because this mechanism can work with only local messages. However, for =
SAVI-DHCP, it is different.

=20

If you doubt there is a bogus DHCP server in the upstream network, you =
might employ something like 'DHCP-trust attribute' configure on the =
router (or gateway) to block DHCP server-client messages from the =
upstream network, then you could only use the local trustable DHCP =
server between the SAVI-perimeter and the router, or use DHCP relay to =
connect the remote trustable DHCP server. But the date (plane) packet =
need pass through, from the upstream network, access network, SAVI =
perimeter to the end-user hosts (i.e. DHCP clients).

=20

Guang:

First, we do not filter data traffic from upstream networks=E2=80=A6 =
Second, it is totally OK to treat router (or gateway) as SAVI devices by =
 configuring DHCP Trust.

=20

But this sounds not a feature of SAVI-switch, and might be out-of-scope =
of the draft. I prefer 'DHCP-trust attribute' could only mention for the =
SAVI device in this draft.

=20

8.

=20

I believe the solution in draft-SAVI-DHCP-21 can work, but the solution =
in RFC6620 sounds better. If one want to implement both SAVI-SLAAC & =
SAVI-DHCP, he might want the same binding table. Right?

=20

Guang:

I cannot see why using additional memory to keep a useless field in =
running time is better=E2=80=A6

=20

=20

9. Leaf- I guess the text in the draft will not cause any =
misunderstanding if you delete the prefix of 'EVE_'. Right?

Guang: Thank you for this comment. "EVE_" means it is an event instead =
of a packet. For example, not all " DHCP_OPTION_RC'" will trigger an =
event.

=20

For example, you can=E2=80=99t find =E2=80=98EVE_=E2=80=99 for those =
messages which act as the event to trigger the state-change described in =
RFC6620, you still can understand it.

=20

Guang:

That=E2=80=99s a good reason. But we are going to modify this naming if =
only misunderstanding is caused by the prefix. There is no =
misunderstanding with the current naming, right?

=20

10. Leaf - In Section 7.1, <quote> Data packets without matching binding =
entry may trigger this process to set up bindings.</quote>

<quote>This process is not intended to set up a binding whenever a data =
packet without matched binding entry is received.</quote>

Does the above 2 sentence sound a little conflict?

Guang - R10: ... "Data packets without matching binding entry _may_ =
trigger this process to set up bindings." We use a "may" to mean this is =
probable.

Leaf - Can I say ' This process is intended to set up a binding whenever =
a data packet without matched binding entry is received.' ?

Guang: =E2=80=A6 Strictly, it is not quite proper. Not all the =
mismatched packet will trigger the process.

=20

=20

Can I say =E2=80=98This process may not intended to set up a binding =
whenever a data packet without matched binding entry is =
received.=E2=80=99 or =E2=80=98This process may intended to set up a =
binding whenever a data packet without matched binding entry is =
received.=E2=80=99? I am just not sure about the wording in =
=E2=80=98This process is not intended to set up a binding whenever a =
data packet without matched binding entry is received.=E2=80=99. Anyway, =
it makes me a little confused. In my mind, the process does intend to do =
something.

=20

Guang:=20

We just want to emphasize =E2=80=9Cno all the data packet will trigger =
this process=E2=80=9D.

=20

=20

11. Leaf - =E2=80=A6if you keep the text in section 7.5.2, <quote>The =
messages MUST NOT be sent to the attachment from which the triggering =
packet is received.</quote>. The DAD process after EVE_DATA_LEASEQUERY =
looks that 'The Neighbor Solicitation is only sent to the attachment =
which triggers the binding.' I personally prefer to combine these 2 DAD =
process, which means to sent DAD_NS to all the ports of SAVI-switch.

Guang: =E2=80=A6As I can understand, you mean sending DAD to the =
attachment which triggers the binding after receiving the DHCP =
leasequery-reply? What is the purpose of this step? And I'm wondering =
how to combine the 2 DAD processes since they are performed at different =
stages? May you please give a further explanation?

=20

=20

Draft-(ver.)20 has the 2nd DAD process after EVE_DATA_LEASEQUERY (in the =
state of RECOVERY). Draft-(ver.)21 also have the 2nd ARP process for =
IPv4 address in same section 7.5.3.2.=20

=20

I guess the purpose of this process is double-check that one client (or =
host) assigned the address (specified in the Lease-query) with the valid =
lease is actively attached on the port which received a data without =
matched binding entry.=20

=20

Guang:

Well I see. It is a good reason.

=20

I suppose the target address in the 2nd DAD process is the same as that =
in the 1st DAD process, which is the source address of the data packet =
received in the EVE_DATA_UNMATCH, right? If yes, that make possible to =
combine these 2 processes.

=20

Guang:

Actually not. The first is to avoid the attack against a local address. =
If a local conflict is found, there is no need to perform lease-query, =
as the procedure is costly.

=20

Best regards,

Guang

=20

=20

=20

From: Leaf Yeh [mailto:leaf.yeh.sdo@gmail.com]=20
Sent: Wednesday, April 02, 2014 5:14 PM
To: 'Guang Yao'; 'Jun Bi'; 'Jun Bi'
Cc: 'Ted Lemon'; savi@ietf.org
Subject: RE: Some findings in the darft-ietf-savi-dhcp-20

=20

1. Guang - R2.2: ...Indeed, there is no problem if letting the Relay or =
Server B outside the perimeter. ..., in recent versions, we decide to =
include them into the perimeter.

Leaf - The above decision sounds you make that Relay is the for the =
connection with the upstream network.

Guang - Exactly.=20

=20

=20

The basic questions here sounds : Do we need Server B/Relay work outside =
the perimeter? Per the draft-(ver.)21 of today, I guess the answer is =
'no'. :)

=20

=20

2. Guang - Trust: both data packet and control packet are trusted;

DHCP-Trust: only control packet is trusted.

Actually it is proper to configure Trust on the port of Relay and server =
B, if we also trust the data packet from them. In the scenario, the =
relay and server B are supposed to only send control packets, thus I =
think it makes no difference whether DHCP-Trust or trust is used. (Maybe =
we should specify this point in the doc?)=20

However, I believe it is necessary to distinguish the two types of =
trusts. =20

=20

=20

For the thinking of additional modular for the switch, DHCP-Trust =
attribute is designed for anti-bogus DHCP server/Relay. It is only used =
for the access of DHCP server/Relay, just because the default (No =
attribute) is blocking the messages from the Server/Relay on all ports =
(including validating ports) on the SAVI-switch, right?

=20

Can we just use DHCP-Trust take care the DHCP (control) messages from =
the Server/Relay, and not care the data (plane) packet? I mean it might =
be enough for the defense against bogus DHCP server/Relay, right?

=20

=20

Guang - I think the perimeter is only a deployment suggestion. In =
practice it is not always possible to enforce savi as the diagram. =20

=20

=20

Then I suggested to make the Fig.1 in the draft more popular for the =
real practice (or networking deployment). In my mind, the basic =
application scenario looks like the following:

=20



=20

=20

Guang - For example, we may choose to configure DHCP-trust and =
validating on the same port, which is attached by a DHCP server and some =
hosts through a hub. In such cases, the DHCP server is actually outside =
the perimeter. The DHCP messages are not fully trustable but we have to =
make use of them for there are no other ways.

=20

=20

That sounds the DHCP server can be outside SAVI-perimeter and DHCP-Trust =
can be used on the perimeter with Validating port.

=20

=20

Guang - Besides, I think where to draw the perimeter is actually not a =
critical problem. It makes no difference whether placing the relay and =
server inside or outside the perimeter. The savi device works based on =
port configuration, without knowing the perimeter.

=20

=20

The concept of 'perimeter' is defined in section 4 of RFC7039 (SAVI =
arch.) and section 2.5 of RFC6620 (SAVI-SLAAC). It looks to me the =
Validating port of SAVI-Switch (for SLAAC) and the Validating attribute =
of the SAVI devices (for DHCP) forms the perimeter. In another word, the =
binding filters of SAVI form the perimeter, though draft-SAVI-DHCP adds =
more discussion 'On the Placement of DHCP Server/Relay' at section =
4.3.3.

=20

=20

3. Guang - Besides, to confirm with other solutions, perimeter is the =
place to perform data packet filtering. Thus, only the attach points =
with validating attribute are on the perimeter.

...

Guang - It's my fault: the upstream port is also on the perimeter.

We choose not to fully trust the traffic from upstream network: both =
data packet and control packet. Thus, I think it is necessary to keep it =
outside the perimeter.=20

However, if the operator chooses to fully trust packet from upstream =
networks, he can use a Trust on the corresponding port. Then in concept =
the upstream network is inside the perimeter.

=20

=20

That is really my concern:

a.  I don't think we really need SAVI switch (and its validating =
attributes) to form the perimeter against the upstream network in =
practice.

b .  If you don't trust the traffic from the upstream network, then the =
methods, such as ingress filtering or uRPF, other than SAVI might be =
employed.

c.  I guess we have not a clear definition for the upstream network. In =
my mind, the upstream network mention here sounds in the same =
administrative domain of the operator, which we could trust.

=20

=20

5. Leaf -4. Question of clarification on the text in section 4.3.2, =
<quote>(6) Optional: configure filters on the upstream links to filter =
out spoofing of local addresses from other networks.</quote>...

Guang - R4:...We cannot prevent other networks from spoofing each other. =
Thus, we can just requre local addresses (addresses assigned to local =
network) will not be spoofed by the other networks.

Leaf - Thanks for your explanation here, but that method sounds ingress =
filtering (or uRPF) to me. Meanwhile, the 'other network' in the =
definition of 'Upstream link' seems a little vague for me. I guess it is =
usually we don=E2=80=99t use SAVI-switch to connect to the upstream =
network, we use a gateway or router. So the (6) of SAVI-DHCP Perimeter =
Configuration Guideline seems unnecessary. I mean we don't usually use =
SAVI-switch to form the SAVI-perimeter against the upstream link or =
network.

Guang: ... We do not require the savi switch to connect to upstream =
network. Actually, they are connected to the gateway or router. This =
configuration just specifies how to process the traffic from the gateway =
or router.

=20

=20

The draft sounds only about SAVI-switch. The configuration guideline & =
state machines only work for switches (i.e. SAVI devices), right?=20

=20

=20

6. Guang: ...For SAVI-DHCP, a critical problem is that the DHCP =
Server-Client messages should be trustable. However, there can be bogus =
DHCP servers in the upstream network. We should not make assumption that =
the upstream network is always trustable. Thus, they should not be in =
the perimeter.

=20

=20

I suppose the SAVI protection perimeter is not suitable against the =
upstream network, for at least 2 reasons:

a.  we don't use SAVI device to connect the upstream network;

b.  we don't use Validating attribute for the upstream network;

=20

I guess your perimeter (SAVI-DHCP perimeter) here sounds not the same as =
SAVI protection perimeter defined in RFC7039 (SAVI arch.) and RFC6620 =
(SAVI-SLAAC). I can't find words in the above 2 RFCs on that we can't =
trust the data or even control packets from the upstream network, or the =
statement of ' We should not make assumption that the upstream network =
is always trustable '.

=20

If you doubt there is a bogus DHCP server in the upstream network, you =
might employ something like 'DHCP-trust attribute' configure on the =
router (or gateway) to block DHCP server-client messages from the =
upstream network, then you could only use the local trustable DHCP =
server between the SAVI-perimeter and the router, or use DHCP relay to =
connect the remote trustable DHCP server. But the date (plane) packet =
need pass through, from the upstream network, access network, SAVI =
perimeter to the end-user hosts (i.e. DHCP clients).

=20

But this sounds not a feature of SAVI-switch, and might be out-of-scope =
of the draft. I prefer 'DHCP-trust attribute' could only mention for the =
SAVI device in this draft.

=20

=20

8. Guang:'Creation Time' field only present in the stored table rather =
than BST?

=20

=20

I believe the solution in draft-SAVI-DHCP-21 can work, but the solution =
in RFC6620 sounds better. If one want to implement both SAVI-SLAAC & =
SAVI-DHCP, he might want the same binding table. Right?

=20

=20

9. Leaf- I guess the text in the draft will not cause any =
misunderstanding if you delete the prefix of 'EVE_'. Right?

Guang: Thank you for this comment. "EVE_" means it is an event instead =
of a packet. For example, not all " DHCP_OPTION_RC'" will trigger an =
event.

=20

For example, you can=E2=80=99t find =E2=80=98EVE_=E2=80=99 for those =
messages which act as the event to trigger the state-change described in =
RFC6620, you still can understand it.

=20

=20

10. Leaf - In Section 7.1, <quote> Data packets without matching binding =
entry may trigger this process to set up bindings.</quote>

<quote>This process is not intended to set up a binding whenever a data =
packet without matched binding entry is received.</quote>

Does the above 2 sentence sound a little conflict?

Guang - R10: ... "Data packets without matching binding entry _may_ =
trigger this process to set up bindings." We use a "may" to mean this is =
probable.

Leaf - Can I say ' This process is intended to set up a binding whenever =
a data packet without matched binding entry is received.' ?

Guang: =E2=80=A6 Strictly, it is not quite proper. Not all the =
mismatched packet will trigger the process.

=20

=20

Can I say =E2=80=98This process may not intended to set up a binding =
whenever a data packet without matched binding entry is =
received.=E2=80=99 or =E2=80=98This process may intended to set up a =
binding whenever a data packet without matched binding entry is =
received.=E2=80=99? I am just not sure about the wording in =
=E2=80=98This process is not intended to set up a binding whenever a =
data packet without matched binding entry is received.=E2=80=99. Anyway, =
it makes me a little confused. In my mind, the process does intend to do =
something.

=20

=20

11. Leaf - =E2=80=A6if you keep the text in section 7.5.2, <quote>The =
messages MUST NOT be sent to the attachment from which the triggering =
packet is received.</quote>. The DAD process after EVE_DATA_LEASEQUERY =
looks that 'The Neighbor Solicitation is only sent to the attachment =
which triggers the binding.' I personally prefer to combine these 2 DAD =
process, which means to sent DAD_NS to all the ports of SAVI-switch.

Guang: =E2=80=A6As I can understand, you mean sending DAD to the =
attachment which triggers the binding after receiving the DHCP =
leasequery-reply? What is the purpose of this step? And I'm wondering =
how to combine the 2 DAD processes since they are performed at different =
stages? May you please give a further explanation?

=20

=20

Draft-(ver.)20 has the 2nd DAD process after EVE_DATA_LEASEQUERY (in the =
state of RECOVERY). Draft-(ver.)21 also have the 2nd ARP process for =
IPv4 address in same section 7.5.3.2.=20

=20

I guess the purpose of this process is double-check that one client (or =
host) assigned the address (specified in the Lease-query) with the valid =
lease is actively attached on the port which received a data without =
matched binding entry.=20

=20

I suppose the target address in the 2nd DAD process is the same as that =
in the 1st DAD process, which is the source address of the data packet =
received in the EVE_DATA_UNMATCH, right? If yes, that make possible to =
combine these 2 processes.

=20

=20

Best Regards,

Leaf

=20

=20

=20

-----Original Message-----
From: Guang Yao [mailto:yaoguang@cernet.edu.cn]=20
Sent: Tuesday, April 01, 2014 3:23 PM
To: 'Leaf Yeh'; 'Jun Bi'; 'Jun Bi'
Cc: 'Ted Lemon'; savi@ietf.org <mailto:savi@ietf.org>=20
Subject: RE: Some findings in the darft-ietf-savi-dhcp-20

=20

Dear Leaf,

=20

Thank you very much for the quick review!

=20

Our responses are as follows:

=20

1. Leaf - As to Fig.1, question for clarification : It sounds to set up =
a filter (as the requirement of DHCP-Trust Attribute) inside the =
SAVI-perimeter. I guess if the Relay or Server B is directly connected =
to SAVI Device and outside the SAVI-perimeter, we still need to set up =
DHCP-Trust Attribute for the port of SAVI Device A and B, right? If yes, =
does it means the Fig.1 can let the Relay or Server B outside the =
SAVI-perimeter?

Guang - R2.2: ...Indeed, there is no problem if letting the Relay or =
Server B outside the perimeter. In fact, in the ealier versions, they =
are outside the perimeter. However, in recent versions, we decide to =
include them into the perimeter.=20

=20

The above decision sounds you make that Relay is the for the connection =
with the upstream network.

=20

Guang:

Thank you for this comment.

Exactly. The strength of the binding based security is actually very =
weak. Especially, if the DHCP messages are untrustable, the bindings =
will be meaningless. Thus, We prefer the security mechanism enforced =
between DHCP relay and server, if we cannot completely trust traffic =
from upstream.

=20

=20

2. Guang - On one hand, it is used to distinguish the DHCP server =
A(which is outside the perimeter) and the DHCP server B/Relay. On the =
other hand, we think the perimeter should be used to separating the =
trusted area and the untrusted area. The Relay and Server B should be =
trusted, and they are actually the sources of trust.=20

=20

=20

But you still need DHCP-Trust Attribute for them. It seem DHCP-Trust =
Attribute make them to be trust. How about if we just trust the Relay =
and Server B in the SAVI-perimeter without the additional permission, =
because they are connected to the Trust Port, (which was introduced by =
RFC662.)

=20

Guang:=20

Thank you for this comment.

=20

Trust: both data packet and control packet are trusted;

DHCP-Trust: only control packet is trusted.

=20

Actually it is proper to configure Trust on the port of Relay and server =
B, if we also trust the data packet from them. In the scenario, the =
relay and server B are supposed to only send control packets, thus I =
think it makes no difference whether DHCP-Trust or trust is used. (Maybe =
we should specify this point in the doc?)

=20

However, I believe it is necessary to distinguish the two types of =
trusts.  I think the perimeter is only a deployment suggestion. In =
practice it is not always possible to enforce savi as the diagram.  For =
example, we may choose to configure DHCP-trust and validating on the =
same port, which is attached by a DHCP server and some hosts through a =
hub. In such cases, the DHCP server is actually outside the perimeter. =
The DHCP messages are not fully trustable but we have to make use of =
them for there are no other ways.=20

=20

Besides, I think where to draw the perimeter is actually not a critical =
problem. It makes no difference whether placing the relay and server =
inside or outside the perimeter. The savi device works based on port =
configuration, without knowing the perimeter.

=20

=20

3. Guang - Besides, to confirm with other solutions, perimeter is the =
place to perform data packet filtering. Thus, only the attach points =
with validating attribute are on the perimeter.

=20

=20

It make me not quite sure you want to configure Validating attribute for =
the upstream network, which looks outside of the SAVI-perimeter in =
Fig.1.=20

=20

Per the description in section 4 of RFC7039, <quote>The IP source =
addresses in packets passing the protection perimeter are validated by =
the ingress SAVI instance, but no further validation takes place as long =
as the packets remain within or leave the protection perimeter.</quote>, =
I suppose it is not necessary to let upstream network outside the =
SAVI-perimeter.

=20

Guang:

Thank you for this comment.

It's my fault: the upstream port is also on the perimeter.

We choose not to fully trust the traffic from upstream network: both =
data packet and control packet. Thus, I think it is necessary to keep it =
outside the perimeter.=20

However, if the operator chooses to fully trust packet from upstream =
networks, he can use a Trust on the corresponding port. Then in concept =
the upstream network is inside the perimeter.

=20

=20

4. Leaf - What does =E2=80=9CSAVI device B is still protected from =
spoofing from client A=E2=80=9D exactly mean? How can SAVI device B =
protects from spoofing from client A? It sounds a little confused.

Guang - R3:...It means, "SAVI device B can avoid receiving spoofing =
traffic from client A.".

=20

=20

The above statement sounds SAVI device A can avoid receiving spoofing =
traffic from client A, then 'SAVI device B can avoid receiving spoofing =
traffic from client A' because of the SAVI perimeter. I doubt the =
necessary text of 'SAVI device B is still protected from spoofing from =
client A' here.

=20

Guang:

Thank you for this comment.

We will revise this sentence.

=20

=20

5. Leaf -4. Question of clarification on the text in section 4.3.2, =
<quote>(6) Optional: configure filters on the upstream links to filter =
out spoofing of local addresses from other networks.</quote>...

Guang - R4:...We cannot prevent other networks from spoofing each other. =
Thus, we can just requre local addresses (addresses assigned to local =
network) will not be spoofed by the other networks.

=20

=20

Thanks for your explanation here, but that method sounds ingress =
filtering (or uRPF) to me. Meanwhile, the 'other network' in the =
definition of 'Upstream link' seems a little vague for me. I guess it is =
usually we don=E2=80=99t use SAVI-switch to connect to the upstream =
network, we use a gateway or router. So the (6) of SAVI-DHCP Perimeter =
Configuration Guideline seems unnecessary. I mean we don't usually use =
SAVI-switch to form the SAVI-perimeter against the upstream link or =
network.

=20

=20

Guang:

Thank you for this comment.

We do not require the savi switch to connect to upstream network. =
Actually, they are connected to the gateway or router. This =
configuration just specifies how to process the traffic from the gateway =
or router.

=20

=20

6. Leaf - 5. Question of clarification on the text in the last paragraph =
of section 4.3.2, <quote> In this way, the points of attachments with =
Validating attribute (and generally together with attachments of =
upstream devices) on SAVI devices can form a perimeter separating DHCP =
clients and trusted devices.</quote> The above sentence sounds SAVI =
devices always form perimeter for upstream devices. But in general =
thinking, we always trust devices in the upstream network...

Guang - R5:...We should not trust devices in the upstream network by =
default unless some other securty mechanisms are enforced. =20

=20

=20

Why not if the upstream network is in the SAVI-perimeter?

=20

Guang:

Thank you for this comment.

For SAVI-DHCP, a critical problem is that the DHCP Server-Client =
messages should be trustable. However, there can be bogus DHCP servers =
in the upstream network. We should not make assumption that the upstream =
network is always trustable. Thus, they should not be in the perimeter.

=20

=20

7. Guang - R7.1: ...'A' and 'B' do not stand for any element in the =
diagram. They just denote some anchor of the clients.

=20

=20

How about replace A to be 'Port_1' in the instance of Fig.3?

=20

Guang:

Thank you for this comment. This is an excellent advice. We will revise =
the doc accordingly.

=20

=20

8. Leaf - On the other hand, I guess the =E2=80=98Creation Time=E2=80=99 =
of the entry looks like a field in this table per the usage described in =
the section 9. For the reason of consistency, we also have the field of =
=E2=80=98Creation Time=E2=80=99 in the FCFS-SAVI DataBase (i.e. =
SAVI-SLAAC DB, section 3.1 of RFC6620).

Guang - R7.2:...It is a good suggestion. ... For the usage in section 9, =
the system time of the store operation is enough. There is no need to =
recording the "Creation Time" in binding set up. Besides, adding a new =
field in the table will introduce too many modifications...

=20

=20

Per the description in section 9, <quote> Binding entries MAY be saved =
into non-volatile storage whenever a new binding entry changes to BOUND =
state. ... The time when each binding entry is established is also =
saved.</quote>, I suppose 'Creation Time' could support this action.

=20

Guang:

Thank you for this comment. Maybe can the  'Creation Time' field only =
present in the stored table rather than BST?

=20

=20

9. Leaf...though I don=E2=80=99t really like the prefix of =
=E2=80=98EVE_=E2=80=99 here. =E2=98=BA The prefix of =
=E2=80=98EVE_=E2=80=99 must stand for Event here, supposed it really =
means the additional valid check defined in section 6.3.2.

Guang - R8: ...We have changed =E2=80=98EVE_DHCP_SOLICIT_RC=E2=80=99 to =
=E2=80=98EVE_DHCP_OPTION_RC'. Yes, =E2=80=98EVE_=E2=80=99 stands for =
Event. We need some terms to denote events to be handled.

=20

=20

I guess the text in the draft will not cause any misunderstanding if you =
delete the prefix of 'EVE_'. Right?

=20

Guang:

Thank you for this comment. "EVE_" means it is an event instead of a =
packet. For example, not all " DHCP_OPTION_RC'" will trigger an event.

=20

=20

10. Leaf - In Section 7.1, <quote> Data packets without matching binding =
entry may trigger this process to set up bindings.</quote> <quote>This =
process is not intended to set up a binding whenever a data packet =
without matched binding entry is received.</quote> Does the above 2 =
sentence sound a little conflict?

Guang - R10: ... "Data packets without matching binding entry _may_ =
trigger this process to set up bindings." We use a "may" to mean this is =
probable.

=20

=20

Can I say ' This process is intended to set up a binding whenever a data =
packet without matched binding entry is received.' ?

=20

=20

Guang:

Thank you for this comment. Strictly, it is not quite proper. Not all =
the mismatched packet will trigger the process.

=20

=20

11.=20

Leaf -13. In Section 7.5.3.2, about =E2=80=98IPv6 address=E2=80=99 on =
page 32, <quote> Send a Neighbor Solicitation message with the target =
address set to the IP address in the corresponding entry. The Neighbor =
Solicitation is only sent to the attachment which triggers the binding. =
If there is no response after DAD_TIMEOUT, send another Neighbor =
Solicitation.

</quote> Could this additional DAD process be added in Fig.13?

Guang - R12: ... But it is there:...

=20

=20

I am not quite sure it is a good decision to delete this DAD process =
after EVE_DATA_LEASEQUERY (in the state of RECOVERY). It looks not the =
same as that DAD after EVE_DATA_UNMATCH (in the state of DETECTION), if =
you keep the text in section 7.5.2, <quote>The messages MUST NOT be sent =
to the attachment from which the triggering packet is received.</quote>. =
The DAD process after EVE_DATA_LEASEQUERY looks that 'The Neighbor =
Solicitation is only sent to the attachment which triggers the binding.' =
I personally prefer to combine these 2 DAD process, which means to sent =
DAD_NS to all the ports of SAVI-switch.

=20

Guang:

Thank you for this comment.

As I can understand, you mean sending DAD to the attachment which =
triggers the binding after receiving the DHCP leasequery-reply? What is =
the purpose of this step?

And I'm wondering how to combine the 2 DAD processes since they are =
performed at different stages?

May you please give a further explanation? Thank you very much!

=20

Best regards,

Guang

=20

=20

=20

=20

=20


------=_NextPart_001_0032_01CF4FFA.FA4E5690
Content-Type: text/html;
	charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; charset=3Dutf-8"><meta =
name=3DGenerator content=3D"Microsoft Word 15 (filtered medium)"><!--[if =
!mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:=E5=AE=8B=E4=BD=93;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:"Segoe UI Symbol";
	panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
	{font-family:"\@=E5=AE=8B=E4=BD=93";
	panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	text-align:justify;
	font-size:10.5pt;
	font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
	{mso-style-priority:99;
	mso-style-link:"=E7=BA=AF=E6=96=87=E6=9C=AC Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:10.5pt;
	font-family:"Calibri","sans-serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
	{mso-style-priority:99;
	mso-style-link:"=E6=89=B9=E6=B3=A8=E6=A1=86=E6=96=87=E6=9C=AC Char";
	margin:0cm;
	margin-bottom:.0001pt;
	text-align:justify;
	font-size:9.0pt;
	font-family:"Calibri","sans-serif";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
	{mso-style-priority:34;
	margin-top:0cm;
	margin-right:0cm;
	margin-bottom:0cm;
	margin-left:36.0pt;
	margin-bottom:.0001pt;
	text-align:justify;
	font-size:10.5pt;
	font-family:"Calibri","sans-serif";}
span.Char
	{mso-style-name:"=E7=BA=AF=E6=96=87=E6=9C=AC Char";
	mso-style-priority:99;
	mso-style-link:=E7=BA=AF=E6=96=87=E6=9C=AC;
	font-family:"Calibri","sans-serif";}
span.Char0
	{mso-style-name:"=E6=89=B9=E6=B3=A8=E6=A1=86=E6=96=87=E6=9C=AC Char";
	mso-style-priority:99;
	mso-style-link:=E6=89=B9=E6=B3=A8=E6=A1=86=E6=96=87=E6=9C=AC;}
span.EmailStyle22
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:1677153988;
	mso-list-type:hybrid;
	mso-list-template-ids:-1876904470 67698713 67698713 67698715 67698703 =
67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
	{mso-level-number-format:alpha-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l0:level2
	{mso-level-number-format:alpha-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l0:level3
	{mso-level-number-format:roman-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:right;
	text-indent:-9.0pt;}
@list l0:level4
	{mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l0:level5
	{mso-level-number-format:alpha-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l0:level6
	{mso-level-number-format:roman-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:right;
	text-indent:-9.0pt;}
@list l0:level7
	{mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l0:level8
	{mso-level-number-format:alpha-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l0:level9
	{mso-level-number-format:roman-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:right;
	text-indent:-9.0pt;}
ol
	{margin-bottom:0cm;}
ul
	{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue =
vlink=3Dpurple style=3D'text-justify-trim:punctuation'><div =
class=3DWordSection1><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'>Dear =
Leaf,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>Thank =
you very much for these comments! Our responses are as =
follows:<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>1. =
<o:p></o:p></span></p><p class=3DMsoPlainText>1. Guang - R2.2: =
...Indeed, there is no problem if letting the Relay or Server B outside =
the perimeter. ..., in recent versions, we decide to include them into =
the perimeter.<o:p></o:p></p><p class=3DMsoPlainText>Leaf - The above =
decision sounds you make that Relay is the for the connection with the =
upstream network.<o:p></o:p></p><p class=3DMsoPlainText>Guang - Exactly. =
<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>The =
basic questions here sounds : Do we need Server B/Relay work outside the =
perimeter? Per the draft-(ver.)21 of today, I guess the answer is 'no'. =
<span style=3D'font-family:Wingdings'>J</span><o:p></o:p></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>Guang: =
cheers!<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>2. =
<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText>For the thinking of additional modular for the =
switch, DHCP-Trust attribute is designed for anti-bogus DHCP =
server/Relay. It is only used for the access of DHCP server/Relay, just =
because the default (No attribute) is blocking the messages from the =
Server/Relay on all ports (including validating ports) on the =
SAVI-switch, right?<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p =
class=3DMsoPlainText>Yes.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Can we =
just use DHCP-Trust take care the DHCP (control) messages from the =
Server/Relay, and not care the data (plane) packet? I mean it might be =
enough for the defense against bogus DHCP server/Relay, =
right?<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText>If =
DHCP-Trust is used alone, data packet will not be checked. Maybe there =
is some misunderstanding here? Data packet check is only performed on =
=E2=80=9CValidating=E2=80=9D port.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>3. =
<o:p></o:p></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><img width=3D452 height=3D595 =
id=3D"=E5=9B=BE=E7=89=87_x0020_2" =
src=3D"cid:image001.png@01CF4FF3.E70CD9A0" =
alt=3D"cid:image001.png@01CF4FF3.E70CD9A0"></span><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>Guang: =
I can understand your scenario. Actually, this is the original scenario =
of SAVI-DHCP. However, from some reviewers, bogus DHCP servers from the =
upstream networks are possible security threat. If we choose fully trust =
traffic from upstream networks, this mechanism is actually fragile. =
Thus, at last, we choose the current design.<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>Anyway, =
the guidelines are just suggestions to make the deployment secure. If =
the operator chooses trust the upstream networks, it is alright to =
configure Trust on the upstream port. But it should understand this =
security threat.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>4. =
<o:p></o:p></span></p><p class=3DMsoPlainText>That sounds the DHCP =
server can be outside SAVI-perimeter and DHCP-Trust can be used on the =
perimeter with Validating port.<o:p></o:p></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>Guang: =
Exactly. But such a case will introduce security problem. If we have no =
better choices, such a configuration is =
possible.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>5. =
<o:p></o:p></span></p><p class=3DMsoPlainText>The concept of 'perimeter' =
is defined in section 4 of RFC7039 (SAVI arch.) and section 2.5 of =
RFC6620 (SAVI-SLAAC). It looks to me the Validating port of SAVI-Switch =
(for SLAAC) and the Validating attribute of the SAVI devices (for DHCP) =
forms the perimeter. In another word, the binding filters of SAVI form =
the perimeter, though draft-SAVI-DHCP adds more discussion 'On the =
Placement of DHCP Server/Relay' at section 4.3.3.<o:p></o:p></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'>Guang:<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'>Exactly. A difference is that =
SAVI-DHCP choose not trust DHCP messages from upstream network. For =
SAVI-FCFS, there is no such a problem.<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'>6.<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText>That is really my concern:<o:p></o:p></p><p =
class=3DMsoPlainText>a. &nbsp;I don't think we really need SAVI switch =
(and its validating attributes) to form the perimeter against the =
upstream network in practice.<o:p></o:p></p><p class=3DMsoPlainText>b . =
&nbsp;If you don't trust the traffic from the upstream network, then the =
methods, such as ingress filtering or uRPF, other than SAVI might be =
employed.<o:p></o:p></p><p class=3DMsoPlainText>c. &nbsp;I guess we have =
not a clear definition for the upstream network. In my mind, the =
upstream network mention here sounds in the same administrative domain =
of the operator, which we could trust.<o:p></o:p></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'>Guang:<o:p></o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>As we =
specified in the doc, the upstream network is actually all the other =
networks, i.e., the other part of the Internet.<o:p></o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>In this =
mechanism, we make no assumption on how the upstream networks are =
operated, and whether filtering is performed on the gateway or =
router(actually, ingress filtering or uRPF is not able to filter bogus =
DHCP messages). It is a too strong assumption that the traffic from all =
the other networks can be trust.<o:p></o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:11.0pt;color:#1F497D'>Again, =
we must claim that the guidelines are just =
suggestions.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'>7.<o:p></o:p></span></p><p =
class=3DMsoPlainText>I suppose the SAVI protection perimeter is not =
suitable against the upstream network, for at least 2 =
reasons:<o:p></o:p></p><p class=3DMsoPlainText>a. &nbsp;we don't use =
SAVI device to connect the upstream network;<o:p></o:p></p><p =
class=3DMsoPlainText>b. &nbsp;we don't use Validating attribute for the =
upstream network;<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText =
style=3D'margin-left:36.0pt;text-indent:-18.0pt;mso-list:l0 level1 =
lfo2'><![if !supportLists]><span style=3D'mso-list:Ignore'>a.<span =
style=3D'font:7.0pt "Times New =
Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span><![endif]>As =
we state, it is a suggestion. Besides, the gateway/router itself can be =
regarded as SAVI device if=C2=A0 it helps filtering bogus DHCP =
messages.<o:p></o:p></p><p class=3DMsoPlainText =
style=3D'margin-left:36.0pt;text-indent:-18.0pt;mso-list:l0 level1 =
lfo2'><![if !supportLists]><span style=3D'mso-list:Ignore'>b.<span =
style=3D'font:7.0pt "Times New =
Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span><![endif]>We =
don=E2=80=99t use this, either. <span =
style=3D'font-family:Wingdings'>J</span><o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>I =
guess your perimeter (SAVI-DHCP perimeter) here sounds not the same as =
SAVI protection perimeter defined in RFC7039 (SAVI arch.) and RFC6620 =
(SAVI-SLAAC). I can't find words in the above 2 RFCs on that we can't =
trust the data or even control packets from the upstream network, or the =
statement of ' We should not make assumption that the upstream network =
is always trustable '.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText>For =
SAVI-FCFS, it is totally OK if the upstream network is untrustable, =
because this mechanism can work with only local messages. However, for =
SAVI-DHCP, it is different.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>If you =
doubt there is a bogus DHCP server in the upstream network, you might =
employ something like 'DHCP-trust attribute' configure on the router (or =
gateway) to block DHCP server-client messages from the upstream network, =
then you could only use the local trustable DHCP server between the =
SAVI-perimeter and the router, or use DHCP relay to connect the remote =
trustable DHCP server. But the date (plane) packet need pass through, =
from the upstream network, access network, SAVI perimeter to the =
end-user hosts (i.e. DHCP clients).<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText>First, =
we do not filter data traffic from upstream networks=E2=80=A6 Second, it =
is totally OK to treat router (or gateway) as SAVI devices by=C2=A0 =
configuring DHCP Trust.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>But =
this sounds not a feature of SAVI-switch, and might be out-of-scope of =
the draft. I prefer 'DHCP-trust attribute' could only mention for the =
SAVI device in this draft.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>8.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>I =
believe the solution in draft-SAVI-DHCP-21 can work, but the solution in =
RFC6620 sounds better. If one want to implement both SAVI-SLAAC &amp; =
SAVI-DHCP, he might want the same binding table. Right?<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText>I =
cannot see why using additional memory to keep a useless field in =
running time is better=E2=80=A6<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>9. =
Leaf- I guess the text in the draft will not cause any misunderstanding =
if you delete the prefix of 'EVE_'. Right?<o:p></o:p></p><p =
class=3DMsoPlainText>Guang: Thank you for this comment. &quot;EVE_&quot; =
means it is an event instead of a packet. For example, not all &quot; =
DHCP_OPTION_RC'&quot; will trigger an event.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>For =
example, you can<span style=3D'font-family:"Courier =
New"'>=E2=80=99</span>t find <span style=3D'font-family:"Courier =
New"'>=E2=80=98</span>EVE_<span style=3D'font-family:"Courier =
New"'>=E2=80=99</span> for those messages which act as the event to =
trigger the state-change described in RFC6620, you still can understand =
it.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p =
class=3DMsoPlainText>That=E2=80=99s a good reason. But we are going to =
modify this naming if only misunderstanding is caused by the prefix. =
There is no misunderstanding with the current naming, =
right?<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>10. Leaf - In Section 7.1, &lt;quote&gt; Data =
packets without matching binding entry may trigger this process to set =
up bindings.&lt;/quote&gt;<o:p></o:p></p><p =
class=3DMsoPlainText>&lt;quote&gt;This process is not intended to set up =
a binding whenever a data packet without matched binding entry is =
received.&lt;/quote&gt;<o:p></o:p></p><p class=3DMsoPlainText>Does the =
above 2 sentence sound a little conflict?<o:p></o:p></p><p =
class=3DMsoPlainText>Guang - R10: ... &quot;Data packets without =
matching binding entry _may_ trigger this process to set up =
bindings.&quot; We use a &quot;may&quot; to mean this is =
probable.<o:p></o:p></p><p class=3DMsoPlainText>Leaf - Can I say ' This =
process is intended to set up a binding whenever a data packet without =
matched binding entry is received.' ?<o:p></o:p></p><p =
class=3DMsoPlainText>Guang: <span style=3D'font-family:"Courier =
New"'>=E2=80=A6</span> Strictly, it is not quite proper. Not all the =
mismatched packet will trigger the process.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Can I =
say <span style=3D'font-family:"Courier New"'>=E2=80=98</span>This =
process may not intended to set up a binding whenever a data packet =
without matched binding entry is received.<span =
style=3D'font-family:"Courier New"'>=E2=80=99</span> or <span =
style=3D'font-family:"Courier New"'>=E2=80=98</span>This process may =
intended to set up a binding whenever a data packet without matched =
binding entry is received.<span style=3D'font-family:"Courier =
New"'>=E2=80=99</span>? I am just not sure about the wording in <span =
style=3D'font-family:"Courier New"'>=E2=80=98</span>This process is not =
intended to set up a binding whenever a data packet without matched =
binding entry is received.<span style=3D'font-family:"Courier =
New"'>=E2=80=99</span>. Anyway, it makes me a little confused. In my =
mind, the process does intend to do something.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Guang: =
<o:p></o:p></p><p class=3DMsoPlainText>We just want to emphasize =
=E2=80=9Cno all the data packet will trigger this =
process=E2=80=9D.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>11. =
Leaf - <span style=3D'font-family:"Courier New"'>=E2=80=A6</span>if you =
keep the text in section 7.5.2, &lt;quote&gt;The messages MUST NOT be =
sent to the attachment from which the triggering packet is =
received.&lt;/quote&gt;. The DAD process after EVE_DATA_LEASEQUERY looks =
that 'The Neighbor Solicitation is only sent to the attachment which =
triggers the binding.' I personally prefer to combine these 2 DAD =
process, which means to sent DAD_NS to all the ports of =
SAVI-switch.<o:p></o:p></p><p class=3DMsoPlainText>Guang: <span =
style=3D'font-family:"Courier New"'>=E2=80=A6</span>As I can understand, =
you mean sending DAD to the attachment which triggers the binding after =
receiving the DHCP leasequery-reply? What is the purpose of this step? =
And I'm wondering how to combine the 2 DAD processes since they are =
performed at different stages? May you please give a further =
explanation?<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Draft-(ver.)20 has the 2<sup>nd</sup> DAD process =
after EVE_DATA_LEASEQUERY (in the state of RECOVERY). Draft-(ver.)21 =
also have the 2<sup>nd</sup> ARP process for IPv4 address in same =
section 7.5.3.2. <o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>I =
guess the purpose of this process is double-check that one client (or =
host) assigned the address (specified in the Lease-query) with the valid =
lease is actively attached on the port which received a data without =
matched binding entry. <o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText>Well I =
see. It is a good reason.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>I =
suppose the target address in the 2<sup>nd</sup> DAD process is the same =
as that in the 1<sup>st</sup> DAD process, which is the source address =
of the data packet received in the EVE_DATA_UNMATCH, right? If yes, that =
make possible to combine these 2 processes.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p =
class=3DMsoPlainText>Actually not. The first is to avoid the attack =
against a local address. If a local conflict is found, there is no need =
to perform lease-query, as the procedure is costly.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Best =
regards,<o:p></o:p></p><p class=3DMsoPlainText>Guang<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;color:#1F497D'><o:p>&nbsp;</o:p></span></p><div=
><div style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt =
0cm 0cm 0cm'><p class=3DMsoNormal align=3Dleft =
style=3D'text-align:left'><b><span =
style=3D'font-size:11.0pt'>From:</span></b><span =
style=3D'font-size:11.0pt'> Leaf Yeh [mailto:leaf.yeh.sdo@gmail.com] =
<br><b>Sent:</b> Wednesday, April 02, 2014 5:14 PM<br><b>To:</b> 'Guang =
Yao'; 'Jun Bi'; 'Jun Bi'<br><b>Cc:</b> 'Ted Lemon'; =
savi@ietf.org<br><b>Subject:</b> RE: Some findings in the =
darft-ietf-savi-dhcp-20<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal align=3Dleft =
style=3D'text-align:left'><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>1. Guang - R2.2: ...Indeed, there is no problem if =
letting the Relay or Server B outside the perimeter. ..., in recent =
versions, we decide to include them into the perimeter.<o:p></o:p></p><p =
class=3DMsoPlainText>Leaf - The above decision sounds you make that =
Relay is the for the connection with the upstream =
network.<o:p></o:p></p><p class=3DMsoPlainText>Guang - Exactly. =
<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>The =
basic questions here sounds : Do we need Server B/Relay work outside the =
perimeter? Per the draft-(ver.)21 of today, I guess the answer is 'no'. =
<span style=3D'font-family:Wingdings'>J</span><o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>2. =
Guang - Trust: both data packet and control packet are =
trusted;<o:p></o:p></p><p class=3DMsoPlainText>DHCP-Trust: only control =
packet is trusted.<o:p></o:p></p><p class=3DMsoPlainText>Actually it is =
proper to configure Trust on the port of Relay and server B, if we also =
trust the data packet from them. In the scenario, the relay and server B =
are supposed to only send control packets, thus I think it makes no =
difference whether DHCP-Trust or trust is used. (Maybe we should specify =
this point in the doc?) <o:p></o:p></p><p class=3DMsoPlainText>However, =
I believe it is necessary to distinguish the two types of trusts.&nbsp; =
<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>For =
the thinking of additional modular for the switch, DHCP-Trust attribute =
is designed for anti-bogus DHCP server/Relay. It is only used for the =
access of DHCP server/Relay, just because the default (No attribute) is =
blocking the messages from the Server/Relay on all ports (including =
validating ports) on the SAVI-switch, right?<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Can we =
just use DHCP-Trust take care the DHCP (control) messages from the =
Server/Relay, and not care the data (plane) packet? I mean it might be =
enough for the defense against bogus DHCP server/Relay, =
right?<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Guang =
- I think the perimeter is only a deployment suggestion. In practice it =
is not always possible to enforce savi as the diagram.&nbsp; =
<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Then I =
suggested to make the Fig.1 in the draft more popular for the real =
practice (or networking deployment). In my mind, the basic application =
scenario looks like the following:<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText><img =
width=3D452 height=3D595 id=3D"=E5=9B=BE=E7=89=87_x0020_1" =
src=3D"cid:image001.png@01CF4FF3.E70CD9A0" =
alt=3D"cid:image001.png@01CF4FF3.E70CD9A0"><o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Guang =
- For example, we may choose to configure DHCP-trust and validating on =
the same port, which is attached by a DHCP server and some hosts through =
a hub. In such cases, the DHCP server is actually outside the perimeter. =
The DHCP messages are not fully trustable but we have to make use of =
them for there are no other ways.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>That =
sounds the DHCP server can be outside SAVI-perimeter and DHCP-Trust can =
be used on the perimeter with Validating port.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Guang =
- Besides, I think where to draw the perimeter is actually not a =
critical problem. It makes no difference whether placing the relay and =
server inside or outside the perimeter. The savi device works based on =
port configuration, without knowing the perimeter.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>The =
concept of 'perimeter' is defined in section 4 of RFC7039 (SAVI arch.) =
and section 2.5 of RFC6620 (SAVI-SLAAC). It looks to me the Validating =
port of SAVI-Switch (for SLAAC) and the Validating attribute of the SAVI =
devices (for DHCP) forms the perimeter. In another word, the binding =
filters of SAVI form the perimeter, though draft-SAVI-DHCP adds more =
discussion 'On the Placement of DHCP Server/Relay' at section =
4.3.3.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>3. =
Guang - Besides, to confirm with other solutions, perimeter is the place =
to perform data packet filtering. Thus, only the attach points with =
validating attribute are on the perimeter.<o:p></o:p></p><p =
class=3DMsoPlainText>...<o:p></o:p></p><p class=3DMsoPlainText>Guang - =
It's my fault: the upstream port is also on the =
perimeter.<o:p></o:p></p><p class=3DMsoPlainText>We choose not to fully =
trust the traffic from upstream network: both data packet and control =
packet. Thus, I think it is necessary to keep it outside the perimeter. =
<o:p></o:p></p><p class=3DMsoPlainText>However, if the operator chooses =
to fully trust packet from upstream networks, he can use a Trust on the =
corresponding port. Then in concept the upstream network is inside the =
perimeter.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>That =
is really my concern:<o:p></o:p></p><p class=3DMsoPlainText>a. &nbsp;I =
don't think we really need SAVI switch (and its validating attributes) =
to form the perimeter against the upstream network in =
practice.<o:p></o:p></p><p class=3DMsoPlainText>b . &nbsp;If you don't =
trust the traffic from the upstream network, then the methods, such as =
ingress filtering or uRPF, other than SAVI might be =
employed.<o:p></o:p></p><p class=3DMsoPlainText>c. &nbsp;I guess we have =
not a clear definition for the upstream network. In my mind, the =
upstream network mention here sounds in the same administrative domain =
of the operator, which we could trust.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>5. =
Leaf -4. Question of clarification on the text in section 4.3.2, =
&lt;quote&gt;(6) Optional: configure filters on the upstream links to =
filter out spoofing of local addresses from other =
networks.&lt;/quote&gt;...<o:p></o:p></p><p class=3DMsoPlainText>Guang - =
R4:...We cannot prevent other networks from spoofing each other. Thus, =
we can just requre local addresses (addresses assigned to local network) =
will not be spoofed by the other networks.<o:p></o:p></p><p =
class=3DMsoPlainText>Leaf - Thanks for your explanation here, but that =
method sounds ingress filtering (or uRPF) to me. Meanwhile, the 'other =
network' in the definition of 'Upstream link' seems a little vague for =
me. I guess it is usually we don<span style=3D'font-family:"Courier =
New"'>=E2=80=99</span>t use SAVI-switch to connect to the upstream =
network, we use a gateway or router. So the (6) of SAVI-DHCP Perimeter =
Configuration Guideline seems unnecessary. I mean we don't usually use =
SAVI-switch to form the SAVI-perimeter against the upstream link or =
network.<o:p></o:p></p><p class=3DMsoPlainText>Guang: ... We do not =
require the savi switch to connect to upstream network. Actually, they =
are connected to the gateway or router. This configuration just =
specifies how to process the traffic from the gateway or =
router.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>The =
draft sounds only about SAVI-switch. The configuration guideline &amp; =
state machines only work for switches (i.e. SAVI devices), right? =
<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>6. =
Guang: ...For SAVI-DHCP, a critical problem is that the DHCP =
Server-Client messages should be trustable. However, there can be bogus =
DHCP servers in the upstream network. We should not make assumption that =
the upstream network is always trustable. Thus, they should not be in =
the perimeter.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>I =
suppose the SAVI protection perimeter is not suitable against the =
upstream network, for at least 2 reasons:<o:p></o:p></p><p =
class=3DMsoPlainText>a. &nbsp;we don't use SAVI device to connect the =
upstream network;<o:p></o:p></p><p class=3DMsoPlainText>b. &nbsp;we =
don't use Validating attribute for the upstream =
network;<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>I guess your perimeter (SAVI-DHCP perimeter) here =
sounds not the same as SAVI protection perimeter defined in RFC7039 =
(SAVI arch.) and RFC6620 (SAVI-SLAAC). I can't find words in the above 2 =
RFCs on that we can't trust the data or even control packets from the =
upstream network, or the statement of ' We should not make assumption =
that the upstream network is always trustable '.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>If you =
doubt there is a bogus DHCP server in the upstream network, you might =
employ something like 'DHCP-trust attribute' configure on the router (or =
gateway) to block DHCP server-client messages from the upstream network, =
then you could only use the local trustable DHCP server between the =
SAVI-perimeter and the router, or use DHCP relay to connect the remote =
trustable DHCP server. But the date (plane) packet need pass through, =
from the upstream network, access network, SAVI perimeter to the =
end-user hosts (i.e. DHCP clients).<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>But =
this sounds not a feature of SAVI-switch, and might be out-of-scope of =
the draft. I prefer 'DHCP-trust attribute' could only mention for the =
SAVI device in this draft.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>8. =
Guang:'Creation Time' field only present in the stored table rather than =
BST?<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>I =
believe the solution in draft-SAVI-DHCP-21 can work, but the solution in =
RFC6620 sounds better. If one want to implement both SAVI-SLAAC &amp; =
SAVI-DHCP, he might want the same binding table. Right?<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>9. =
Leaf- I guess the text in the draft will not cause any misunderstanding =
if you delete the prefix of 'EVE_'. Right?<o:p></o:p></p><p =
class=3DMsoPlainText>Guang: Thank you for this comment. &quot;EVE_&quot; =
means it is an event instead of a packet. For example, not all &quot; =
DHCP_OPTION_RC'&quot; will trigger an event.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>For =
example, you can<span style=3D'font-family:"Courier =
New"'>=E2=80=99</span>t find <span style=3D'font-family:"Courier =
New"'>=E2=80=98</span>EVE_<span style=3D'font-family:"Courier =
New"'>=E2=80=99</span> for those messages which act as the event to =
trigger the state-change described in RFC6620, you still can understand =
it.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>10. =
Leaf - In Section 7.1, &lt;quote&gt; Data packets without matching =
binding entry may trigger this process to set up =
bindings.&lt;/quote&gt;<o:p></o:p></p><p =
class=3DMsoPlainText>&lt;quote&gt;This process is not intended to set up =
a binding whenever a data packet without matched binding entry is =
received.&lt;/quote&gt;<o:p></o:p></p><p class=3DMsoPlainText>Does the =
above 2 sentence sound a little conflict?<o:p></o:p></p><p =
class=3DMsoPlainText>Guang - R10: ... &quot;Data packets without =
matching binding entry _may_ trigger this process to set up =
bindings.&quot; We use a &quot;may&quot; to mean this is =
probable.<o:p></o:p></p><p class=3DMsoPlainText>Leaf - Can I say ' This =
process is intended to set up a binding whenever a data packet without =
matched binding entry is received.' ?<o:p></o:p></p><p =
class=3DMsoPlainText>Guang: <span style=3D'font-family:"Courier =
New"'>=E2=80=A6</span> Strictly, it is not quite proper. Not all the =
mismatched packet will trigger the process.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Can I =
say <span style=3D'font-family:"Courier New"'>=E2=80=98</span>This =
process may not intended to set up a binding whenever a data packet =
without matched binding entry is received.<span =
style=3D'font-family:"Courier New"'>=E2=80=99</span> or <span =
style=3D'font-family:"Courier New"'>=E2=80=98</span>This process may =
intended to set up a binding whenever a data packet without matched =
binding entry is received.<span style=3D'font-family:"Courier =
New"'>=E2=80=99</span>? I am just not sure about the wording in <span =
style=3D'font-family:"Courier New"'>=E2=80=98</span>This process is not =
intended to set up a binding whenever a data packet without matched =
binding entry is received.<span style=3D'font-family:"Courier =
New"'>=E2=80=99</span>. Anyway, it makes me a little confused. In my =
mind, the process does intend to do something.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>11. =
Leaf - <span style=3D'font-family:"Courier New"'>=E2=80=A6</span>if you =
keep the text in section 7.5.2, &lt;quote&gt;The messages MUST NOT be =
sent to the attachment from which the triggering packet is =
received.&lt;/quote&gt;. The DAD process after EVE_DATA_LEASEQUERY looks =
that 'The Neighbor Solicitation is only sent to the attachment which =
triggers the binding.' I personally prefer to combine these 2 DAD =
process, which means to sent DAD_NS to all the ports of =
SAVI-switch.<o:p></o:p></p><p class=3DMsoPlainText>Guang: <span =
style=3D'font-family:"Courier New"'>=E2=80=A6</span>As I can understand, =
you mean sending DAD to the attachment which triggers the binding after =
receiving the DHCP leasequery-reply? What is the purpose of this step? =
And I'm wondering how to combine the 2 DAD processes since they are =
performed at different stages? May you please give a further =
explanation?<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Draft-(ver.)20 has the 2<sup>nd</sup> DAD process =
after EVE_DATA_LEASEQUERY (in the state of RECOVERY). Draft-(ver.)21 =
also have the 2<sup>nd</sup> ARP process for IPv4 address in same =
section 7.5.3.2. <o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>I =
guess the purpose of this process is double-check that one client (or =
host) assigned the address (specified in the Lease-query) with the valid =
lease is actively attached on the port which received a data without =
matched binding entry. <o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>I =
suppose the target address in the 2<sup>nd</sup> DAD process is the same =
as that in the 1<sup>st</sup> DAD process, which is the source address =
of the data packet received in the EVE_DATA_UNMATCH, right? If yes, that =
make possible to combine these 2 processes.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Best =
Regards,<o:p></o:p></p><p class=3DMsoPlainText>Leaf<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>-----Original Message-----<br>From: Guang Yao [<a =
href=3D"mailto:yaoguang@cernet.edu.cn">mailto:yaoguang@cernet.edu.cn</a>]=
 <br>Sent: Tuesday, April 01, 2014 3:23 PM<br>To: 'Leaf Yeh'; 'Jun Bi'; =
'Jun Bi'<br>Cc: 'Ted Lemon'; <a =
href=3D"mailto:savi@ietf.org">savi@ietf.org</a><br>Subject: RE: Some =
findings in the darft-ietf-savi-dhcp-20<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Dear =
Leaf,<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Thank you very much for the quick =
review!<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Our responses are as follows:<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>1. =
Leaf - As to Fig.1, question for clarification : It sounds to set up a =
filter (as the requirement of DHCP-Trust Attribute) inside the =
SAVI-perimeter. I guess if the Relay or Server B is directly connected =
to SAVI Device and outside the SAVI-perimeter, we still need to set up =
DHCP-Trust Attribute for the port of SAVI Device A and B, right? If yes, =
does it means the Fig.1 can let the Relay or Server B outside the =
SAVI-perimeter?<o:p></o:p></p><p class=3DMsoPlainText>Guang - R2.2: =
...Indeed, there is no problem if letting the Relay or Server B outside =
the perimeter. In fact, in the ealier versions, they are outside the =
perimeter. However, in recent versions, we decide to include them into =
the perimeter. <o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>The =
above decision sounds you make that Relay is the for the connection with =
the upstream network.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText>Thank =
you for this comment.<o:p></o:p></p><p class=3DMsoPlainText>Exactly. The =
strength of the binding based security is actually very weak. =
Especially, if the DHCP messages are untrustable, the bindings will be =
meaningless. Thus, We prefer the security mechanism enforced between =
DHCP relay and server, if we cannot completely trust traffic from =
upstream.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>2. =
Guang - On one hand, it is used to distinguish the DHCP server A(which =
is outside the perimeter) and the DHCP server B/Relay. On the other =
hand, we think the perimeter should be used to separating the trusted =
area and the untrusted area. The Relay and Server B should be trusted, =
and they are actually the sources of trust. <o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>But =
you still need DHCP-Trust Attribute for them. It seem DHCP-Trust =
Attribute make them to be trust. How about if we just trust the Relay =
and Server B in the SAVI-perimeter without the additional permission, =
because they are connected to the Trust Port, (which was introduced by =
RFC662.)<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang: <o:p></o:p></p><p class=3DMsoPlainText>Thank =
you for this comment.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Trust: =
both data packet and control packet are trusted;<o:p></o:p></p><p =
class=3DMsoPlainText>DHCP-Trust: only control packet is =
trusted.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Actually it is proper to configure Trust on the =
port of Relay and server B, if we also trust the data packet from them. =
In the scenario, the relay and server B are supposed to only send =
control packets, thus I think it makes no difference whether DHCP-Trust =
or trust is used. (Maybe we should specify this point in the =
doc?)<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>However, I believe it is necessary to distinguish =
the two types of trusts.&nbsp; I think the perimeter is only a =
deployment suggestion. In practice it is not always possible to enforce =
savi as the diagram.&nbsp; For example, we may choose to configure =
DHCP-trust and validating on the same port, which is attached by a DHCP =
server and some hosts through a hub. In such cases, the DHCP server is =
actually outside the perimeter. The DHCP messages are not fully =
trustable but we have to make use of them for there are no other ways. =
<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Besides, I think where to draw the perimeter is =
actually not a critical problem. It makes no difference whether placing =
the relay and server inside or outside the perimeter. The savi device =
works based on port configuration, without knowing the =
perimeter.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>3. =
Guang - Besides, to confirm with other solutions, perimeter is the place =
to perform data packet filtering. Thus, only the attach points with =
validating attribute are on the perimeter.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>It =
make me not quite sure you want to configure Validating attribute for =
the upstream network, which looks outside of the SAVI-perimeter in =
Fig.1. <o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Per the description in section 4 of RFC7039, =
&lt;quote&gt;The IP source addresses in packets passing the protection =
perimeter are validated by the ingress SAVI instance, but no further =
validation takes place as long as the packets remain within or leave the =
protection perimeter.&lt;/quote&gt;, I suppose it is not necessary to =
let upstream network outside the SAVI-perimeter.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText>Thank =
you for this comment.<o:p></o:p></p><p class=3DMsoPlainText>It's my =
fault: the upstream port is also on the perimeter.<o:p></o:p></p><p =
class=3DMsoPlainText>We choose not to fully trust the traffic from =
upstream network: both data packet and control packet. Thus, I think it =
is necessary to keep it outside the perimeter. <o:p></o:p></p><p =
class=3DMsoPlainText>However, if the operator chooses to fully trust =
packet from upstream networks, he can use a Trust on the corresponding =
port. Then in concept the upstream network is inside the =
perimeter.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>4. =
Leaf - What does <span style=3D'font-family:"Courier =
New"'>=E2=80=9C</span>SAVI device B is still protected from spoofing =
from client A<span style=3D'font-family:"Courier New"'>=E2=80=9D</span> =
exactly mean? How can SAVI device B protects from spoofing from client =
A? It sounds a little confused.<o:p></o:p></p><p =
class=3DMsoPlainText>Guang - R3:...It means, &quot;SAVI device B can =
avoid receiving spoofing traffic from client A.&quot;.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>The =
above statement sounds SAVI device A can avoid receiving spoofing =
traffic from client A, then 'SAVI device B can avoid receiving spoofing =
traffic from client A' because of the SAVI perimeter. I doubt the =
necessary text of 'SAVI device B is still protected from spoofing from =
client A' here.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText>Thank =
you for this comment.<o:p></o:p></p><p class=3DMsoPlainText>We will =
revise this sentence.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>5. =
Leaf -4. Question of clarification on the text in section 4.3.2, =
&lt;quote&gt;(6) Optional: configure filters on the upstream links to =
filter out spoofing of local addresses from other =
networks.&lt;/quote&gt;...<o:p></o:p></p><p class=3DMsoPlainText>Guang - =
R4:...We cannot prevent other networks from spoofing each other. Thus, =
we can just requre local addresses (addresses assigned to local network) =
will not be spoofed by the other networks.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Thanks =
for your explanation here, but that method sounds ingress filtering (or =
uRPF) to me. Meanwhile, the 'other network' in the definition of =
'Upstream link' seems a little vague for me. I guess it is usually we =
don<span style=3D'font-family:"Courier New"'>=E2=80=99</span>t use =
SAVI-switch to connect to the upstream network, we use a gateway or =
router. So the (6) of SAVI-DHCP Perimeter Configuration Guideline seems =
unnecessary. I mean we don't usually use SAVI-switch to form the =
SAVI-perimeter against the upstream link or network.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText>Thank =
you for this comment.<o:p></o:p></p><p class=3DMsoPlainText>We do not =
require the savi switch to connect to upstream network. Actually, they =
are connected to the gateway or router. This configuration just =
specifies how to process the traffic from the gateway or =
router.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>6. =
Leaf - 5. Question of clarification on the text in the last paragraph of =
section 4.3.2, &lt;quote&gt; In this way, the points of attachments with =
Validating attribute (and generally together with attachments of =
upstream devices) on SAVI devices can form a perimeter separating DHCP =
clients and trusted devices.&lt;/quote&gt; The above sentence sounds =
SAVI devices always form perimeter for upstream devices. But in general =
thinking, we always trust devices in the upstream =
network...<o:p></o:p></p><p class=3DMsoPlainText>Guang - R5:...We should =
not trust devices in the upstream network by default unless some other =
securty mechanisms are enforced.&nbsp; <o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Why =
not if the upstream network is in the SAVI-perimeter?<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText>Thank =
you for this comment.<o:p></o:p></p><p class=3DMsoPlainText>For =
SAVI-DHCP, a critical problem is that the DHCP Server-Client messages =
should be trustable. However, there can be bogus DHCP servers in the =
upstream network. We should not make assumption that the upstream =
network is always trustable. Thus, they should not be in the =
perimeter.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>7. =
Guang - R7.1: ...'A' and 'B' do not stand for any element in the =
diagram. They just denote some anchor of the clients.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>How =
about replace A to be 'Port_1' in the instance of =
Fig.3?<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText>Thank =
you for this comment. This is an excellent advice. We will revise the =
doc accordingly.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>8. =
Leaf - On the other hand, I guess the <span =
style=3D'font-family:"Courier New"'>=E2=80=98</span>Creation Time<span =
style=3D'font-family:"Courier New"'>=E2=80=99</span> of the entry looks =
like a field in this table per the usage described in the section 9. For =
the reason of consistency, we also have the field of <span =
style=3D'font-family:"Courier New"'>=E2=80=98</span>Creation Time<span =
style=3D'font-family:"Courier New"'>=E2=80=99</span> in the FCFS-SAVI =
DataBase (i.e. SAVI-SLAAC DB, section 3.1 of RFC6620).<o:p></o:p></p><p =
class=3DMsoPlainText>Guang - R7.2:...It is a good suggestion. ... For =
the usage in section 9, the system time of the store operation is =
enough. There is no need to recording the &quot;Creation Time&quot; in =
binding set up. Besides, adding a new field in the table will introduce =
too many modifications...<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Per =
the description in section 9, &lt;quote&gt; Binding entries MAY be saved =
into non-volatile storage whenever a new binding entry changes to BOUND =
state. ... The time when each binding entry is established is also =
saved.&lt;/quote&gt;, I suppose 'Creation Time' could support this =
action.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText>Thank =
you for this comment. Maybe can the&nbsp; 'Creation Time' field only =
present in the stored table rather than BST?<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>9. =
Leaf...though I don<span style=3D'font-family:"Courier =
New"'>=E2=80=99</span>t really like the prefix of <span =
style=3D'font-family:"Courier New"'>=E2=80=98</span>EVE_<span =
style=3D'font-family:"Courier New"'>=E2=80=99</span> here. <span =
style=3D'font-family:"Segoe UI Symbol","sans-serif"'>=E2=98=BA</span> =
The prefix of <span style=3D'font-family:"Courier =
New"'>=E2=80=98</span>EVE_<span style=3D'font-family:"Courier =
New"'>=E2=80=99</span> must stand for Event here, supposed it really =
means the additional valid check defined in section =
6.3.2.<o:p></o:p></p><p class=3DMsoPlainText>Guang - R8: ...We have =
changed <span style=3D'font-family:"Courier =
New"'>=E2=80=98</span>EVE_DHCP_SOLICIT_RC<span =
style=3D'font-family:"Courier New"'>=E2=80=99</span> to <span =
style=3D'font-family:"Courier New"'>=E2=80=98</span>EVE_DHCP_OPTION_RC'. =
Yes, <span style=3D'font-family:"Courier New"'>=E2=80=98</span>EVE_<span =
style=3D'font-family:"Courier New"'>=E2=80=99</span> stands for Event. =
We need some terms to denote events to be handled.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>I =
guess the text in the draft will not cause any misunderstanding if you =
delete the prefix of 'EVE_'. Right?<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText>Thank =
you for this comment. &quot;EVE_&quot; means it is an event instead of a =
packet. For example, not all &quot; DHCP_OPTION_RC'&quot; will trigger =
an event.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>10. =
Leaf - In Section 7.1, &lt;quote&gt; Data packets without matching =
binding entry may trigger this process to set up bindings.&lt;/quote&gt; =
&lt;quote&gt;This process is not intended to set up a binding whenever a =
data packet without matched binding entry is received.&lt;/quote&gt; =
Does the above 2 sentence sound a little conflict?<o:p></o:p></p><p =
class=3DMsoPlainText>Guang - R10: ... &quot;Data packets without =
matching binding entry _may_ trigger this process to set up =
bindings.&quot; We use a &quot;may&quot; to mean this is =
probable.<o:p></o:p></p><p class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Can I =
say ' This process is intended to set up a binding whenever a data =
packet without matched binding entry is received.' ?<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText>Thank =
you for this comment. Strictly, it is not quite proper. Not all the =
mismatched packet will trigger the process.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>11. =
<o:p></o:p></p><p class=3DMsoPlainText>Leaf -13. In Section 7.5.3.2, =
about <span style=3D'font-family:"Courier New"'>=E2=80=98</span>IPv6 =
address<span style=3D'font-family:"Courier New"'>=E2=80=99</span> on =
page 32, &lt;quote&gt; Send a Neighbor Solicitation message with the =
target address set to the IP address in the corresponding entry. The =
Neighbor Solicitation is only sent to the attachment which triggers the =
binding. If there is no response after DAD_TIMEOUT, send another =
Neighbor Solicitation.<o:p></o:p></p><p =
class=3DMsoPlainText>&lt;/quote&gt; Could this additional DAD process be =
added in Fig.13?<o:p></o:p></p><p class=3DMsoPlainText>Guang - R12: ... =
But it is there:...<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>I am =
not quite sure it is a good decision to delete this DAD process after =
EVE_DATA_LEASEQUERY (in the state of RECOVERY). It looks not the same as =
that DAD after EVE_DATA_UNMATCH (in the state of DETECTION), if you keep =
the text in section 7.5.2, &lt;quote&gt;The messages MUST NOT be sent to =
the attachment from which the triggering packet is =
received.&lt;/quote&gt;. The DAD process after EVE_DATA_LEASEQUERY looks =
that 'The Neighbor Solicitation is only sent to the attachment which =
triggers the binding.' I personally prefer to combine these 2 DAD =
process, which means to sent DAD_NS to all the ports of =
SAVI-switch.<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText>Guang:<o:p></o:p></p><p class=3DMsoPlainText>Thank =
you for this comment.<o:p></o:p></p><p class=3DMsoPlainText>As I can =
understand, you mean sending DAD to the attachment which triggers the =
binding after receiving the DHCP leasequery-reply? What is the purpose =
of this step?<o:p></o:p></p><p class=3DMsoPlainText>And I'm wondering =
how to combine the 2 DAD processes since they are performed at different =
stages?<o:p></o:p></p><p class=3DMsoPlainText>May you please give a =
further explanation? Thank you very much!<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p class=3DMsoPlainText>Best =
regards,<o:p></o:p></p><p class=3DMsoPlainText>Guang<o:p></o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p><p =
class=3DMsoPlainText><o:p>&nbsp;</o:p></p></div></body></html>
------=_NextPart_001_0032_01CF4FFA.FA4E5690--

------=_NextPart_000_0031_01CF4FFA.FA4E2F80
Content-Type: image/png;
	name="image001.png"
Content-Transfer-Encoding: base64
Content-ID: <image001.png@01CF4FF3.E70CD9A0>

iVBORw0KGgoAAAANSUhEUgAAAcQAAAJTCAIAAAAZtvEuAAAAAXNSR0IArs4c6QAAMVNJREFUeF7t
3Tt64swSgGH5rAX+YB5WACuASSYidQYhJM4cOpsEQpNNSjTJwArMCvw4sNkLp1qtG5iLQK1GKn1K
xoDUl7c05UaY0sNutwvYEEAAAQSKCfyv2OEcjQACCCBgBEimnAcIIICAAwGSqQNEmkAAAQRIppwD
CCCAgAMB1cl0Pe7Ntw6QtDaBj9bIMq97CKhOpvcApU8EEGimAMm0mXFn1ggg4FhAYzLdznsP4TZY
bKZt++N4LXDrsX2QbuHTTXv+pI/jc4vmEGiUwIPmP9qXa4KfT2+TVqMiesVk8bkCi10RuCCgcWVK
0BFAAAHvAiRT7+R0iAACGgVUv83XGDDmhAAC1RRgZVrNuDAqBBComQDJtGYBY7gIIFBNAZJpNePC
qBBAoGYCJNOaBYzhIoBANQVIptWMC6NCAIGaCZBMaxYwhosAAtUUIJlWMy6MCgEEaiagOZnKd9Dz
lOBLvrEvOydfW3/ozWsWyeuHm9Pn+oY5AoEmCmhOpjnj2X/drUbd2ddOvsXfmrztwkfyIOfhB7vN
e7Z4ChsCCDRLgGR6Mt5h7anefJ6Umtpb5saVqWQX2cJlbLisnW4Wg7gqVZJW7c6ZlW/8SroSNi+n
Q8nUt4p6tXv2euFoxutoBxJ3s/67MtsqC5BMT0ZHFqmz7mY6DVZSWUu2r+GyHSUvyWzL4Zd9etXZ
bGwb4bJ21h1F++92r/2ocbvelXqA7eUwPCb4Gy5f549JM6b5TD79lTQS9SqNf8lwNmY0q2AwMP9+
zd5tO2wIIHB3AZLphRCMVnFKbE3+xMmrNXnuxJVSB4vRKt81AXspwfTXfzWNbufLTVJw9aE93QSb
jyg3tj9f4uWtPJ1u3Vk0mtGvOFHf/RRiAAggYARIpt/Og+3neyZ7/WgfPVHkQmu8yTrxtk+rWv91
5OLs3mZT5XosK9ho4SvLzy6nKgIIVF+AZGpi1P4RTH9Hi8Ltv+Wm818cuc30Mb2U+W/ZsQvCwz8T
SPeXF98/7U38zGXN89c0+7860yN/byDZvDuMSlpv5497S9Pqn1GMEIGmCuyvjFQ9kjWdeWedb1uN
4jMgs1qUBkajdGGYtLa/WEwvkobXQ5OGkufTp2wf2QOONpVZjUYDGM3iHeXgsD0ZjN1tv/t8s7UX
ga/xuaJddkWgkQKa65nKx0SPwZ8ity2RFWixBir9K7q4T6Wnx+AQ8CvA2/yT3vK3SFP7AdFtl0T9
BpLeEEDgvgKaV6b3laV3BBBolAAr00aFm8kigEBZAiTTsmRpFwEEGiVAMm1UuJksAgiUJUAyLUuW
dhFAoFECJNNGhZvJIoBAWQKak2nBep22MJP9hlJF6pxGhazsN6wKbwV9CvdPAwioEtCcTAsGytY5
DZbme6amIFT4haGLdU5LrWcaFrIqOC0ORwCBUgRIphdYh8Ng8P0b9kfrkJ6oZxpVPo0biSqRxl8E
SOuiZr7If7L+aTzYTP+UNC3lPwaNInCtAMn0ktjP11XwEr7XT7fjdUhP1DOVyn2mxmlcyS8q7P/H
1OKTpJmWh8pUnzpV/3R/rPZL+UnR1EsT4XUEEChTgGR6Wbf/NFxmakedq0N6tLHWZBgWcTbrTbMg
Xf99D4tCST3TjpRClZ/Crf+66iyzWfuw/mm0n/mGa1hkmjR6OXbsgYA3AZJpDmopCz1cjv/Fe56s
Q3qyqf86Updv/RHMTLpcf77vlezLMYCDFelolJaRvvpoDkAAgVIESKa5WKW0fjBNCoueqEMatXSk
nqkc8PFb1qM/5YflS1wV1axYsxcQ4hXrhRF1fzzJR2PB4EKx1FzzYicEEHAlQDI9KSmfFA0W5j11
+NdR8iY8KVQqD3Zya6b4xiLhHe7iZtIbmpjbNMXvxNs/3heSS1uBZNNNkFTvNyvetJlB8GxviRp+
RmX7DrfsjflsRl//XQSBuXNfnntZuzpXaAcBBM4IaK4aRb3O86c+PqQGBBwKsDJ1iElTCCDQXAHN
K9PmRpWZI4CAdwFWpt7J6RABBDQKkEw1RpU5IYCAdwGSqXdyOkQAAY0CJFONUWVOCCDgXYBk6p2c
DhFAQKOA5mRKvc7zZyw+Gv9HM6e7CWhOpndDpWMEEGieAMm0eTFnxgggUIIAybQEVJpEAIHmCZBM
mxdzZowAAiUIkExLQKVJBBBongDJtHkxZ8YIIFCCAMm0BFSaRACB5gmQTJsXc2aMAAIlCJBMS0Cl
SQQQaJ4A9UybF3NmjAACJQiwMi0BlSYRQKB5AiTT5sWcGSOAQAkCJNMSUGkSAQSaJ0AybV7MmTEC
CJQgQDItAZUmEUCgeQIk0+bFnBkjgEAJAqqT6Xrcm29LQLu1ScZzqxzHIVB9AdXJtPr8jBABBLQI
kEy1RJJ5IIDAfQV2+ravWfeb6Wgl81yNDp8Pny77+dqMR9+pwIwQ8Ceg+uukco3y8+lt0rrvr6u0
d8ZTlUgwDgTcC/A2370pLSKAQAMFSKYNDDpTRgAB9wKq3+a756JFBBBA4LgAK1PODAQQQMCBAMnU
ASJNIIAAAiRTzgEEEEDAgQDJ1AEiTSCAAAIkU84BBBBAwIEAydQBIk0ggAACJFPOAQQQQMCBAMnU
AWLOJrbzXrVKAuYcN7shgEAOAZJpDiR2QQABBC4JkEwvCfE6AgggkEOAZJoDiV0QQACBSwIk00tC
vI4AAgjkECCZ5kBiFwQQQOCSAMn0khCvI4AAAjkESKY5kNgFAQQQuCRAMr0kxOsIIIBADgGSaQ4k
dkEAAQQuCVBp/5IQryOAAAI5BFiZ5kBiFwQQQOCSAMn0khCvI4AAAjkESKY5kNgFAQQQuCRAMr0k
xOsIIIBADgGSaQ4kdkEAAQQuCZBMLwm5e516pu4saQmBygmQTCsXEgaEAAJ1FCCZ1jFqjBkBBCon
QDKtXEgYEAII1FGAZFrHqDFmBBConADJtHIhYUAIIFBHAZJpHaPGmBFAoHICJNPKhYQBIYBAHQVI
pnWMGmNGAIHKCZBMKxcSBoQAAnUUoJ5pHaPGmBFAoHICrEwrFxIGhAACdRQgmdYxaowZAQQqJ0Ay
rVxIGBACCNRRgGRax6gxZgQQqJwAybRyIWFACCBQRwGSqb+oUc/UnzU9IeBdgGTqnZwOEUBAowDJ
VGNUmRMCCHgXIJl6J6dDBBDQKEAy1RhV5oQAAt4FSKbeyekQAQQ0CpBMNUaVOSGAgHcBkql3cjpE
AAGNAiRTjVFlTggg4F2AZOqdnA4RQECjAPVMNUaVOSGAgHcBVqbeyekQAQQ0CpBMNUaVOSGAgHcB
kql3cjpEAAGNAiRTjVFlTggg4F2AZOqdnA4RQECjAMlUY1SZEwIIeBdQnUzX49586530dIeMp0LB
YCgIOBZQnUwdW9EcAgggcFKAZMrJgQACCLgQ2OnbvmbdbzKjlcxzNTp8Pny67OdrMx59pwIzQsCf
gOqvk8o1ys+nt0nLxS8dF20wHheKtIFANQV4m1/NuDAqBBComQDJtGYBY7gIIFBNAdVv86tJzqgQ
QECjACtTjVFlTggg4F2AZOqdnA4RQECjAMlUY1SZEwIIeBcgmXonp0MEENAoQDLVGFXmhAAC3gVI
pt7J6RABBDQKkEw1RpU5IYCAdwHNyXQ771WrBJ/36J7vsKiPHP+Q3cZr2996bJ81j7M/77348CCx
mffsMQcNXYha3GbUd29+0TUZKefDRSt2uFlAczK9GYUDcwm0Jm9SOsbWijHlYoJBmD+D/quUdpGn
X/vmZ1NGZrQyP4epdRBE+38Nl+3pxna039BuuHw8V4c2bL87+4q67UwvpkgZqex8rOBMromyEwJ5
BEimeZTYJ4eAyXHvL2ey4Hb+IpnUptUgsAkufrTX/s9h8PGVo8dwl/7TLN07u1jOsWJNFs6yyE0z
ctRI9ETyKO+A2K+pAiTTpka+hHm3/uts4iy4GMRXAAaL7o+26e3rI7A/XNr+LXPuaBqaP047v6IE
PX9cDqMF605WvpIgL3X1K15Xy3K4HV2nCFfc3dkfW25MHpl19tvkUlO83nQBkmnTz4CS5p+8+z9S
LfZ4l2n6XQ6jRHZmbJtp22ZrSZ/R8nY7X26Spx/MNYTNR3QZ91RD7c+XOOfHlxzscvd1uPydXAJe
Dp+ibF0SFs2qECCZqghjNSax/XyPFqFHx9P+ESz/nR5pmn7zlKCNrpmuRptpnPVkYdyd7ZcCPnoV
IRnCetzOrGT3S4pPngN7yUKuTTxXpyRuNQLNKI4KkEw5MVwJrH9PO+fyTmvyvPdhkflUPv4LgFvH
EF6oHUSt9H/l+DAq7cnk/mGUJ7dytSD6NCzawS5O12OWpbfGpnnH+Svq772n7Ge+3juvQYdFfb59
Om7XlsnT5mF8p5jkw/fs+i9Zi2aeTHY8DZjcfSZeh5rDsz+n/4vP35Ym+/l+dzQyN7tJl8fR7Wz2
nqhBUBni/QQ01zOVz2Efgz953jM273eomTE+F+JetdvMNPM0rc+seZtfn1gxUl8C0dcCBgv5PKvo
hQhfY6afuwtoXpneHZcBIIBAcwRYmTYn1swUAQRKFCCZlohL0wgg0BwBkmlzYs1MEUCgRAGSaYm4
NI0AAs0RIJk2J9bMFAEEShTQnEyL1us8xX59Pc0SA1ig6bJ8CgyJQxGor4DmZFpWVK6vp3lmJHF9
5LIGS7sIIOBHgGRa1HmvnuZe0fjoz71tQUz7wC5qs5Uyp5u0WlL69+En6nLaivRyePy6/r8ozxTh
TyfbQIeipynHly9AMi1qvFdPs2cqwqWV58N6mlIQM/m6uhSeT0vSheWRw5r00ZbUODpVl9McYOok
taXakS1u//dCjbmis7vv8ZI0v3vKkJrmcN8o0HtOAZJpTqjD3Y7X0+xIEeGwpLBs/ddVZ3nu9hun
er5Ul9PUArG1ivuv52vM3Ti3ihwmDmc9m+JQkXAwjEsCJNNLQideP1JP88aWvh12dV1OVx3TDgII
3C5AMr3dzq4N03qarclw7x5I67/vcbnMIHj/NJWGTaWmwWK/y+iV8HqqvSx4ZV3OYjOo7tFnPas7
bEbWWIH7Vf8rveei9TpPDfBMPc39Ep/p1dD0+e5sNpKTLS3bmbS2X0tzv+778bqcBWttluXjMLDH
PVMy+9+2oIPD8dJUkwU0V42iXuf5JQI+jV1CMfEyBHibX4YqbSKAQOMENK9MGxdMJowAAvcTYGV6
P3t6RgABRQIkU0XBZCoIIHA/AZLp/ezpGQEEFAmQTBUFk6kggMD9BEim97OnZwQQUCSgOZlSr/P8
iVrUJ1vaylSziqs6xfVezePsz+Fo0mKwUvwqrj+YKQ2Vqap1dvTpIePxOCwow4bAfQU0J9P7yurv
XapeyXeRkq8frYKBzadhvVd52hRhkTJZ4T62IItk0kEQFcn6Gi7b041V2m9oN1w+ni8QI1k4qSa1
ChYH38/VL88MKylAMq1kWOo4qLBMwcuZLLidv0gmjetchQUIk0d7E/45DD6+8hKYqoa2hpZs19SB
TdbIprxs5sG17eQdKPtpFyCZao+wx/lJuatNnAXTkteDRfdH24zi6yOwP1za/i0v7CiJWNa15opA
WCs7ae+qOrCShW11AlM1MV5B27x8VTuXZsPrTREgmTYl0p7nmRYfOSxLcmogafpdDv8kVWFP7R2u
a80mlwuifHp9HdjW5Lkz/W3ra89f3mdP4cWI69vxbEt31RQgmVYzLrUc1fbzPVqEHh1++0ew/Hd6
Ymn6TQts52CQhDjafJiEeEsdWLnpzLu5W8F6PO08Rxn8lnZyDJRdtAuQTLVH2N/81r/ThHSs13Ad
GN3/yryeFnC9coxyYKYZSeGjX+GS8pY6sDKo4GWeLktvbefKKbC7RgHF9QdrUK/zrvpFffaLjcp/
Dru2TJ42D+P3+En91myd1mQtmnkyLfR62ubgwsHeITfUgTUD/lYS9YZ27hpMOr+/gOaqUdTrPP/b
Hx+NqyPmdDcB3ubfjZ6OEUBAk4DmlammODEXBBCouAAr04oHiOEhgEA9BEim9YgTo0QAgYoLkEwr
HiCGhwAC9RAgmdYjTowSAQQqLkAyrXiAGB4CCNRDgGRajzgxSgQQqLiA6mS6lqrB2woFgPFUKBgM
BQHHAqqTqWMrmkMAAQROCpBMOTkQQAABFwL3Lw/gfATfCnCIU1jI4ntlTVvfouTnazMe55GgQQQa
JKD666RyjfLz6arimC5+PZ1ug/GU60vrCNxTgLf599SnbwQQUCNAMlUTSiaCAAL3FFD9Nv+esPSN
AALNEmBl2qx4M1sEEChJgGRaEizNIoBAswRIps2KN7NFAIGSBEimJcHSLAIINEuAZNqseDNbBBAo
SYBkWhIszSKAQLMESKbNijezRQCBkgRIpiXBHmlW7lNfrZKA/qZOTwjoFyCZ6o8xM0QAAQ8CJFMP
yHSBAAL6BUim+mPMDBFAwIMAydQDMl0ggIB+AZKp/hgzQwQQ8CBAMvWATBcIIKBfgGSqP8bMEAEE
PAiQTD0g0wUCCOgXIJnqjzEzRAABDwJU2veATBcIIKBfgJWp/hgzQwQQ8CBAMvWATBcIIKBfgGSq
P8bMEAEEPAiQTD0g0wUCCOgXIJnqjzEzRAABDwIkUw/IURfUM/VnTU8IeBcgmXonp0MEENAoQDLV
GFXmhAAC3gVIpt7J6RABBDQKkEw1RpU5IYCAdwGSqXdyOkQAAY0CJFONUWVOCCDgXYBk6p2cDhFA
QKMAyVRjVJkTAgh4FyCZeienQwQQ0ChAPVONUWVOCCDgXYCVqXdyOkQAAY0CJFONUWVOCCDgXYBk
6p2cDhFAQKMAyVRjVJkTAgh4FyCZeienQwQQ0ChAMvUXVeqZ+rOmJwS8C5BMvZPTIQIIaBQgmWqM
KnNCAAHvAiRT7+R0iAACGgVIphqjypwQQMC7AMnUOzkdIoCARgGSqcaoMicEEPAuQDL1Tk6HCCCg
UYBkqjGqzAkBBLwLkEy9k9MhAghoFKCeqcaoMicEEPAuwMrUOzkdIoCARgGSqcaoMicEEPAuQDL1
Tk6HCCCgUYBkqjGqzAkBBLwLkEy9k9MhAghoFCCZaowqc0IAAe8CqpPpetybb72Tnu6Q8VQoGAwF
AccCqpOpYyuaQwABBE4KkEw5ORBAAAEXAjt929es+01mtJJ5rkaHz4dPl/18bcaj71RgRgj4E1D9
dVK5Rvn59DZpufil46INxuNCkTYQqKYAb/OrGRdGhQACNRMgmdYsYAwXAQSqKaD6bX41yRkVAgho
FGBlqjGqzAkBBLwLkEy9k9MhAghoFCCZaowqc0IAAe8CJFPv5HSIAAIaBUimGqPKnBBAwLsAydQ7
OR0igIBGAZKpxqgyJwQQ8C6gOZlu570iJfjW4wfZbAvSlHkQPnYbo6Thh/FYKgaGjdue97tLRzBe
Hwxomz0gPCrc5eJW0Odi++yAQKMENCfTgoHsv0oFlG6w/C2ZqTV520m9ku5s9zYp2Gz2cElny+GX
rcSwChaL6DXpeWe7W3WWUUVWMwIZzmy3e+3LbubhbtaVQi2m9kB4gD0ibC3chQ0BBHwKkEwvaA+H
weDYQi9dUcbrQLt2lPVlvKrMtz6M+zcJMZOpt/+WnedJ/1dn+S+pby2Ppmmj6/Fy+ETW9Pm/hb4Q
OCNAMr10evx8XQUvBwX7JW0mK0pZUg7Ct+eyWJS1oSwvw7J+sk58PzzsW1dyyHDZPnoBQXLpL8mU
YTZNjus/zd7/Rm/h13/fhz8rUxDrkiKvI6BegGR6OcT9p+HyMXOpdDtfdlZpZb/+a/pmPAhGq+g9
duu/zuWmg8C8XbfJd7hML8iux9Mwl4bZNLMabU2GNkVv5y/vw+oUF8wzU/ZBQLcAyTRHfFuTP8Pl
OF0g5jjk+l1ak+fR5sMuO9d/F8FiYFesA/kxXo3KS5Nn88bfXgS4vhOOQACBsgRIprlkJdMF0+nG
7pssD6NDzRvumxaJ8ql95s8Ntp/vI7salQblg6Z0S9/bR0vVdjteuOYaPTshgIAHAX9F/b33lH66
fVPXyU1Ooo/I5bH5MD26IJq9M4q9+UlydxLzMD44Ovb4AA5uoxLum97jxB56OIq9T+3jZg/vx2IH
dGkr6HOpeV5HoFkCmuuZysfrj8GfCt22xMPvxmu6wOcaLfZF4IIAb/M5RRBAAAEHAppXpg54aAIB
BBDIJ8DKNJ8TeyGAAAJnBUimnCAIIICAAwGSqQNEmkAAAQRIppwDCCCAgAMBkqkDRJpAAAEENCfT
ovU60xKi9oud11WB+n5u7X/h6f7nXlGf+8+AESBQIQHNybQos9R0kq8WJd8mkupQxfKpFNnjGwRF
g8LxCFRVgGSaOzL917SqXnbRGtfeT+rjm+/bZx5IB8nu3yv/p1X1e/P0zgDH2s89UHZEAIE7CJBM
r0CXqnqbjy85YP6YljNNSufJwtN+2z2qfW9XtWG957AufuZr93GfkkkHUflTU4IvrqRyvP0rBsqu
CCDgXYBkej251DPdbKZxTee2pMC4dJ4Ul+pMzW1OTMJ9eZ9dKIQfVoeKbzESJtzwMsDp9q8fK0cg
gIAnAZLpFdBSJK/7ox3IAjUpHxWVxUluuhTXwjfVnZ9vqssn69gz7V8xWnZFAAGfAiTT/Nrr31GC
NNXvT9331FQ+fZnnWJZKvwftmMun4V8MnGs//3DZEwEEvAoorjhYtF5nWlo0iki2TOgsW9A0/cg/
Lmy6V1H0sNyoublJ7J5tJ2f7rkJW1MfVOGgHARUCmqtGUa/z/K9lfLwuW+hMuwBv87VHmPkhgIAX
Ac0rUy+AdIIAAggYAVamnAcIIICAAwGSqQNEmkAAAQRIppwDCCCAgAMBkqkDRJpAAAEESKacAwgg
gIADAc3JlHqd508QfBz8B6IJBGIBzcmUKCOAAALeBEim3qjpCAEENAuQTDVHl7khgIA3AZKpN2o6
QgABzQIkU83RZW4IIOBNgGTqjZqOEEBAswDJVHN0mRsCCHgTIJl6o6YjBBDQLEAy1Rxd5oYAAt4E
qGfqjZqOEEBAswArU83RZW4IIOBNgGTqjZqOEEBAswDJVHN0mRsCCHgTIJl6o6YjBBDQLEAy1Rxd
5oYAAt4ESKbeqOkIAQQ0C6hOputxb76tUPQYT4WCwVAQcCygOpk6tqI5BBBA4KQAyZSTAwEEEHAh
sNO3fc2632RGK5nnanT4fPh02c/XZjz6TgVmhIA/AdVfJ5VrlJ9Pb5OWi186LtpgPC4UaQOBagrw
Nr+acWFUCCBQMwGSac0CxnARQKCaAqrf5leTnFEhgIBGAVamGqPKnBBAwLsAydQ7OR0igIBGAZKp
xqgyJwQQ8C5AMvVOTocIIKBRgGSqMarMCQEEvAuQTL2T0yECCGgUIJlqjCpzQgAB7wIkU3/k23mv
WiUB/U2dnhDQL0Ay1R9jZogAAh4ESKYekOkCAQT0C5BM9ceYGSKAgAcBkqkHZLpAAAH9AiRT/TFm
hggg4EGAZOoBmS4QQEC/AMlUf4yZIQIIeBAgmXpApgsEENAvQDLVH2NmiAACHgSotO8BmS4QQEC/
ACtT/TFmhggg4EGAZOoBmS4QQEC/AMlUf4yZIQIIeBAgmXpApgsEENAvQDLVH2NmiAACHgRIph6Q
oy6oZ+rPmp4Q8C5AMvVOTocIIKBRgGSqMarMCQEEvAuQTL2T0yECCGgUIJlqjCpzQgAB7wIkU+/k
dIgAAhoFSKYao8qcEEDAuwDJ1Ds5HSKAgEYBkqnGqDInBBDwLkAy9U5OhwggoFGAeqYao8qcEEDA
uwArU+/kdIgAAhoFSKYao8qcEEDAuwDJ1Ds5HSKAgEYBkqnGqDInBBDwLkAy9U5OhwggoFGAZOov
qgXrmcrhD4dbb771N356QgCBMwIk0zqdHt3Z1263W42C0Ur+3c267gc/743X7lulRQT0C5BMaxPj
1uTtbdLKDjd5wq5ZZZkar15NQrQ/29S4Hkc7JIeny9yebHPzfHjAdLMYxOtf0mptTg4GWgEBkmkF
glB4CJM3s17dTNvt5dAsWVfB33UgyfcrXrv2X8MFbbxJ2lwOzSLX7NvZbOzzcoBZ7dpVr9le+4VH
RgMINEaAZKon1OYiwNvEzKf/ej4PtibPnWnbLkAHi9HKHsWGAAIFBEimBfBqfKhZqkbbKhjYt/ls
CCBQQIBkWgCvDoe+f4af98sb+8EiGe9crpJm/wyg819mKtER4XVWrprWIcaMsSICyQKFH8oWkCuY
9uP4m7fkGmh48iQXNzNXQ/df2KUHdGczc83UDmD/zwDSi6ThNdTk0ur+8zcPmgMRaIYAVaP8/VKT
1eFj8OfgE3l/3dMTAgiUKcDb/DJ1aRsBBBojwMq0MaFmogggUKYAK9MydWkbAQQaI0AybUyomSgC
CJQpQDItU5e2EUCgMQIk08aEmokigECZAiTTMnVpGwEEGiNAMm1MqJkoAgiUKaA6ma7H1SqezHjK
PJVpG4H7CqhOpvelpXcEEGiSAMm0SdFmrgggUJ6AwhIE++VALF1YtOOwIEhcK6Tk52szHoXnAlNC
wJuA6q+TyjXKz6cKFRZhPOUtCmgZgXsL8Db/3hGgfwQQUCFAMlURRiaBAAL3FlD9Nv/euPSPAALN
EWBl2pxYM1MEEChRgGRaIi5NI4BAcwRIps2JNTNFAIESBUimJeLSNAIINEeAZNqcWDNTBBAoUYBk
WiIuTSOAQHMESKbNiTUzRQCBEgU0J1O5T315JfjmvYdoG4+l0l8YovU4fu4heiYIZBDxfmvZJX1o
hpY5INxpbHbxtpXq420WdIRARQQ0J9PyiCUNLYdftoDCKlgsop76r/JYypp0Z6vOUnKl2VqTNymw
0p3tdq/96OFu1pW6K6ZmQHiAPSJsLdyFDQEE6ihAMi0aNZMQ3yZJK9t/y87zpP+rs/xns6ls8mia
LjrX4+XwiaxZ1J3jEaiYAMn0loDIcnO4bEdv35N39GFLkkt/SaYMs2nSdP9p9v43egu//vs+/Nm6
pVeOQQCBCguQTG8Mjrx7t9vXcJleIV2Pp2EuPVyNtibD9xfzxn87f3kfyht8NgQQUCZAMi0a0Nbk
ebT5sMvO9d9FsBjYFetAfoxXo/LS5Nm88bcXAYp2yfEIIFA9AZLpDTGRD+Ezfyaw/Xwf2dWovIOX
D5rSLX1vHy1V2+144XpDrxyCAAJVFiCZ3hadzTS+ZPrQDj9PMn/zNFhspg9RnjV/9TTdyDI1Sbty
4VQ+td/76Mn+aVR7uoma8/unUbfNnKMQQOCogOZ6ppLfHoM/FbptScXOQXwqFhCGU28BVqb1jh+j
RwCBighoXplWhJhhIIBAEwRYmTYhyswRAQRKFyCZlk5MBwgg0AQBkmkToswcEUCgdAGSaenEdIAA
Ak0QIJk2IcrMEQEEShfQnEzLqteZ1iS1Xxwt+qf2+1+oKj3kSQdl+fibAT0hUCEBzcm0LGapGbUa
BVKSNC5oOiiWT6WIH98sKCtYtIuALwGSaWHp/uvXzJaEyhbSN18rtU0n5fT3auuHryZr3O93BEiL
8Pfm6R0Dsovi/dJ/hadBAwggUEiAZFqIzx7c+q+z+fiSH+aPSQH+tDSfLDxtLf2otr5d1Yb1pE0Z
/rDS/sEgJJMOgmjlKyX+ppvo9aPtO5gATSCAQGEBkmlhwqSB7XwZVyyx5UuCuDSflOnrTH/bMn1S
0HS/2sn3AYTVp+JbmIQJN7wMcLp9d3OgJQQQuFGAZHojXPYwKcLX/dE2C1Rzr6fsltzUKa61b6pH
P99YHPpc+w5mQRMIIFBEgGRaRM8eu/4dJUhzr6dT90OVxWnwMs+xLJUGD9oxl0/Dvxg4137xadAC
AggUEthfSal6lN710+20vl3jTD7Yl372r39mXwmvje49IVdPD7b05Ww7Odu/dpZl+Vw7DvZHQIWA
5qpR1Os8/2sWn0LLEA5GYF+At/mcEQgggIADAc0rUwc8NIEAAgjkE2Blms+JvRBAAIGzAiRTThAE
EEDAgQDJ1AEiTSCAAAIkU84BBBBAwIEAydQBIk0ggAACmpMp9TrPn9/48P8fAYcCmpOpQyaaQgAB
BM4LkEw5QxBAAAEHAiRTB4g0gQACCJBMOQcQQAABBwIkUweINIEAAgiQTDkHEEAAAQcCJFMHiDSB
AAIIkEw5BxBAAAEHAiRTB4g0gQACCFDPlHMAAQQQcCDAytQBIk0ggAACJFPOAQQQQMCBAMnUASJN
IIAAAiRTzgEEEEDAgQDJ1AEiTSCAAAIkU84BBBBAwIGA6mS6HvfmWwdIrppgPK4kaQeB6gmoTqbV
42ZECCCgVYBkqjWyzAsBBPwK7PRtX7PuN8PRSua5Gh0+Hz5d9vO1GY++U4EZIeBPQPXXSeUa5efT
26Tl99fT6d4YT1UiwTgQcC/A23z3prSIAAINFCCZNjDoTBkBBNwLqH6b756LFhFAAIHjAqxMOTMQ
QAABBwIkUweINIEAAgiQTDkHEEAAAQcCJFMHiDSBAAIIkEw5BxBAAAEHAiRTB4g0gQACCJBMOQcQ
QAABBwIkUweIOZvYznu3lwSUgx/sNl5Lf+nDc00mex3daT1+OH2wvPggL+ec2tHdzrZfpGGORaCK
AiTTKkblyJhakzcpyNKd7XavfXnZPNzNulKo5VztgXCv3bFCK6aH/uuZg+XF73Vhjoxr3guT+7Ht
bPs1YWeYCOQWIJnmprr/jv1fnWmautbj5fDJJFbZwnWk3fIsfk+uWNMFr10Ax9vR9sOdp5vFIO46
OeRo+/bJ8TgZaraHpIPefG7XxFWq6n3/0DOCGgiQTGsQpGSI/afZ+98oya3/vg9/JgWxfoW1BM02
XLZPrhXjhk6sWNfj9nL4ZZtZBYPBIrU51n66Oo66DtfMZjvavjwpa+TFIrBD/Zq9v8QZc94bxM8O
l9NFd/ZVoVpfdTpBGOs9BUim99S/uu/WZGhT0Hb+8j5Miwu2P1/i5eF0c3Wr0QGSnmd/4jb7r9mr
A07aD7sZraKU2/qvE/W7nS+DWfzs5M+RarS3zojjEPAoQDL1iO2iq8lzZ/lvu/237DxP0jfh6Yry
5BXSAp1nV6xltL83tDTJFhgxhyLgX4Bk6t+8WI/mwmm7Pe38it9TB9vP9268St3OH29empqWfydX
Ste/44YutP/+aS9vmsueFy8wHJu7LLeDZXKNdP6SubpQjIqjEfAq4K+of+N7kvfNcjWwOMP3djLv
yLujkblpy023adm/gctoZO7yYv5+ILsazbZvL64m94Kx94A5eRuYZJBmv/ioCCQ7ga4bpeLOtIDA
VQLUM/X3q0s+zn4M/vDRynlxlPydkfTkVIC3+U45aexWgeQ7CXL5l983typy3D0FWJneU5++EUBA
jQArUzWhZCIIIHBPAZLpPfXpGwEE1AiQTNWEkokggMA9BUim99SnbwQQUCNAMlUTSiaCAAL3FCCZ
+tMvVM/U3zDr3VPyJ1amPlVUj3Wv5lU0vbP1YTMHpCVk6+2SGX1d6szWZZwp7VV/4s/ORQRcfQOq
yBh0H5sVNt+xCr++FW3ha6YibPodNFsfNt3C+rAHRzj4xtpV5gdjuOrYM3O5uZ26H+jKM48DK1M1
Cw4msicgpaml9nXylC0NI+UHpExM/OTp+rDXWIZr4agM60FFWbtMltqs8To4rV2QrqCTggan68Nm
bqxwePuDdBEtQ7B3criyzqyd6/fxnK0/ewTojMOp8Z/yOVIP1z7V64XVcMfraNqxZ6YOb3p7iOs9
z8Qr1xmRJ+OyjxMBVqZOGM83khbwO77q3F+NSkjixej+otV0kj9eYadxQ6bOQGaFa6sQ2MGsRvYF
2SNdIcsOmaEeXUllizqY5uP9TdvZbjOtnlmRfZ/XqfGEJROiDvJonHI4NX5r8t3Hhviwx2Q08bST
6J1p/yrP8+O5ePYGF/dgB1cCeU5HV33RTjbpmP+xadLMpjrJa2FaC2NzgJY/Xvvp0zSWZtOjSXrv
ckJ4O5r4csKR//xHbjtjjz+8TJHzbf6RJHViPBcm8u0kO+5wcvzh8d994maPjDP+nWRDGA3vbPvX
eF4Yz8X/U7zNz7V+Z6faCbQmz6PNh60ouP67COK7q8j9Axbx3QrkpWP1YW+Ya/dH+4aj8h0iFV4P
E31yT4N8Lfjb65hD2eO/tv1r98+t5zCZ2ssY3yta8vz5aOBjfU455D6XTQuZe0dJGdaRLfpqbiGw
t2pL7v0iL36vD5u/w3TPzfQxvZOrXJ5Nq81+by25XUL0krkBTXrThOB7fVgzxGM3xTp4/qCgbO46
sxfGcxXHUYdT47+q5TM7n28/v2fR8ThMpkWHwvEIFBbYTNvx/Vuk/JTcb9B8CjFYbKbxPfpMxglv
AphkJ7mxlrzFj29NmMnr7ekmau5yzevuqLNM7mkY3+gw/PVgOo/GlDQz+SN36kp2HwTpTRPMSjna
3dwWK1qByodp2QOSJcv+85kDwhX3t3aiT23SecVLn6PjETnZU6TMsOXQcCKXbnR41MHcB/fY+E/5
HBunHY3E0SIuBnYkdninfOw7j9yeJ+OV87SkalROKAe7UanTAWIlm5CP0SlUK5FpuAMr00r+72RQ
9RGQpW+0hI2+I1CfoTsdKQ6sTJ2eUDSGAAJNFWBl2tTIM28EEHAqQDJ1ykljCCDQVAGSaVMjz7wR
QMCpAMnUKSeNIYBAUwVIpk2NPPNGAAGnAiRTp5xnG6OeqT9rekLAuwDJ1Ds5HSKAgEYBkqnGqDIn
BBDwLkAy9U5OhwggoFGAZKoxqswJAQS8C5BMvZPTIQIIaBQgmWqMKnNCAAHvAiRT7+R0iAACGgVI
phqjypwQQMC7AMnUOzkdIoCARgHqmWqMKnNCAAHvAqxMvZPTIQIIaBQgmWqMKnNCAAHvAiRT7+R0
iAACGgVIphqjypwQQMC7AMnUOzkdIoCARgGSqcaoMicEEPAuoDqZrse9+dY76ekOGU+FgsFQEHAs
oDqZOraiOQQQQOCkAMmUkwMBBBBwIbDTt33Nut9kRiuZ52p0+Hz4dNnP12Y8+k4FZoSAPwHVXyeV
a5SfT2+TlotfOi7aYDwuFGkDgWoK8Da/mnFhVAggUDMBkmnNAsZwEUCgmgKq3+ZXk5xRIYCARgFW
phqjypwQQMC7AMnUOzkdIoCARgGSqcaoMicEEPAuQDL1Tk6HCCCgUYBkqjGqzAkBBLwLkEy9k9Mh
AghoFCCZaowqc0IAAe8CmpPpdt4rpQSftPuQ3cZrG7b12D5rHmd/3nvx4UHGNO/ZYw4aKmW0p0+p
sny8n8R0iEAVBDQn07J8W5M3KZlia6SYMinBIMyfQf9VSprI069987MpnzJamZ/D1DoIov2/hsv2
dGPHtt/Qbrh8rFT91bIAaRcBjQIk08JRNTn0/eVMFtzOXyST2rQaBJKKJQPHj/Z6/zkMPr4Kj4cG
EEDgHgIkUwfqrf86mzgLLgbxFYDBovujbVr/+gjsD5e2f8ucO15qiNcRQMC7AMnUMXny7v9IldTj
XaXpdzn8U516gY5daA4B7QIkUwcR3n6+R4vQo421fwTLf6e7SdNvhUqvOlChCQSaJUAyLR7v9e9p
5/nMkrI1ee5MM5/Um0/6478AKN47LSCAQCUESKbXh0H+pGiwCDIXR4PwQ3t5Wj6ml6ejP40aLDbT
ts2h8tm+fIafXExNPo7KNOT5z6KunzVHIIDAWQHN9Uwluz0Gf3jvfOoEwIfkgIBDAVamDjFpCgEE
miugeWXa3KgycwQQ8C7AytQ7OR0igIBGAZKpxqgyJwQQ8C5AMvVOTocIIKBRgGSqMarMCQEEvAuQ
TL2T0yECCGgU0JxMndTrjAuT7tUhTSqaHv1TezmkFn+C78RH438K5oTALQKak+ktHvvHnKpDasvo
SfXSo13I952Kf1Mgrh9dfBK0gAACPgRIpqeVc9chTZo4uWLNFufvze3+9rnxOKrPn35fP3wh/GJq
tPFFfh//FegDgWICJNPTfrnrkCZNnFqxzh+Xw6+oML9U2perAHKI7Cxr28UiKsGfVpgOWwlr9kfb
0UrSxeLO0Qgg4FiAZOoY9Ehz2/lyIzVPomWmuWfJ5iO6bVSQ3NkkkArT5Q+FHhBAoCwBkulp2Qt1
SHOHRNJkdxavMu2/rDVz67EjAjURIJmeDpSzOqT9X3v1THOeGu+fpnqfvdEpV01zorEbAvcT2F8x
qXokVyS7s/hS5a0zy35iH1/FlPuOHmz2lVPPm9f2P/k3+yd/DGAexIemA04bSy+e3jqJ48c58XE7
JFpDoL4CmqtGUa/z/O9ofO63hqFnhQK8zVcYVKaEAAL+BTSvTP1r0iMCCDRWgJVpY0PPxBFAwKUA
ydSlJm0hgEBjBUimjQ09E0cAAZcCJFOXmrSFAAKNFSCZNjb0TBwBBFwKaE6m1Os8f6bg4/J/Em01
XkBzMm18cAFAAAF/AiRTf9b0hAACigVIpoqDy9QQQMCfAMnUnzU9IYCAYgGSqeLgMjUEEPAnQDL1
Z01PCCCgWIBkqji4TA0BBPwJkEz9WdMTAggoFiCZKg4uU0MAAX8C1DP1Z01PCCCgWICVqeLgMjUE
EPAnQDL1Z01PCCCgWIBkqji4TA0BBPwJkEz9WdMTAggoFiCZKg4uU0MAAX8CJFN/1vSEAAKKBVQn
0/W4N99WKHiMp0LBYCgIOBZQnUwdW9EcAgggcFKAZMrJgQACCLgQ2OnbvmbdbzKjlcxzNTp8Pny6
7OdrMx59pwIzQsCfgOqvk8o1ys+nt0nLxS8dF20wHheKtIFANQV4m1/NuDAqBBComQDJtGYBY7gI
IFBNAdVv86tJzqgQQECjACtTjVFlTggg4F2AZOqdnA4RQECjAMlUY1SZEwIIeBcgmXonp0MEENAo
QDLVGFXmhAAC3gVIpt7J6RABBDQK/B+rCO9hLbq4BgAAAABJRU5ErkJggg==

------=_NextPart_000_0031_01CF4FFA.FA4E2F80--



From nobody Fri Apr  4 19:37:12 2014
Return-Path: <leaf.yeh.sdo@gmail.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E8CA1A019F for <savi@ietfa.amsl.com>; Fri,  4 Apr 2014 19:37:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level: 
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wp3NKiUTF2x2 for <savi@ietfa.amsl.com>; Fri,  4 Apr 2014 19:37:04 -0700 (PDT)
Received: from mail-pb0-x22d.google.com (mail-pb0-x22d.google.com [IPv6:2607:f8b0:400e:c01::22d]) by ietfa.amsl.com (Postfix) with ESMTP id BDB1A1A0056 for <savi@ietf.org>; Fri,  4 Apr 2014 19:37:04 -0700 (PDT)
Received: by mail-pb0-f45.google.com with SMTP id uo5so4259380pbc.32 for <savi@ietf.org>; Fri, 04 Apr 2014 19:37:00 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=from:to:cc:references:in-reply-to:subject:date:message-id :mime-version:content-type:thread-index:content-language; bh=uq7E5QuKIuZYHAXPtj9tI4FeGRlX1xnZvtS90n0wTVU=; b=IRgut5SPgYbDKJXvr7CUPLCYU9NxKUZeznexbS7Pb8xfccaxBssxein+6DGolpTLVU /khKIOys7hecyOPuLQv3HigziMmFu+8zo8wonK9CgCkmgswQ0ihrlikCqfviQcD7KYEY Vjq7aqfezjGHP3eSu/E616zKg/9arb+CFf/nxziS83JJaSqjcXmvjgI60gY4S6OVnLZJ tc5yoNUGrLsTXsEm4hzerQ90asQ7SoR/inamnyUtegPZwzkeDoI8kxqmuVjH+vO+Oots LdoOWK2x+8wcw8UFGHtm1iBwEbZjtArjmpLu9hhn1NSwcFbB/KN4SEjbyA4Cq/Q5bPh5 PzDQ==
X-Received: by 10.66.145.166 with SMTP id sv6mr18674068pab.31.1396665420098; Fri, 04 Apr 2014 19:37:00 -0700 (PDT)
Received: from PC ([111.193.212.109]) by mx.google.com with ESMTPSA id id10sm20878620pbc.35.2014.04.04.19.36.13 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 04 Apr 2014 19:36:59 -0700 (PDT)
From: "Leaf Yeh" <leaf.yeh.sdo@gmail.com>
To: <nordmark@acm.org>, <marcelo@it.uc3m.es>, <elevyabe@cisco.com>
References: <20140321105153.C31F37FC399@rfc-editor.org> <4191B0B1-BCEE-4F0B-BC06-A17F26A09533@nominum.com> <532d7728.4387440a.099e.4779@mx.google.com> <4B7FAFCA-B811-472A-A812-C08E97FF713D@nominum.com>
In-Reply-To: <4B7FAFCA-B811-472A-A812-C08E97FF713D@nominum.com>
Date: Sat, 5 Apr 2014 10:35:43 +0800
Message-ID: <533f6c4b.6ac3440a.1a50.430e@mx.google.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_00B7_01CF50BA.E8DC6210"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: Ac9Hcn8GZbjmEjb0R9aYj0NBaxMuiQJAVX8A
Content-Language: zh-cn
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/AfFTA7rwiX4Uu7bFBq7sdR52D8E
Cc: savi@ietf.org, 'Ted Lemon' <ted.lemon@nominum.com>
Subject: Re: [savi] [Editorial Errata Reported] RFC6620 (3926)
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 05 Apr 2014 02:37:09 -0000

This is a multi-part message in MIME format.

------=_NextPart_000_00B7_01CF50BA.E8DC6210
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Dear Eric and authors:

 

Pls. verify this Errata ticket (3926 @
http://www.rfc-editor.org/errata_search.php?rfc=6620 ).

 

BTW, could you tell me the meaning of the sign of '.../-' in the Fig.2 of
RFC6620 (http://tools.ietf.org/html/rfc6620#section-3.2.3 )? 

For example, VP_NA/-, TimeOut/-, etc.

 

 

Best Regards,

Leaf

 

 

 

-----Original Message-----
From: Ted Lemon [mailto:ted.lemon@nominum.com] 
Sent: Monday, March 24, 2014 11:05 PM
To: Leaf Yeh
Cc: savi@ietf.org; nordmark@acm.org; marcelo@it.uc3m.es; elevyabe@cisco.com;
Brian Haberman; jeanmichel.combes@gmail.com
Subject: Re: [Editorial Errata Reported] RFC6620 (3926)

 

On Mar 22, 2014, at 6:42 AM, Leaf Yeh < <mailto:leaf.yeh.sdo@gmail.com>
leaf.yeh.sdo@gmail.com> wrote:

> Could we ask the input from the authors of RFC 6620 or the input from 

> SAVI-WG on this reported Errata?

 

Could the authors please work with Leaf to figure out if this erratum is
correct?   I do not have time to wade deeply enough into the document to
either accept or reject it on my own at the moment.

 

Thanks!


------=_NextPart_000_00B7_01CF50BA.E8DC6210
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 12 =
(filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	text-align:justify;
	text-justify:inter-ideograph;
	font-size:10.5pt;
	font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
	{mso-style-priority:99;
	mso-style-link:"\7EAF\6587\672C Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:10.5pt;
	font-family:"Calibri","sans-serif";}
span.Char
	{mso-style-name:"\7EAF\6587\672C Char";
	mso-style-priority:99;
	mso-style-link:\7EAF\6587\672C;
	font-family:"Calibri","sans-serif";}
.MsoChpDefault
	{mso-style-type:export-only;}
/* Page Definitions */
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DZH-CN link=3Dblue =
vlink=3Dpurple style=3D'text-justify-trim:punctuation'><div =
class=3DWordSection1><p class=3DMsoPlainText><span lang=3DEN-US>Dear =
Eric and authors:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Pls. verify this Errata ticket (3926 @ <a =
href=3D"http://www.rfc-editor.org/errata_search.php?rfc=3D6620">http://ww=
w.rfc-editor.org/errata_search.php?rfc=3D6620</a> =
).<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>BTW, could you tell me the meaning of the sign of '...<span =
style=3D'color:red'>/-</span>' in the Fig.2 of RFC6620 (<a =
href=3D"http://tools.ietf.org/html/rfc6620#section-3.2.3">http://tools.ie=
tf.org/html/rfc6620#section-3.2.3</a> )? <o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>For example, VP_NA<span =
style=3D'color:red'>/-</span>, TimeOut<span =
style=3D'color:red'>/-</span>, etc.<o:p></o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoPlainText><span lang=3DEN-US>Best =
Regards,<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Leaf<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>-----Original Message-----<br>From: Ted Lemon =
[mailto:ted.lemon@nominum.com] <br>Sent: Monday, March 24, 2014 11:05 =
PM<br>To: Leaf Yeh<br>Cc: savi@ietf.org; nordmark@acm.org; =
marcelo@it.uc3m.es; elevyabe@cisco.com; Brian Haberman; =
jeanmichel.combes@gmail.com<br>Subject: Re: [Editorial Errata Reported] =
RFC6620 (3926)<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>On Mar 22, 2014, at 6:42 AM, Leaf Yeh &lt;<a =
href=3D"mailto:leaf.yeh.sdo@gmail.com"><span =
style=3D'color:windowtext;text-decoration:none'>leaf.yeh.sdo@gmail.com</s=
pan></a>&gt; wrote:<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&gt; Could we ask the input from the authors of RFC 6620 or =
the input from <o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>&gt; SAVI-WG on this reported =
Errata?<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Could the authors please work with Leaf to figure out if =
this erratum is correct?&nbsp;&nbsp; I do not have time to wade deeply =
enough into the document to either accept or reject it on my own at the =
moment.<o:p></o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p class=3DMsoPlainText><span =
lang=3DEN-US>Thanks!<o:p></o:p></span></p></div></body></html>
------=_NextPart_000_00B7_01CF50BA.E8DC6210--


From nobody Sat Apr  5 01:13:09 2014
Return-Path: <marcelo@it.uc3m.es>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 078DB1A0369 for <savi@ietfa.amsl.com>; Sat,  5 Apr 2014 01:13:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.211
X-Spam-Level: 
X-Spam-Status: No, score=-104.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_WHITELIST=-100] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xjHdSVT_hqEC for <savi@ietfa.amsl.com>; Sat,  5 Apr 2014 01:12:59 -0700 (PDT)
Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by ietfa.amsl.com (Postfix) with ESMTP id 703C21A0367 for <savi@ietf.org>; Sat,  5 Apr 2014 01:12:59 -0700 (PDT)
Received: from smtp02.uc3m.es (localhost [127.0.0.1]) by localhost.uc3m.es (Postfix) with ESMTP id A427D894AC1; Sat,  5 Apr 2014 10:12:53 +0200 (CEST)
X-uc3m-safe: yes
X-uc3m-safe: yes
Received: from [10.0.1.2] (15.111.220.87.dynamic.jazztel.es [87.220.111.15]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: marcelo@smtp02.uc3m.es) by smtp02.uc3m.es (Postfix) with ESMTPSA id 4D3A388738C; Sat,  5 Apr 2014 10:12:53 +0200 (CEST)
Message-ID: <533FBB04.1010404@it.uc3m.es>
Date: Sat, 05 Apr 2014 10:12:52 +0200
From: marcelo bagnulo braun <marcelo@it.uc3m.es>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Thunderbird/24.4.0
MIME-Version: 1.0
To: Leaf Yeh <leaf.yeh.sdo@gmail.com>, nordmark@acm.org,  elevyabe@cisco.com
References: <20140321105153.C31F37FC399@rfc-editor.org> <4191B0B1-BCEE-4F0B-BC06-A17F26A09533@nominum.com> <532d7728.4387440a.099e.4779@mx.google.com> <4B7FAFCA-B811-472A-A812-C08E97FF713D@nominum.com> <533f6c4b.6ac3440a.1a50.430e@mx.google.com>
In-Reply-To: <533f6c4b.6ac3440a.1a50.430e@mx.google.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
X-TM-AS-Product-Ver: IMSS-7.1.0.1224-7.5.0.1017-20610.006
X-TM-AS-Result: No--21.979-7.0-31-1
X-imss-scan-details: No--21.979-7.0-31-1
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/I1tfYtUxVS2FNOE9hovggtjw_QI
Cc: savi@ietf.org, 'Ted Lemon' <ted.lemon@nominum.com>
Subject: Re: [savi] [Editorial Errata Reported] RFC6620 (3926)
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 05 Apr 2014 08:13:04 -0000

Hi,

thanks for spotting this. I agree with the Errata and it should be approved.

Regards, marcelo


El 05/04/14 04:35, Leaf Yeh escribió:
>
> Dear Eric and authors:
>
> Pls. verify this Errata ticket (3926 @ 
> http://www.rfc-editor.org/errata_search.php?rfc=6620 ).
>
> BTW, could you tell me the meaning of the sign of '.../-' in the Fig.2 
> of RFC6620 (http://tools.ietf.org/html/rfc6620#section-3.2.3 )?
>
> For example, VP_NA/-, TimeOut/-, etc.
>
> Best Regards,
>
> Leaf
>
> -----Original Message-----
> From: Ted Lemon [mailto:ted.lemon@nominum.com]
> Sent: Monday, March 24, 2014 11:05 PM
> To: Leaf Yeh
> Cc: savi@ietf.org; nordmark@acm.org; marcelo@it.uc3m.es; 
> elevyabe@cisco.com; Brian Haberman; jeanmichel.combes@gmail.com
> Subject: Re: [Editorial Errata Reported] RFC6620 (3926)
>
> On Mar 22, 2014, at 6:42 AM, Leaf Yeh <leaf.yeh.sdo@gmail.com 
> <mailto:leaf.yeh.sdo@gmail.com>> wrote:
>
> > Could we ask the input from the authors of RFC 6620 or the input from
>
> > SAVI-WG on this reported Errata?
>
> Could the authors please work with Leaf to figure out if this erratum 
> is correct?   I do not have time to wade deeply enough into the 
> document to either accept or reject it on my own at the moment.
>
> Thanks!
>


From nobody Sat Apr  5 04:59:55 2014
Return-Path: <wwwrun@rfc-editor.org>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FB861A0166; Sat,  5 Apr 2014 04:59:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.912
X-Spam-Level: 
X-Spam-Status: No, score=-1.912 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vi1KqxXZjzCZ; Sat,  5 Apr 2014 04:59:46 -0700 (PDT)
Received: from rfc-editor.org (rfc-editor.org [IPv6:2607:f170:8000:1500::d3]) by ietfa.amsl.com (Postfix) with ESMTP id E79CC1A0158; Sat,  5 Apr 2014 04:59:45 -0700 (PDT)
Received: by rfc-editor.org (Postfix, from userid 30) id 75FA77FC3A9; Sat,  5 Apr 2014 04:59:40 -0700 (PDT)
To: leaf.yeh.sdo@gmail.com, nordmark@acm.org, marcelo@it.uc3m.es, elevyabe@cisco.com
From: RFC Errata System <rfc-editor@rfc-editor.org>
Message-Id: <20140405115940.75FA77FC3A9@rfc-editor.org>
Date: Sat,  5 Apr 2014 04:59:40 -0700 (PDT)
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/eAHfMcpeF1TNA_VsukFxwFyMONU
Cc: rfc-editor@rfc-editor.org, savi@ietf.org, ted.lemon@nominum.com, iesg@ietf.org
Subject: [savi] [Errata Verified] RFC6620 (3926)
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 05 Apr 2014 11:59:51 -0000

The following errata report has been verified for RFC6620,
"FCFS SAVI: First-Come, First-Served Source Address Validation Improvement for Locally Assigned IPv6 Addresses". 

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=6620&eid=3926

--------------------------------------
Status: Verified
Type: Editorial

Reported by: Leaf Yeh <leaf.yeh.sdo@gmail.com>
Date Reported: 2014-03-21
Verified by: Ted Lemon (IESG)

Section: 3.2.3

Original Text
-------------
   +---------+  VP_NS, VP_DATA/2xNS                    +-----------+
   |         |---------------------------------------->|           |
   | NO_BIND |                                         | TENTATIVE |
   |         |<----------------------------------------|           |
   +---------+                    TP_NA, TP_NS/-       +-----------+
          ^                                                |
          |                                                | TimeOut
   Timeout|                                                |
          |                                                v
   +---------+  VP_NA/-                                +-----------+
   |         |---------------------------------------->|           |
   | TESTING |                                TP_NS/-  |           |
   |  TP-LT  |<----------------------------------------|   VALID   |
   |         |                           TimeOut/2xNS  |           |
   |         |<----------------------------------------|           |
   +---------+                                         +-----------+
     ^   |                                                ^    |
     |   |                                                |    |
     |   +---------------------      ---------------------+    |
     |       VP_NS/-          |     |  NP_NA, TimeOut/-        |
     |                        v     |                          |
     |                     +-----------+                       |
     |                     |           |                       |
     +---------------------|  TESTING  |<----------------------+
          VP_NS, VP_DATA/- |    VP     |  VP_DATA, VP_NS,
                           +-----------+  VP_NA/2xNS

                    Figure 2: Simplified State Machine

Corrected Text
--------------
   +---------+  VP_NS, VP_DATA/2xNS                    +-----------+
   |         |---------------------------------------->|           |
   | NO_BIND |                                         | TENTATIVE |
   |         |<----------------------------------------|           |
   +---------+                    TP_NA, TP_NS/-       +-----------+
          ^                                                |
          |                                                | TimeOut
   Timeout|                                                |
          |                                                v
   +---------+  VP_NA/-                                +-----------+
   |         |---------------------------------------->|           |
   | TESTING |                                TP_NS/-  |           |
   |  TP-LT  |<----------------------------------------|   VALID   |
   |         |                           TimeOut/2xNS  |           |
   |         |<----------------------------------------|           |
   +---------+                                         +-----------+
     ^   |                                                ^    |
     |   |                                                |    |
     |   +---------------------      ---------------------+    |
     |       VP_NS/-          |     |  VP_NA, TimeOut/-        |
     |                        v     |                          |
     |                     +-----------+                       |
     |                     |           |                       |
     +---------------------|  TESTING  |<----------------------+
          TP_NS, TP_DATA/- |    VP     |  VP_DATA, VP_NS,
                           +-----------+  VP_NA/2xNS

                    Figure 2: Simplified State Machine

Notes
-----
a. According to the description on the state machine at page 19,

 <quote>
o  If an NA message containing the IPAddr as the Target Address is
      received through the Validating Port P as a reply to the DAD_NS
      message, then the NA is forwarded as usual and the state is
      changed to VALID.  The LIFETIME is set to DEFAULT_LT.
 </quote>

the state change from TESTING_VP  to VALID should be triggered by the  VP_NA (NA message containing the IPAddr as the Target Address is received through the Validating Port).


b. According to the description on the state machine at page 19,

 <quote>
   o  If a data packet containing IPAddr as the source address is
      received through a Trusted Port (i.e., other than port P), the
      state is moved to TESTING_TP-LT, and the packet MAY be discarded.

   o  If a DAD_NS is received through a Trusted Port, the packet is
      forwarded as usual, and the state is moved to TESTING_TP-LT.
 </quote>

the state change from TESTING_VP  to TESTING_TP-LT should be triggered by the TP_DATA (data packet containing IPAddr as the source address received through a Trusted Port), or by the TP_NS (DAD_NS is received through a Trusted Port).

--------------------------------------
RFC6620 (draft-ietf-savi-fcfs-14)
--------------------------------------
Title               : FCFS SAVI: First-Come, First-Served Source Address Validation Improvement for Locally Assigned IPv6 Addresses
Publication Date    : May 2012
Author(s)           : E. Nordmark, M. Bagnulo, E. Levy-Abegnoli
Category            : PROPOSED STANDARD
Source              : Source Address Validation Improvements
Area                : Internet
Stream              : IETF
Verifying Party     : IESG


From nobody Tue Apr  8 03:15:30 2014
Return-Path: <jeanmichel.combes@gmail.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B776A1A0289 for <savi@ietfa.amsl.com>; Tue,  8 Apr 2014 03:15:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level: 
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wPmByajqnwiN for <savi@ietfa.amsl.com>; Tue,  8 Apr 2014 03:15:22 -0700 (PDT)
Received: from mail-wg0-x233.google.com (mail-wg0-x233.google.com [IPv6:2a00:1450:400c:c00::233]) by ietfa.amsl.com (Postfix) with ESMTP id 03D171A01FA for <savi@ietf.org>; Tue,  8 Apr 2014 03:15:21 -0700 (PDT)
Received: by mail-wg0-f51.google.com with SMTP id k14so710935wgh.22 for <savi@ietf.org>; Tue, 08 Apr 2014 03:15:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=mime-version:date:message-id:subject:from:to:cc:content-type;  bh=blEMQOOd4su4yLTK4dzvWQXNCB7gkd8OeyoA7giUFDU=; b=YTbUr/6amobcEJqxOmNPZ6cietsVs5QgZ9Y55oq4ZgwD1eIGKnKqFT9XGAN6R78lx2 4jTBsR6mOjh9CZFTiyPJqFTLib7g2akg66sM8QDKmHaXTck3Nh06Nznlm8hg0IFEhnWg 6KkWMrv5DgDZgLGKRSxZxYlvggVUUEhiP8eCzcEx4vMydU5d+ptTDHRET8sM5IpNqb75 Lw53ABpDjGr8yuXUmFxfYEfhdEEqVOYN//P/z8PlcvCAu1dQcveqeRAbmYJ76Jhxv1Pc Jdv9Kf2uYUNPd8TIdQIuCsU+4shSQ/aQfFX6MfLWliU2fx/0GCPSqr+7AOMRiQMNmolX MbIw==
MIME-Version: 1.0
X-Received: by 10.180.105.132 with SMTP id gm4mr5931244wib.39.1396952115522; Tue, 08 Apr 2014 03:15:15 -0700 (PDT)
Received: by 10.217.107.137 with HTTP; Tue, 8 Apr 2014 03:15:15 -0700 (PDT)
Date: Tue, 8 Apr 2014 12:15:15 +0200
Message-ID: <CAA7e52osoEKeo=EqGF2=PTUrnxC=+8c+GkvF1v4DBQYELYQ6_A@mail.gmail.com>
From: Jean-Michel Combes <jeanmichel.combes@gmail.com>
To: SAVI Mailing List <savi@ietf.org>
Content-Type: multipart/alternative; boundary=f46d044280ea9d31e704f685428b
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/0ymjxtFOwLB-d2nNOYpFLTcx858
Cc: "<draft-ietf-savi-dhcp@tools.ietf.org>" <draft-ietf-savi-dhcp@tools.ietf.org>, Ted Lemon <mellon@fugue.com>
Subject: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 08 Apr 2014 10:15:26 -0000

--f46d044280ea9d31e704f685428b
Content-Type: text/plain; charset=ISO-8859-1

Folks,

As it has been deeply modified since the last WGLC (version -06), this is a
new two weeks WGLC for the following document: "SAVI Solution for DHCP" (
http://tools.ietf.org/html/draft-ietf-savi-dhcp-22).

Please, don't hesitate to give your opinion (i.e., agreement/disagreement
to move forward the document, comments, etc.)!

Thanks in advance.

Best regards,

JMC.

--f46d044280ea9d31e704f685428b
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div><div><div><div>Folks,<br><br></div>As it has bee=
n deeply modified since the last WGLC (version -06), this is a new two week=
s WGLC for the following document: &quot;SAVI Solution for DHCP&quot; (<a h=
ref=3D"http://tools.ietf.org/html/draft-ietf-savi-dhcp-22">http://tools.iet=
f.org/html/draft-ietf-savi-dhcp-22</a>).<br>
<br></div>Please, don&#39;t hesitate to give your opinion (i.e., agreement/=
disagreement to move forward the document, comments, etc.)!<br><br></div>Th=
anks in advance.<br><br></div>Best regards,<br><br></div>JMC.<br></div>

--f46d044280ea9d31e704f685428b--


From nobody Tue Apr  8 21:48:44 2014
Return-Path: <internet-drafts@ietf.org>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E12C11A00B0; Tue,  8 Apr 2014 21:48:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yuaBMMYdCmvo; Tue,  8 Apr 2014 21:48:36 -0700 (PDT)
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BC0F1A00B9; Tue,  8 Apr 2014 21:48:32 -0700 (PDT)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: internet-drafts@ietf.org
To: i-d-announce@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 5.2.0
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <20140409044832.9939.62815.idtracker@ietfa.amsl.com>
Date: Tue, 08 Apr 2014 21:48:32 -0700
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/OwZ3iD_JYpXScX7b5iiZOnuBHXM
Cc: savi@ietf.org
Subject: [savi] I-D Action: draft-ietf-savi-dhcp-23.txt
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Apr 2014 04:48:38 -0000

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Source Address Validation Improvements Working Group of the IETF.

        Title           : SAVI Solution for DHCP
        Authors         : Jun Bi
                          Jianping Wu
                          Guang Yao
                          Fred Baker
	Filename        : draft-ietf-savi-dhcp-23.txt
	Pages           : 43
	Date            : 2014-04-08

Abstract:
   This document specifies the procedure for creating a binding between
   a DHCPv4/DHCPv6 assigned IP address and a binding anchor on a SAVI
   (Source Address Validation Improvements) device.  The bindings set up
   by this procedure can be used to filter out packets with forged
   source IP address in DHCP scenario.  This mechanism is proposed as a
   complement to ingress filtering to provide finer-grained source IP
   address validation.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-savi-dhcp-23

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-savi-dhcp-23


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


From nobody Wed Apr 16 09:58:49 2014
Return-Path: <jeanmichel.combes@gmail.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13D241A014B for <savi@ietfa.amsl.com>; Wed, 16 Apr 2014 09:58:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level: 
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B7zb-6ERHupJ for <savi@ietfa.amsl.com>; Wed, 16 Apr 2014 09:58:46 -0700 (PDT)
Received: from mail-wi0-x22a.google.com (mail-wi0-x22a.google.com [IPv6:2a00:1450:400c:c05::22a]) by ietfa.amsl.com (Postfix) with ESMTP id E28851A01F2 for <savi@ietf.org>; Wed, 16 Apr 2014 09:58:45 -0700 (PDT)
Received: by mail-wi0-f170.google.com with SMTP id bs8so1605576wib.5 for <savi@ietf.org>; Wed, 16 Apr 2014 09:58:42 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=6o8p4vgQuoaIhodtBG8HuhBYtkMbV0+rDFhi+PzitBA=; b=VVY7hkQIMNpZ9Gw84ElholnhqWjAiyeOCno0JA/UZBdlt1yXfvOpm49sYGBOuju3B/ bPtcW97kOB+8tHIjHICL8UISwaaFnn045FB7Fd2/A+cHBOo7PJ24U5u7ZlRQ1CNQlObR klkn1aSlk1H/+cDSgMUqK/oe76qKjKaTeCkmNtaD+v10XjbAtlNjVpmFFX3j/E9tFSHB R1Gq6N8M2A5pEdChDxqKKstx5HvjtRS8RkMJK7w5IB/b/30w9+UC+IceCMzovhYJNtwi UIbWxBaRZzKzEn1gYtJmmXYm3raZ3f0srWuAW7mvJNJZGIRbh5Ne9Nmq4ZybSgUm2fnT MbDQ==
MIME-Version: 1.0
X-Received: by 10.194.109.6 with SMTP id ho6mr8035782wjb.21.1397667522133; Wed, 16 Apr 2014 09:58:42 -0700 (PDT)
Received: by 10.217.107.137 with HTTP; Wed, 16 Apr 2014 09:58:42 -0700 (PDT)
In-Reply-To: <CAA7e52osoEKeo=EqGF2=PTUrnxC=+8c+GkvF1v4DBQYELYQ6_A@mail.gmail.com>
References: <CAA7e52osoEKeo=EqGF2=PTUrnxC=+8c+GkvF1v4DBQYELYQ6_A@mail.gmail.com>
Date: Wed, 16 Apr 2014 18:58:42 +0200
Message-ID: <CAA7e52rte6tSQ4QQdfWY4t6PBOPV03h-rPJYN-FTfV9xOMUwiQ@mail.gmail.com>
From: Jean-Michel Combes <jeanmichel.combes@gmail.com>
To: SAVI Mailing List <savi@ietf.org>
Content-Type: multipart/alternative; boundary=047d7bf10b502bc6b404f72bd451
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/eNr7pZieXD5oxCsjBBIatbdiCJM
Cc: "<draft-ietf-savi-dhcp@tools.ietf.org>" <draft-ietf-savi-dhcp@tools.ietf.org>, Ted Lemon <mellon@fugue.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Apr 2014 16:58:48 -0000

--047d7bf10b502bc6b404f72bd451
Content-Type: text/plain; charset=UTF-8

Folks,

just a reminder regarding this WGLC :)

Thanks in advance for your replies.

Best regards,

JMC.


2014-04-08 12:15 GMT+02:00 Jean-Michel Combes <jeanmichel.combes@gmail.com>:

> Folks,
>
> As it has been deeply modified since the last WGLC (version -06), this is
> a new two weeks WGLC for the following document: "SAVI Solution for DHCP" (
> http://tools.ietf.org/html/draft-ietf-savi-dhcp-22).
>
> Please, don't hesitate to give your opinion (i.e., agreement/disagreement
> to move forward the document, comments, etc.)!
>
> Thanks in advance.
>
> Best regards,
>
> JMC.
>

--047d7bf10b502bc6b404f72bd451
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div><div>Folks,<br><br></div>just a reminder regardi=
ng this WGLC :)<br><br></div>Thanks in advance for your replies.<br><br></d=
iv>Best regards,<br><br>JMC.<br></div><div class=3D"gmail_extra"><br><br><d=
iv class=3D"gmail_quote">
2014-04-08 12:15 GMT+02:00 Jean-Michel Combes <span dir=3D"ltr">&lt;<a href=
=3D"mailto:jeanmichel.combes@gmail.com" target=3D"_blank">jeanmichel.combes=
@gmail.com</a>&gt;</span>:<br><blockquote class=3D"gmail_quote" style=3D"ma=
rgin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir=3D"ltr"><div><div><div><div><div>Folks,<br><br></div>As it has bee=
n deeply modified since the last WGLC (version -06), this is a new two week=
s WGLC for the following document: &quot;SAVI Solution for DHCP&quot; (<a h=
ref=3D"http://tools.ietf.org/html/draft-ietf-savi-dhcp-22" target=3D"_blank=
">http://tools.ietf.org/html/draft-ietf-savi-dhcp-22</a>).<br>

<br></div>Please, don&#39;t hesitate to give your opinion (i.e., agreement/=
disagreement to move forward the document, comments, etc.)!<br><br></div>Th=
anks in advance.<br><br></div>Best regards,<br><br></div>JMC.<br></div>

</blockquote></div><br></div>

--047d7bf10b502bc6b404f72bd451--


From nobody Thu Apr 17 05:09:25 2014
Return-Path: <elevyabe@cisco.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1CC581A010F for <savi@ietfa.amsl.com>; Thu, 17 Apr 2014 05:09:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.772
X-Spam-Level: 
X-Spam-Status: No, score=-14.772 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.272, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id duxWtSIA7Dbp for <savi@ietfa.amsl.com>; Thu, 17 Apr 2014 05:09:17 -0700 (PDT)
Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by ietfa.amsl.com (Postfix) with ESMTP id ADDB91A0117 for <savi@ietf.org>; Thu, 17 Apr 2014 05:09:14 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=7672; q=dns/txt; s=iport; t=1397736551; x=1398946151; h=from:to:cc:subject:date:message-id:in-reply-to: mime-version; bh=s0709BiIwx+T7+R0FWk6vtLxI2BTECUxNeMuJk9o2nY=; b=XfC5EXERLqfBUjhMXds2ZUN0BVyk3bHPrBsW/MHzXZhZtdelU6OcE/kP Z/NE8AZlC54WDNXa2ks5oLEwec9ykw7JXO08uRWjqk7Ku9I+PacYvmsux 4S0RUcKNDLVwllzbAJpQqk69sBLbFry0IxbJnIw4Ll5332bAShkkSYxKc 0=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AnoFALzDT1OtJA2H/2dsb2JhbABZgkJEO1e6U4h3gSUWdIIlAQIEbgsSAQgRAwECKCgRFAkIAgQBDQUbh00DEQ3DWQ2GcheMSYIIEQeEOASWfIFugTeLRYVQgzGCKw
X-IronPort-AV: E=Sophos;i="4.97,878,1389744000";  d="scan'208,217";a="318399750"
Received: from alln-core-2.cisco.com ([173.36.13.135]) by rcdn-iport-2.cisco.com with ESMTP; 17 Apr 2014 12:09:10 +0000
Received: from xhc-rcd-x02.cisco.com (xhc-rcd-x02.cisco.com [173.37.183.76]) by alln-core-2.cisco.com (8.14.5/8.14.5) with ESMTP id s3HC9AMh000438 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Thu, 17 Apr 2014 12:09:10 GMT
Received: from xmb-rcd-x06.cisco.com ([169.254.6.41]) by xhc-rcd-x02.cisco.com ([173.37.183.76]) with mapi id 14.03.0123.003; Thu, 17 Apr 2014 07:09:10 -0500
From: "Eric Levy- Abegnoli (elevyabe)" <elevyabe@cisco.com>
To: Jean-Michel Combes <jeanmichel.combes@gmail.com>, SAVI Mailing List <savi@ietf.org>
Thread-Topic: [savi] WGLC: draft-ietf-savi-dhcp-22
Thread-Index: AQHPUxN2E7EPfIMXT02EsRAhu//xEJsWOt8A
Date: Thu, 17 Apr 2014 12:09:10 +0000
Message-ID: <CF758A35.38C12%elevyabe@cisco.com>
In-Reply-To: <CAA7e52osoEKeo=EqGF2=PTUrnxC=+8c+GkvF1v4DBQYELYQ6_A@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
user-agent: Microsoft-MacOutlook/14.3.2.130206
x-originating-ip: [10.49.80.39]
Content-Type: multipart/alternative; boundary="_000_CF758A3538C12elevyabeciscocom_"
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/yrnOEmSivYVQ3rvJKVhA8tu9C9g
Cc: "<draft-ietf-savi-dhcp@tools.ietf.org>" <draft-ietf-savi-dhcp@tools.ietf.org>, Ted Lemon <mellon@fugue.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 17 Apr 2014 12:09:23 -0000

--_000_CF758A3538C12elevyabeciscocom_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Hi,
In general, the document looks good. I spot a few substantial issues listed=
 below:

1) There seem to be a requirement in several places of the document (see be=
low) to send LEASEQUERY to the DHCP server.  That is certainly useful to do=
 so, but switches are sometimes pure layer-2 switches, and don't implement =
a DHCP stack not they have a layer-3 address to source traffic from.
Even when the switches have a layer-3 leg,  setting then to reach out the D=
HCP server is not a trivial operation, and not one which is typically done =
on layer-2 access switches.
Whenever the LEASEQUERY is mandated,  I'd rather have it as a SHOULD, with =
some alternate behavior (delete the entry for instance).

Section  6.4.2.2, paragrap 2.1:
  the SAVI device MUST send a LEASEQUERY [RFC5007]
Section 7.5.2.1
  IPv4 address: Send a DHCPLEASEQUERY [RFC4388]
 IPv6 address: Send a LEASEQUERY [RFC5007]

2) Section 7.1 & 7.2
"To perform this process, the SAVI device MUST join the Solicited Node
   Multicast group of the source address of triggering IPv6 data packet
   whenever performing duplicate detection."

  *   I don't think a layer-2 switch can and need to join the Solicited Nod=
e  Multicast group of the source address. It does not have a layer-3 stack =
on top of every link it is bridging/switching. It has to snoop ND traffic, =
like it snoops DHCP traffic.

  Section 7.5.1.2

  *   I wonder what would be the end-result if the switch send a DAD or and=
 ARP and the legitimate owner interpret it as "someone already has the addr=
ess" (always possible depending on its current state). That would seriously=
 break DAD or ACD (rfc5227). I think we need a way to distinguish  between =
the packets issued by the switch and normal DAD or ACD packets.  (some fiel=
d in the header? But that would be a protocol change=85).

Eric

From: Jean-Michel Combes <jeanmichel.combes@gmail.com<mailto:jeanmichel.com=
bes@gmail.com>>
Date: mardi 8 avril 2014 12:15
To: SAVI Mailing List <savi@ietf.org<mailto:savi@ietf.org>>
Cc: "<draft-ietf-savi-dhcp@tools.ietf.org<mailto:draft-ietf-savi-dhcp@tools=
.ietf.org>>" <draft-ietf-savi-dhcp@tools.ietf.org<mailto:draft-ietf-savi-dh=
cp@tools.ietf.org>>, Ted Lemon <mellon@fugue.com<mailto:mellon@fugue.com>>
Subject: [savi] WGLC: draft-ietf-savi-dhcp-22

Folks,

As it has been deeply modified since the last WGLC (version -06), this is a=
 new two weeks WGLC for the following document: "SAVI Solution for DHCP" (h=
ttp://tools.ietf.org/html/draft-ietf-savi-dhcp-22).

Please, don't hesitate to give your opinion (i.e., agreement/disagreement t=
o move forward the document, comments, etc.)!

Thanks in advance.

Best regards,

JMC.

--_000_CF758A3538C12elevyabeciscocom_
Content-Type: text/html; charset="Windows-1252"
Content-ID: <EECD8691E086EE4699B113B3FC08656B@emea.cisco.com>
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
</head>
<body style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-lin=
e-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-fami=
ly: Calibri, sans-serif; ">
<div>Hi,</div>
<div>In general, the document looks good. I spot a few substantial issues l=
isted below:</div>
<div><br>
</div>
<div>1) There seem to be a requirement in several places of the document (s=
ee below) to send LEASEQUERY to the DHCP server. &nbsp;That is certainly us=
eful to do so, but switches are sometimes pure layer-2 switches, and don't =
implement a DHCP stack not they have
 a layer-3 address to source traffic from.</div>
<div>Even when the switches have a layer-3 leg, &nbsp;setting then to reach=
 out the DHCP server is not a trivial operation, and not one which is typic=
ally done on layer-2 access switches.</div>
<div>Whenever the LEASEQUERY is mandated, &nbsp;I'd rather have it as a SHO=
ULD, with some alternate behavior (delete the entry for instance).</div>
<div><br>
</div>
<div>Section &nbsp;6.4.2.2, paragrap 2.1:&nbsp;</div>
<div>&nbsp;&nbsp;the SAVI device MUST send a LEASEQUERY [RFC5007]</div>
<div>Section 7.5.2.1</div>
<div>&nbsp; IPv4 address: Send a DHCPLEASEQUERY [RFC4388]</div>
<div>&nbsp;IPv6 address: Send a LEASEQUERY [RFC5007]</div>
<div><br>
</div>
<div>2) Section 7.1 &amp; 7.2</div>
<div>&quot;To perform this process, the SAVI device MUST join the Solicited=
 Node</div>
<div>&nbsp; &nbsp;Multicast group of the source address of triggering IPv6 =
data packet</div>
<div>&nbsp; &nbsp;whenever performing duplicate detection.&quot;</div>
<ul>
<li>I don't think a layer-2 switch can and need to join&nbsp;the Solicited =
Node&nbsp; Multicast group of the source address. It does not have a layer-=
3 stack on top of every link it is bridging/switching. It has to snoop ND t=
raffic, like it snoops DHCP traffic.&nbsp;</li></ul>
<div>&nbsp; Section 7.5.1.2</div>
<ul>
<li>I wonder what would be the end-result if the switch send a DAD or and A=
RP and the legitimate owner interpret it as &quot;someone already has the a=
ddress&quot; (always possible depending on its current state). That would s=
eriously break DAD or ACD (rfc5227). I think
 we need a way to distinguish &nbsp;between the packets issued by the switc=
h and normal DAD or ACD packets. &nbsp;(some field in the header? But that =
would be a protocol change=85).</li></ul>
<div>Eric</div>
<div><br>
</div>
<span id=3D"OLK_SRC_BODY_SECTION">
<div style=3D"font-family:Calibri; font-size:11pt; text-align:left; color:b=
lack; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM:=
 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid;=
 BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style=3D"font-weight:bold">From: </span>Jean-Michel Combes &lt;<a hre=
f=3D"mailto:jeanmichel.combes@gmail.com">jeanmichel.combes@gmail.com</a>&gt=
;<br>
<span style=3D"font-weight:bold">Date: </span>mardi 8 avril 2014 12:15<br>
<span style=3D"font-weight:bold">To: </span>SAVI Mailing List &lt;<a href=
=3D"mailto:savi@ietf.org">savi@ietf.org</a>&gt;<br>
<span style=3D"font-weight:bold">Cc: </span>&quot;&lt;<a href=3D"mailto:dra=
ft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@tools.ietf.org</a>&g=
t;&quot; &lt;<a href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-i=
etf-savi-dhcp@tools.ietf.org</a>&gt;, Ted Lemon &lt;<a href=3D"mailto:mello=
n@fugue.com">mellon@fugue.com</a>&gt;<br>
<span style=3D"font-weight:bold">Subject: </span>[savi] WGLC: draft-ietf-sa=
vi-dhcp-22<br>
</div>
<div><br>
</div>
<blockquote id=3D"MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style=3D"BORDER-LEFT:=
 #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div>
<div>
<div dir=3D"ltr">
<div>
<div>
<div>
<div>
<div>Folks,<br>
<br>
</div>
As it has been deeply modified since the last WGLC (version -06), this is a=
 new two weeks WGLC for the following document: &quot;SAVI Solution for DHC=
P&quot; (<a href=3D"http://tools.ietf.org/html/draft-ietf-savi-dhcp-22">htt=
p://tools.ietf.org/html/draft-ietf-savi-dhcp-22</a>).<br>
<br>
</div>
Please, don't hesitate to give your opinion (i.e., agreement/disagreement t=
o move forward the document, comments, etc.)!<br>
<br>
</div>
Thanks in advance.<br>
<br>
</div>
Best regards,<br>
<br>
</div>
JMC.<br>
</div>
</div>
</div>
</blockquote>
</span>
</body>
</html>

--_000_CF758A3538C12elevyabeciscocom_--


From nobody Mon Apr 21 20:57:13 2014
Return-Path: <yaoguang@cernet.edu.cn>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 827571A004A for <savi@ietfa.amsl.com>; Mon, 21 Apr 2014 20:57:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PrQs2KY7QkKF for <savi@ietfa.amsl.com>; Mon, 21 Apr 2014 20:57:10 -0700 (PDT)
Received: from cernet.edu.cn (sea.net.edu.cn [202.112.39.2]) by ietfa.amsl.com (Postfix) with ESMTP id 491861A0051 for <savi@ietf.org>; Mon, 21 Apr 2014 20:57:09 -0700 (PDT)
Received: from AndrewYaoPC (unknown [166.111.132.217]) by centos (Coremail) with SMTP id AQAAf3C7FgOA6FVTw9QCAA--.130S2; Tue, 22 Apr 2014 11:56:48 +0800 (CST)
From: "Guang Yao" <yaoguang@cernet.edu.cn>
To: "'Ted Lemon'" <mellon@fugue.com>
References: <CAA7e52osoEKeo=EqGF2=PTUrnxC=+8c+GkvF1v4DBQYELYQ6_A@mail.gmail.com> <CF758A35.38C12%elevyabe@cisco.com> <000e01cf5d0a$4a279d40$de76d7c0$@cernet.edu.cn> <D0685C39-0755-4DBC-BED3-AF3684153ABC@fugue.com>
In-Reply-To: <D0685C39-0755-4DBC-BED3-AF3684153ABC@fugue.com>
Date: Tue, 22 Apr 2014 11:56:51 +0800
Message-ID: <000001cf5dde$e493d450$adbb7cf0$@cernet.edu.cn>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AQJ+SCgfdpNGCy/MpS4Q3KK7ONbjpgGWxBw8AcRlR48BlYz03pmXoxDw
Content-Language: zh-cn
X-CM-TRANSID: AQAAf3C7FgOA6FVTw9QCAA--.130S2
X-Coremail-Antispam: 1UD129KBjvJXoW7XF1DXrW3WF1xCrWfWw45ZFb_yoW8JrW3pa 98JF45Ka1DG3WrX3WDtryxXw1j9r95Ca9rGFn8Gry0yF15AF98AryIkrW0q3srWry8Xa15 Z3y29r1DA3sxurJanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUgYb7Iv0xC_Zr1lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2z4x0Y4vE2Ix0cI8IcVAFwI0_Gr0_Xr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_ Cr1l84ACjcxK6I8E87Iv67AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVCY1x0267AKxVW8Jr 0_Cr1UM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj 6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41lF7 xvr2IYc2Ij64vIr40E4x8a64kEw24lc2xSY4AK67AK6r48MxAIw28IcxkI7VAKI48JMI8I 3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxV WUAVWUtwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8I cVCY1x0267AKxVWUJVW8JwCI42IY6xAIw20EY4v20xvaj40_WFyUJVCq3wCI42IY6I8E87 Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r1j6r4UYxBIdaVFxhVjvjDU0xZF pf9x07jIbyZUUUUU=
X-CM-SenderInfo: 51drw3xdqjquphuqv3oohg3hdfq/
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/2_eWNu6XnHdRdK79siBGy7KHSNc
Cc: draft-ietf-savi-dhcp@tools.ietf.org, 'SAVI Mailing List' <savi@ietf.org>, 'Jean-Michel Combes' <jeanmichel.combes@gmail.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Apr 2014 03:57:12 -0000

Hi, Ted

Thank you very much for your comments! I agree with you. It's safe to assume
all the SAVI devices have layer-3 stack. But it seems Eric also concerns the
implementation of DHCP leasequery and NDP snooping.

On the MLD problem mentioned by Eric, I wonder should SAVI-DHCP be
consistent with RFC6620, or be different? 

Hi, Eric

On the DAD problem:

I read the doc again and find DAD NS will not be sent to the tentative node.
Whenever probe should be sent to the tentative node, we use plain NS instead
of DAD NS. Thus would it be OK?

We are looking forward to your further comments, thanks!

Best regards,
Guang

-----Original Message-----
From: Ted Lemon [mailto:mellon@fugue.com] 
Sent: Tuesday, April 22, 2014 12:31 AM
To: Guang Yao
Cc: Eric Levy- Abegnoli (elevyabe); Jean-Michel Combes; SAVI Mailing List;
draft-ietf-savi-dhcp@tools.ietf.org
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

Do we really think there are modern layer 2 devices that will implement
SAVI-DHCP that will not have IPv6 addresses?   This seems highly doubtful to
me-the devices that would only have layer two addresses would be unmanaged
switches.   I have a cheap managed switch, and it has an IPv4 address and a
web server in it.   I think this is a non-problem.




From nobody Mon Apr 21 23:24:03 2014
Return-Path: <leaf.yeh.sdo@gmail.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C4FA1A00A5 for <savi@ietfa.amsl.com>; Mon, 21 Apr 2014 23:24:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level: 
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QUsFMBa_q_vM for <savi@ietfa.amsl.com>; Mon, 21 Apr 2014 23:23:55 -0700 (PDT)
Received: from mail-pb0-x233.google.com (mail-pb0-x233.google.com [IPv6:2607:f8b0:400e:c01::233]) by ietfa.amsl.com (Postfix) with ESMTP id 6170D1A0089 for <savi@ietf.org>; Mon, 21 Apr 2014 23:23:55 -0700 (PDT)
Received: by mail-pb0-f51.google.com with SMTP id uo5so4540141pbc.24 for <savi@ietf.org>; Mon, 21 Apr 2014 23:23:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=from:to:cc:references:in-reply-to:subject:date:message-id :mime-version:content-type:thread-index:content-language; bh=sFMMKXUskiz5eW2JcTp7XCv4sh6Otae0+7U7FIAJn0w=; b=uC+lNLKFv2/RexifGxlthqMb0eyO4RnrqZJyiPr1jDGJ54HR8uvz1tdwAl1LNgohVo l8iM38yayQJBQfOZmKXJBFn+PSgjTqnXGRzgEFcd5beifPDZpWVFiJBrcuDdSaOOtdWm AEPrGi5GHHkCfbVWeKZzRYe3FjJiDghZH/oeZKPcjyvR9ftWwcyXTUfGyVANQDTv8ylJ o6v8Bh+OvoLtjiMEoMs7wPfYuE5FmeFnmq+NQKcpqoTQ3I9u430LNJYI4XFjwaWGll3f YFF+eLI55a75tVRoZKBwbJqzGYtnqFlNpHbpmK/xrczKbgHtWD5giCK5zZz+cd0QQYGS oZTw==
X-Received: by 10.66.177.168 with SMTP id cr8mr7518451pac.128.1398147830237; Mon, 21 Apr 2014 23:23:50 -0700 (PDT)
Received: from PC ([218.241.103.137]) by mx.google.com with ESMTPSA id di3sm54674688pbc.11.2014.04.21.23.23.47 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 21 Apr 2014 23:23:49 -0700 (PDT)
From: "Leaf Yeh" <leaf.yeh.sdo@gmail.com>
To: "'Eric Levy- Abegnoli \(elevyabe\)'" <elevyabe@cisco.com>, "'Jean-Michel Combes'" <jeanmichel.combes@gmail.com>, "'SAVI Mailing List'" <savi@ietf.org>
References: <CAA7e52osoEKeo=EqGF2=PTUrnxC=+8c+GkvF1v4DBQYELYQ6_A@mail.gmail.com> <CF758A35.38C12%elevyabe@cisco.com>
In-Reply-To: <CF758A35.38C12%elevyabe@cisco.com>
Date: Tue, 22 Apr 2014 14:23:44 +0800
Message-ID: <53560af5.c3b3440a.7a58.1cfd@mx.google.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_001F_01CF5E36.7A34F690"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AQHPUxN2E7EPfIMXT02EsRAhu//xEJsWOt8AgAb/rjA=
Content-Language: zh-cn
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/GHUkZ7HtxrBJMZ5E73fWvHBTLpM
Cc: draft-ietf-savi-dhcp@tools.ietf.org, 'Ted Lemon' <mellon@fugue.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Apr 2014 06:24:01 -0000

This is a multi-part message in MIME format.

------=_NextPart_000_001F_01CF5E36.7A34F690
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Eric - Section 7.5.1.2 - I wonder what would be the end-result if the switch
send a DAD or and ARP and the legitimate owner interpret it as "someone
already has the address" (always possible depending on its current state).
That would seriously break DAD or ACD (rfc5227). I think we need a way to
distinguish  between the packets issued by the switch and normal DAD or ACD
packets.  (some field in the header? But that would be a protocol change.).

 

 

As for IPv6 address, I suppose the switch employs the same  process as that
described in section 3.2.3 of RFC6620, page 15 @
http://tools.ietf.org/html/rfc6620#section-3.2.3 

 

<quote>

Upon the reception through a Validating Port (VP) of a DATA packet

      containing IPAddr as the source address, the SAVI device SHOULD

      execute the process of sending Neighbor Solicitation messages of

      the Duplicate Address Detection process as described in Section
<http://tools.ietf.org/html/rfc6620#section-5.4.2> 

      5.4.2 <http://tools.ietf.org/html/rfc6620#section-5.4.2>  of [RFC4862
<http://tools.ietf.org/html/rfc4862> ] for the IPAddr using the following
default

      parameters: DupAddrDetectTransmits set to 2 (i.e., 2 Neighbor

      Solicitation messages for that address will be sent by the SAVI

      device) and RetransTimer set to T_WAIT milliseconds (i.e., the

      time between two Neighbor Solicitation messages is T_WAIT

      milliseconds).

</quote>

 

If you could agreed on the above in RFC6620, I guess you would have no doubt
here for the IPv6 address. J

 

 

Best Regards,

Leaf

 

 

 

From: savi [mailto:savi-bounces@ietf.org] On Behalf Of Eric Levy- Abegnoli
(elevyabe)
Sent: Thursday, April 17, 2014 8:09 PM
To: Jean-Michel Combes; SAVI Mailing List
Cc: <draft-ietf-savi-dhcp@tools.ietf.org>; Ted Lemon
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Hi,

In general, the document looks good. I spot a few substantial issues listed
below:

 

1) There seem to be a requirement in several places of the document (see
below) to send LEASEQUERY to the DHCP server.  That is certainly useful to
do so, but switches are sometimes pure layer-2 switches, and don't implement
a DHCP stack not they have a layer-3 address to source traffic from.

Even when the switches have a layer-3 leg,  setting then to reach out the
DHCP server is not a trivial operation, and not one which is typically done
on layer-2 access switches.

Whenever the LEASEQUERY is mandated,  I'd rather have it as a SHOULD, with
some alternate behavior (delete the entry for instance).

 

Section  6.4.2.2, paragrap 2.1: 

  the SAVI device MUST send a LEASEQUERY [RFC5007]

Section 7.5.2.1

  IPv4 address: Send a DHCPLEASEQUERY [RFC4388]

 IPv6 address: Send a LEASEQUERY [RFC5007]

 

2) Section 7.1 & 7.2

"To perform this process, the SAVI device MUST join the Solicited Node

   Multicast group of the source address of triggering IPv6 data packet

   whenever performing duplicate detection."

*	I don't think a layer-2 switch can and need to join the Solicited
Node  Multicast group of the source address. It does not have a layer-3
stack on top of every link it is bridging/switching. It has to snoop ND
traffic, like it snoops DHCP traffic. 

  Section 7.5.1.2

*	I wonder what would be the end-result if the switch send a DAD or
and ARP and the legitimate owner interpret it as "someone already has the
address" (always possible depending on its current state). That would
seriously break DAD or ACD (rfc5227). I think we need a way to distinguish
between the packets issued by the switch and normal DAD or ACD packets.
(some field in the header? But that would be a protocol change.).

Eric

 

From: Jean-Michel Combes <jeanmichel.combes@gmail.com>
Date: mardi 8 avril 2014 12:15
To: SAVI Mailing List <savi@ietf.org>
Cc: "<draft-ietf-savi-dhcp@tools.ietf.org>"
<draft-ietf-savi-dhcp@tools.ietf.org>, Ted Lemon <mellon@fugue.com>
Subject: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Folks,

As it has been deeply modified since the last WGLC (version -06), this is a
new two weeks WGLC for the following document: "SAVI Solution for DHCP"
(http://tools.ietf.org/html/draft-ietf-savi-dhcp-22).

Please, don't hesitate to give your opinion (i.e., agreement/disagreement to
move forward the document, comments, etc.)!

Thanks in advance.

Best regards,

JMC.


------=_NextPart_000_001F_01CF5E36.7A34F690
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 12 =
(filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Tahoma;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
pre
	{mso-style-priority:99;
	mso-style-link:"HTML \9884\8BBE\683C\5F0F Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:SimSun;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
	{mso-style-priority:99;
	mso-style-link:"\6279\6CE8\6846\6587\672C Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:9.0pt;
	font-family:"Times New Roman","serif";}
span.Char
	{mso-style-name:"\6279\6CE8\6846\6587\672C Char";
	mso-style-priority:99;
	mso-style-link:\6279\6CE8\6846\6587\672C;
	font-family:SimSun;}
span.EmailStyle19
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.HTMLChar
	{mso-style-name:"HTML \9884\8BBE\683C\5F0F Char";
	mso-style-priority:99;
	mso-style-link:"HTML \9884\8BBE\683C\5F0F";
	font-family:SimSun;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:702286737;
	mso-list-template-ids:-933963184;}
@list l0:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1
	{mso-list-id:1495491494;
	mso-list-template-ids:1653885722;}
@list l1:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
ol
	{margin-bottom:0cm;}
ul
	{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DZH-CN link=3Dblue =
vlink=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Eric - </span><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section 7.5.1.2</span><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
> - </span><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>I wonder what would be the end-result if the switch send a DAD or and =
ARP and the legitimate owner interpret it as &quot;someone already has =
the address&quot; (always possible depending on its current state). That =
would seriously break DAD or ACD (rfc5227). I think we need a way to =
distinguish &nbsp;between the packets issued by the switch and normal =
DAD or ACD packets. &nbsp;(some field in the header? But that would be a =
protocol change&#8230;).<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>As for IPv6 address, I suppose the switch employs the same =
&nbsp;process as that described in section 3.2.3 of RFC6620, page 15 @ =
<a =
href=3D"http://tools.ietf.org/html/rfc6620#section-3.2.3">http://tools.ie=
tf.org/html/rfc6620#section-3.2.3</a> <o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;quote&gt;<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'text-indent:36.0pt;page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>Upon the reception through a Validating =
Port (VP) of a DATA packet<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; containing =
IPAddr as the source address, the SAVI device =
SHOULD<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; execute the =
process of sending Neighbor Solicitation messages =
of<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; the =
Duplicate Address Detection process as described in <a =
href=3D"http://tools.ietf.org/html/rfc6620#section-5.4.2">Section</a><o:p=
></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a =
href=3D"http://tools.ietf.org/html/rfc6620#section-5.4.2">5.4.2</a> of =
[<a href=3D"http://tools.ietf.org/html/rfc4862" title=3D"&quot;IPv6 =
Stateless Address Autoconfiguration&quot;">RFC4862</a>] for the IPAddr =
using the following default<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; parameters: =
DupAddrDetectTransmits set to 2 (i.e., 2 =
Neighbor<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Solicitation =
messages for that address will be sent by the =
SAVI<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; device) and =
RetransTimer set to T_WAIT milliseconds (i.e., =
the<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; time between =
two Neighbor Solicitation messages is T_WAIT<o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
milliseconds).</span><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;/quote&gt;<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>If you could agreed on the above in RFC6620, I guess you would have =
no doubt here for the IPv6 address. </span><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:Wingdings;color:#1F497D'>J</span><s=
pan lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best Regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Leaf<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span>=
</b><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'> savi =
[mailto:savi-bounces@ietf.org] <b>On Behalf Of </b>Eric Levy- Abegnoli =
(elevyabe)<br><b>Sent:</b> Thursday, April 17, 2014 8:09 =
PM<br><b>To:</b> Jean-Michel Combes; SAVI Mailing List<br><b>Cc:</b> =
&lt;draft-ietf-savi-dhcp@tools.ietf.org&gt;; Ted =
Lemon<br><b>Subject:</b> Re: [savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Hi,<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>In general, the document looks good. I spot a few substantial issues =
listed below:<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>1) There seem to be a requirement in several places of the document =
(see below) to send LEASEQUERY to the DHCP server. &nbsp;That is =
certainly useful to do so, but switches are sometimes pure layer-2 =
switches, and don't implement a DHCP stack not they have a layer-3 =
address to source traffic from.<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Even when the switches have a layer-3 leg, &nbsp;setting then to reach =
out the DHCP server is not a trivial operation, and not one which is =
typically done on layer-2 access =
switches.<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Whenever the LEASEQUERY is mandated, &nbsp;I'd rather have it as a =
SHOULD, with some alternate behavior (delete the entry for =
instance).<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section &nbsp;6.4.2.2, paragrap =
2.1:&nbsp;<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;&nbsp;the SAVI device MUST send a LEASEQUERY =
[RFC5007]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section 7.5.2.1<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; IPv4 address: Send a DHCPLEASEQUERY =
[RFC4388]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;IPv6 address: Send a LEASEQUERY =
[RFC5007]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>2) Section 7.1 &amp; 7.2<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&quot;To perform this process, the SAVI device MUST join the Solicited =
Node<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;Multicast group of the source address of triggering IPv6 =
data packet<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;whenever performing duplicate =
detection.&quot;<o:p></o:p></span></p></div><ul type=3Ddisc><li =
class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l1 level1 lfo1'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I don't =
think a layer-2 switch can and need to join&nbsp;the Solicited =
Node&nbsp; Multicast group of the source address. It does not have a =
layer-3 stack on top of every link it is bridging/switching. It has to =
snoop ND traffic, like it snoops DHCP =
traffic.&nbsp;<o:p></o:p></span></li></ul><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; Section 7.5.1.2<o:p></o:p></span></p></div><ul type=3Ddisc><li =
class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l0 level1 lfo2'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I wonder =
what would be the end-result if the switch send a DAD or and ARP and the =
legitimate owner interpret it as &quot;someone already has the =
address&quot; (always possible depending on its current state). That =
would seriously break DAD or ACD (rfc5227). I think we need a way to =
distinguish &nbsp;between the packets issued by the switch and normal =
DAD or ACD packets. &nbsp;(some field in the header? But that would be a =
protocol change&#8230;).<o:p></o:p></span></li></ul><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Eric<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>From: </span></b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>Jean-Michel Combes &lt;<a =
href=3D"mailto:jeanmichel.combes@gmail.com">jeanmichel.combes@gmail.com</=
a>&gt;<br><b>Date: </b>mardi 8 avril 2014 12:15<br><b>To: </b>SAVI =
Mailing List &lt;<a =
href=3D"mailto:savi@ietf.org">savi@ietf.org</a>&gt;<br><b>Cc: =
</b>&quot;&lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;&quot; &lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;, Ted Lemon &lt;<a =
href=3D"mailto:mellon@fugue.com">mellon@fugue.com</a>&gt;<br><b>Subject: =
</b>[savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><blockquote =
style=3D'border:none;border-left:solid #B5C4DF 4.5pt;padding:0cm 0cm 0cm =
4.0pt;margin-left:3.75pt;margin-right:0cm' =
id=3D"MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"><div><div><div><div><div><div><=
div><div><p class=3DMsoNormal style=3D'margin-bottom:12.0pt'><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Folks,<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>As it has been deeply modified since the last WGLC (version -06), this =
is a new two weeks WGLC for the following document: &quot;SAVI Solution =
for DHCP&quot; (<a =
href=3D"http://tools.ietf.org/html/draft-ietf-savi-dhcp-22">http://tools.=
ietf.org/html/draft-ietf-savi-dhcp-22</a>).<o:p></o:p></span></p></div><p=
 class=3DMsoNormal style=3D'margin-bottom:12.0pt'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Please, don't hesitate to give your opinion (i.e., =
agreement/disagreement to move forward the document, comments, =
etc.)!<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Thanks in advance.<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Best regards,<o:p></o:p></span></p></div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>JMC.<o:p></o:p></span></p></div></div></div></blockquote></div></body></=
html>
------=_NextPart_000_001F_01CF5E36.7A34F690--


From nobody Mon Apr 21 23:33:21 2014
Return-Path: <yaoguang@cernet.edu.cn>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 178FE1A00A7 for <savi@ietfa.amsl.com>; Mon, 21 Apr 2014 23:33:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.171
X-Spam-Level: 
X-Spam-Status: No, score=-4.171 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, GB_I_LETTER=-2, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.272] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id taGxNViJ6GHx for <savi@ietfa.amsl.com>; Mon, 21 Apr 2014 23:33:14 -0700 (PDT)
Received: from cernet.edu.cn (mail.cernet.edu.cn [202.112.39.2]) by ietfa.amsl.com (Postfix) with ESMTP id 19D371A0092 for <savi@ietf.org>; Mon, 21 Apr 2014 23:33:13 -0700 (PDT)
Received: from AndrewYaoPC (unknown [166.111.132.217]) by centos (Coremail) with SMTP id AQAAf3A7zwQTDVZT5t8CAA--.110S2; Tue, 22 Apr 2014 14:32:51 +0800 (CST)
From: "Guang Yao" <yaoguang@cernet.edu.cn>
To: "'Leaf Yeh'" <leaf.yeh.sdo@gmail.com>, "'Eric Levy- Abegnoli \(elevyabe\)'" <elevyabe@cisco.com>, "'Jean-Michel Combes'" <jeanmichel.combes@gmail.com>, "'SAVI Mailing List'" <savi@ietf.org>
References: <CAA7e52osoEKeo=EqGF2=PTUrnxC=+8c+GkvF1v4DBQYELYQ6_A@mail.gmail.com> <CF758A35.38C12%elevyabe@cisco.com> <53560af5.c3b3440a.7a58.1cfd@mx.google.com>
In-Reply-To: <53560af5.c3b3440a.7a58.1cfd@mx.google.com>
Date: Tue, 22 Apr 2014 14:32:54 +0800
Message-ID: <001601cf5df4$b146bc00$13d43400$@cernet.edu.cn>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0017_01CF5E37.BF6C45F0"
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AQJ+SCgfdpNGCy/MpS4Q3KK7ONbjpgGWxBw8Al/KbiSZn6Nz4A==
Content-Language: zh-cn
X-CM-TRANSID: AQAAf3A7zwQTDVZT5t8CAA--.110S2
X-Coremail-Antispam: 1UD129KBjvJXoWxZw1ruF1DAr4DXw1UZF1fZwb_yoWrKFy5pa ykGFW3Kr1DJw1xuw4kWw1xZr4fZrW0kFW7GFn5Gw10yan8WF92yr1IkrZ8Ar9rZrn7Ca1a qFZI934kZ343ZrJanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUBKb7Iv0xC_Kw4lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2z4x0Y4vE2Ix0cI8IcVAFwI0_Gr0_Xr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_ Cr1l84ACjcxK6I8E87Iv67AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVCY1x0267AKxVW8Jr 0_Cr1UM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVAYj202j2C_Xr0_Wr1l5I8CrVAq jxCE14ACF2xKxwAqx4xG64kEw2xG04xIwI0_Jr0_Gr1l5I8CrVCF0I0E4I0vr24lYx0E2I x0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWUJVW8 JwACjcxG0xvY0x0EwIxGrwACjcxG0xvY0x0EwIxGrVCF72vEw4AK0wCjr7xvwVCIw2I0I7 xG6c02F41lc2xSY4AK67AK6r47MxAIw28IcxkI7VAKI48JMI8I3I0E5I8CrVAFwI0_JrI_ JrWlx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUAVWUtwCIc40Y0x0EwI xGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVWUJVW8 JwCI42IY6xAIw20EY4v20xvaj40_Wr1j6rW3Jr1lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIx AIcVC2z280aVCY1x0267AKxVW8JVW8JrUvcSsGvfC2KfnxnUUI43ZEXa7IU5iJ57UUUUU= =
X-CM-SenderInfo: 51drw3xdqjquphuqv3oohg3hdfq/
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/iURF3m5Vie8K0v_vExVJMFEbwF0
Cc: draft-ietf-savi-dhcp@tools.ietf.org, 'Ted Lemon' <mellon@fugue.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Apr 2014 06:33:19 -0000

This is a multipart message in MIME format.

------=_NextPart_000_0017_01CF5E37.BF6C45F0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Hi Leaf and Eric,

 

Maybe there are some misunderstandings... In SAVI-DHCP, as I mentioned in
the last letter, we use plain NS rather than DAD NS. Whenever we use DAD,
the messages are not sent to the tentative node. Thus, SAVI-DHCP is actually
different from RFC6620.Actually, I do think sending DAD NS to the tentative
node will cause some problem.

 

Best regards,

Guang

 

From: savi [mailto:savi-bounces@ietf.org] On Behalf Of Leaf Yeh
Sent: Tuesday, April 22, 2014 2:24 PM
To: 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes'; 'SAVI Mailing
List'
Cc: draft-ietf-savi-dhcp@tools.ietf.org; 'Ted Lemon'
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Eric - Section 7.5.1.2 - I wonder what would be the end-result if the switch
send a DAD or and ARP and the legitimate owner interpret it as "someone
already has the address" (always possible depending on its current state).
That would seriously break DAD or ACD (rfc5227). I think we need a way to
distinguish  between the packets issued by the switch and normal DAD or ACD
packets.  (some field in the header? But that would be a protocol change.).

 

 

As for IPv6 address, I suppose the switch employs the same  process as that
described in section 3.2.3 of RFC6620, page 15 @
http://tools.ietf.org/html/rfc6620#section-3.2.3 

 

<quote>

Upon the reception through a Validating Port (VP) of a DATA packet

      containing IPAddr as the source address, the SAVI device SHOULD

      execute the process of sending Neighbor Solicitation messages of

      the Duplicate Address Detection process as described in Section
<http://tools.ietf.org/html/rfc6620#section-5.4.2> 

      5.4.2 <http://tools.ietf.org/html/rfc6620#section-5.4.2>  of [RFC4862
<http://tools.ietf.org/html/rfc4862> ] for the IPAddr using the following
default

      parameters: DupAddrDetectTransmits set to 2 (i.e., 2 Neighbor

      Solicitation messages for that address will be sent by the SAVI

      device) and RetransTimer set to T_WAIT milliseconds (i.e., the

      time between two Neighbor Solicitation messages is T_WAIT

      milliseconds).

</quote>

 

If you could agreed on the above in RFC6620, I guess you would have no doubt
here for the IPv6 address. :)

 

 

Best Regards,

Leaf

 

 

 

From: savi [mailto:savi-bounces@ietf.org] On Behalf Of Eric Levy- Abegnoli
(elevyabe)
Sent: Thursday, April 17, 2014 8:09 PM
To: Jean-Michel Combes; SAVI Mailing List
Cc: <draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> >; Ted Lemon
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Hi,

In general, the document looks good. I spot a few substantial issues listed
below:

 

1) There seem to be a requirement in several places of the document (see
below) to send LEASEQUERY to the DHCP server.  That is certainly useful to
do so, but switches are sometimes pure layer-2 switches, and don't implement
a DHCP stack not they have a layer-3 address to source traffic from.

Even when the switches have a layer-3 leg,  setting then to reach out the
DHCP server is not a trivial operation, and not one which is typically done
on layer-2 access switches.

Whenever the LEASEQUERY is mandated,  I'd rather have it as a SHOULD, with
some alternate behavior (delete the entry for instance).

 

Section  6.4.2.2, paragrap 2.1: 

  the SAVI device MUST send a LEASEQUERY [RFC5007]

Section 7.5.2.1

  IPv4 address: Send a DHCPLEASEQUERY [RFC4388]

 IPv6 address: Send a LEASEQUERY [RFC5007]

 

2) Section 7.1 & 7.2

"To perform this process, the SAVI device MUST join the Solicited Node

   Multicast group of the source address of triggering IPv6 data packet

   whenever performing duplicate detection."

*	I don't think a layer-2 switch can and need to join the Solicited
Node  Multicast group of the source address. It does not have a layer-3
stack on top of every link it is bridging/switching. It has to snoop ND
traffic, like it snoops DHCP traffic. 

  Section 7.5.1.2

*	I wonder what would be the end-result if the switch send a DAD or
and ARP and the legitimate owner interpret it as "someone already has the
address" (always possible depending on its current state). That would
seriously break DAD or ACD (rfc5227). I think we need a way to distinguish
between the packets issued by the switch and normal DAD or ACD packets.
(some field in the header? But that would be a protocol change.).

Eric

 

From: Jean-Michel Combes <jeanmichel.combes@gmail.com
<mailto:jeanmichel.combes@gmail.com> >
Date: mardi 8 avril 2014 12:15
To: SAVI Mailing List <savi@ietf.org <mailto:savi@ietf.org> >
Cc: "<draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> >"
<draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> >, Ted Lemon <mellon@fugue.com
<mailto:mellon@fugue.com> >
Subject: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Folks,

As it has been deeply modified since the last WGLC (version -06), this is a
new two weeks WGLC for the following document: "SAVI Solution for DHCP"
(http://tools.ietf.org/html/draft-ietf-savi-dhcp-22).

Please, don't hesitate to give your opinion (i.e., agreement/disagreement to
move forward the document, comments, etc.)!

Thanks in advance.

Best regards,

JMC.


------=_NextPart_000_0017_01CF5E37.BF6C45F0
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 =
(filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:Tahoma;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
pre
	{mso-style-priority:99;
	mso-style-link:"HTML \9884\8BBE\683C\5F0F Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:SimSun;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
	{mso-style-priority:99;
	mso-style-link:"\6279\6CE8\6846\6587\672C Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:9.0pt;
	font-family:"Times New Roman","serif";}
span.HTMLChar
	{mso-style-name:"HTML \9884\8BBE\683C\5F0F Char";
	mso-style-priority:99;
	mso-style-link:"HTML \9884\8BBE\683C\5F0F";
	font-family:SimSun;}
span.Char
	{mso-style-name:"\6279\6CE8\6846\6587\672C Char";
	mso-style-priority:99;
	mso-style-link:\6279\6CE8\6846\6587\672C;
	font-family:SimSun;}
span.EmailStyle21
	{mso-style-type:personal;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.EmailStyle22
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:76488042;
	mso-list-template-ids:1160431000;}
@list l0:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level2
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1
	{mso-list-id:501046122;
	mso-list-template-ids:-1812165262;}
@list l1:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level2
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2
	{mso-list-id:702286737;
	mso-list-template-ids:-933963184;}
@list l2:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2:level2
	{mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l2:level3
	{mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l2:level4
	{mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l2:level5
	{mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l2:level6
	{mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l2:level7
	{mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l2:level8
	{mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l2:level9
	{mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l3
	{mso-list-id:1495491494;
	mso-list-template-ids:1653885722;}
@list l3:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l3:level2
	{mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l3:level3
	{mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l3:level4
	{mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l3:level5
	{mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l3:level6
	{mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l3:level7
	{mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l3:level8
	{mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l3:level9
	{mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
ol
	{margin-bottom:0cm;}
ul
	{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue =
vlink=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Hi Leaf and Eric,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Maybe there are some misunderstandings... In SAVI-DHCP, as I =
mentioned in the last letter, we use plain NS rather than DAD NS. =
Whenever we use DAD, the messages are not sent to the tentative node. =
Thus, SAVI-DHCP is actually different from RFC6620.Actually, I do think =
sending DAD NS to the tentative node will cause some =
problem.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Guang<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span=
></b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'> savi =
[mailto:savi-bounces@ietf.org] <b>On Behalf Of </b>Leaf =
Yeh<br><b>Sent:</b> Tuesday, April 22, 2014 2:24 PM<br><b>To:</b> 'Eric =
Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes'; 'SAVI Mailing =
List'<br><b>Cc:</b> draft-ietf-savi-dhcp@tools.ietf.org; 'Ted =
Lemon'<br><b>Subject:</b> Re: [savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Eric - </span><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section 7.5.1.2 - I wonder what would be the end-result if the switch =
send a DAD or and ARP and the legitimate owner interpret it as =
&quot;someone already has the address&quot; (always possible depending =
on its current state). That would seriously break DAD or ACD (rfc5227). =
I think we need a way to distinguish &nbsp;between the packets issued by =
the switch and normal DAD or ACD packets. &nbsp;(some field in the =
header? But that would be a protocol =
change&#8230;).<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>As for IPv6 address, I suppose the switch employs the same =
&nbsp;process as that described in section 3.2.3 of RFC6620, page 15 @ =
<a =
href=3D"http://tools.ietf.org/html/rfc6620#section-3.2.3">http://tools.ie=
tf.org/html/rfc6620#section-3.2.3</a> <o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;quote&gt;<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'text-indent:36.0pt;page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>Upon the reception through a Validating =
Port (VP) of a DATA packet<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; containing =
IPAddr as the source address, the SAVI device =
SHOULD<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; execute the =
process of sending Neighbor Solicitation messages =
of<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; the =
Duplicate Address Detection process as described in <a =
href=3D"http://tools.ietf.org/html/rfc6620#section-5.4.2">Section</a><o:p=
></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a =
href=3D"http://tools.ietf.org/html/rfc6620#section-5.4.2">5.4.2</a> of =
[<a href=3D"http://tools.ietf.org/html/rfc4862" title=3D"&quot;IPv6 =
Stateless Address Autoconfiguration&quot;">RFC4862</a>] for the IPAddr =
using the following default<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; parameters: =
DupAddrDetectTransmits set to 2 (i.e., 2 =
Neighbor<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Solicitation =
messages for that address will be sent by the =
SAVI<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; device) and =
RetransTimer set to T_WAIT milliseconds (i.e., =
the<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; time between =
two Neighbor Solicitation messages is T_WAIT<o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
milliseconds).</span><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;/quote&gt;<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>If you could agreed on the above in RFC6620, I guess you would have =
no doubt here for the IPv6 address. </span><span =
style=3D'font-size:10.5pt;font-family:Wingdings;color:#1F497D'>J</span><s=
pan =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best Regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Leaf<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span>=
</b><span style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'> =
savi [<a =
href=3D"mailto:savi-bounces@ietf.org">mailto:savi-bounces@ietf.org</a>] =
<b>On Behalf Of </b>Eric Levy- Abegnoli (elevyabe)<br><b>Sent:</b> =
Thursday, April 17, 2014 8:09 PM<br><b>To:</b> Jean-Michel Combes; SAVI =
Mailing List<br><b>Cc:</b> &lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;; Ted Lemon<br><b>Subject:</b> Re: [savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Hi,<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>In general, the document looks good. I spot a few substantial issues =
listed below:<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>1) There seem to be a requirement in several places of the document =
(see below) to send LEASEQUERY to the DHCP server. &nbsp;That is =
certainly useful to do so, but switches are sometimes pure layer-2 =
switches, and don't implement a DHCP stack not they have a layer-3 =
address to source traffic from.<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Even when the switches have a layer-3 leg, &nbsp;setting then to reach =
out the DHCP server is not a trivial operation, and not one which is =
typically done on layer-2 access =
switches.<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Whenever the LEASEQUERY is mandated, &nbsp;I'd rather have it as a =
SHOULD, with some alternate behavior (delete the entry for =
instance).<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section &nbsp;6.4.2.2, paragrap =
2.1:&nbsp;<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;&nbsp;the SAVI device MUST send a LEASEQUERY =
[RFC5007]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section 7.5.2.1<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; IPv4 address: Send a DHCPLEASEQUERY =
[RFC4388]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;IPv6 address: Send a LEASEQUERY =
[RFC5007]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>2) Section 7.1 &amp; 7.2<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&quot;To perform this process, the SAVI device MUST join the Solicited =
Node<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;Multicast group of the source address of triggering IPv6 =
data packet<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;whenever performing duplicate =
detection.&quot;<o:p></o:p></span></p></div><ul type=3Ddisc><li =
class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l3 level1 lfo3'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I don't =
think a layer-2 switch can and need to join&nbsp;the Solicited =
Node&nbsp; Multicast group of the source address. It does not have a =
layer-3 stack on top of every link it is bridging/switching. It has to =
snoop ND traffic, like it snoops DHCP =
traffic.&nbsp;<o:p></o:p></span></li></ul><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; Section 7.5.1.2<o:p></o:p></span></p></div><ul type=3Ddisc><li =
class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l2 level1 lfo6'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I wonder =
what would be the end-result if the switch send a DAD or and ARP and the =
legitimate owner interpret it as &quot;someone already has the =
address&quot; (always possible depending on its current state). That =
would seriously break DAD or ACD (rfc5227). I think we need a way to =
distinguish &nbsp;between the packets issued by the switch and normal =
DAD or ACD packets. &nbsp;(some field in the header? But that would be a =
protocol change&#8230;).<o:p></o:p></span></li></ul><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Eric<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>From: </span></b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>Jean-Michel Combes &lt;<a =
href=3D"mailto:jeanmichel.combes@gmail.com">jeanmichel.combes@gmail.com</=
a>&gt;<br><b>Date: </b>mardi 8 avril 2014 12:15<br><b>To: </b>SAVI =
Mailing List &lt;<a =
href=3D"mailto:savi@ietf.org">savi@ietf.org</a>&gt;<br><b>Cc: =
</b>&quot;&lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;&quot; &lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;, Ted Lemon &lt;<a =
href=3D"mailto:mellon@fugue.com">mellon@fugue.com</a>&gt;<br><b>Subject: =
</b>[savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><blockquote =
style=3D'border:none;border-left:solid #B5C4DF 4.5pt;padding:0cm 0cm 0cm =
4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:=
5.0pt' =
id=3D"MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"><div><div><div><div><div><div><=
div><div><p class=3DMsoNormal style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Folks,<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>As it has been deeply modified since the last WGLC (version -06), this =
is a new two weeks WGLC for the following document: &quot;SAVI Solution =
for DHCP&quot; (<a =
href=3D"http://tools.ietf.org/html/draft-ietf-savi-dhcp-22">http://tools.=
ietf.org/html/draft-ietf-savi-dhcp-22</a>).<o:p></o:p></span></p></div><p=
 class=3DMsoNormal style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Please, don't hesitate to give your opinion (i.e., =
agreement/disagreement to move forward the document, comments, =
etc.)!<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Thanks in advance.<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Best regards,<o:p></o:p></span></p></div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>JMC.<o:p></o:p></span></p></div></div></div></blockquote></div></body></=
html>
------=_NextPart_000_0017_01CF5E37.BF6C45F0--



From nobody Mon Apr 21 23:51:52 2014
Return-Path: <leaf.yeh.sdo@gmail.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A6FD1A00D4 for <savi@ietfa.amsl.com>; Mon, 21 Apr 2014 23:51:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.999
X-Spam-Level: 
X-Spam-Status: No, score=-3.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, GB_I_LETTER=-2, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gefey8qyfdgc for <savi@ietfa.amsl.com>; Mon, 21 Apr 2014 23:51:42 -0700 (PDT)
Received: from mail-pa0-x231.google.com (mail-pa0-x231.google.com [IPv6:2607:f8b0:400e:c03::231]) by ietfa.amsl.com (Postfix) with ESMTP id 4227B1A0088 for <savi@ietf.org>; Mon, 21 Apr 2014 23:51:42 -0700 (PDT)
Received: by mail-pa0-f49.google.com with SMTP id lj1so4543520pab.8 for <savi@ietf.org>; Mon, 21 Apr 2014 23:51:37 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=from:to:cc:references:in-reply-to:subject:date:message-id :mime-version:content-type:thread-index:content-language; bh=zNpyga4X+QODlTLWKNPjiVFj3s4jjB1Voz5PzAhWGuA=; b=NDBculA0LnnxbujyErTmRUnqGVXeJ47CpMjDyGEIk3XEEYXpUAoYirNKj0ev99GJld 2ERaHQ44fR7ukZp00ifGm9ZhYF8eYTqcg97S6wY9sG2knP/dKE3WdRg0hO0uFWfdX4W/ US/U15kciHn3kNcBNadZTUVT/Uel3VROp7/dMnwwafNl8uwuBWSNtcuC5y453NtXHqEo I7Z5mu3AQRDOkedyfTZvq6nEWVvNQKJoDJxatUr4EDc4pUe8oQ9/Z2yi0rWJTUNBCI6Q fQ+rqnghfW4tjvTOWTaupuzBC5h+fWVdYwEvnX5Wi8rnTfRnzh2y/r0V2QvLdXiXENem 3VKA==
X-Received: by 10.66.119.239 with SMTP id kx15mr37719092pab.51.1398149497039;  Mon, 21 Apr 2014 23:51:37 -0700 (PDT)
Received: from PC ([218.241.103.137]) by mx.google.com with ESMTPSA id ov4sm77970685pbc.46.2014.04.21.23.51.34 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 21 Apr 2014 23:51:36 -0700 (PDT)
From: "Leaf Yeh" <leaf.yeh.sdo@gmail.com>
To: "'Guang Yao'" <yaoguang@cernet.edu.cn>, "'Eric Levy- Abegnoli \(elevyabe\)'" <elevyabe@cisco.com>, "'Jean-Michel Combes'" <jeanmichel.combes@gmail.com>, "'SAVI Mailing List'" <savi@ietf.org>
References: <CAA7e52osoEKeo=EqGF2=PTUrnxC=+8c+GkvF1v4DBQYELYQ6_A@mail.gmail.com> <CF758A35.38C12%elevyabe@cisco.com> <53560af5.c3b3440a.7a58.1cfd@mx.google.com> <001601cf5df4$b146bc00$13d43400$@cernet.edu.cn>
In-Reply-To: <001601cf5df4$b146bc00$13d43400$@cernet.edu.cn>
Date: Tue, 22 Apr 2014 14:51:29 +0800
Message-ID: <53561178.24d9440a.77a0.7bc6@mx.google.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_002B_01CF5E3A.5BCE6200"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AQJ+SCgfdpNGCy/MpS4Q3KK7ONbjpgGWxBw8Al/KbiSZn6Nz4IAAAjEQ
Content-Language: zh-cn
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/jCWRbyP-wLMyn7O2QQrdzawXc64
Cc: draft-ietf-savi-dhcp@tools.ietf.org, 'Ted Lemon' <mellon@fugue.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Apr 2014 06:51:47 -0000

This is a multi-part message in MIME format.

------=_NextPart_000_002B_01CF5E3A.5BCE6200
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Guang - Whenever we use DAD, the messages are not sent to the tentative
node. Thus, SAVI-DHCP is actually different from RFC6620.

 

 

I can't read the difference you mentioned here. J

 

Section 7.5.1.2 @
https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/?include_text=1 

<quote>The messages MUST NOT be sent to the attachment from which the

   triggering packet is received.</quote>

 

Section 3.2.3 of RFC6620 @ http://tools.ietf.org/html/rfc6620#section-3.2.3 

<quote>The DAD_NS messages are not

      sent through any of the ports configured as Validating Ports. </quote>

 

 

Best Regards,

Leaf

 

 

 

From: Guang Yao [mailto:yaoguang@cernet.edu.cn] 
Sent: Tuesday, April 22, 2014 2:33 PM
To: 'Leaf Yeh'; 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes';
'SAVI Mailing List'
Cc: draft-ietf-savi-dhcp@tools.ietf.org; 'Ted Lemon'
Subject: RE: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Hi Leaf and Eric,

 

Maybe there are some misunderstandings... In SAVI-DHCP, as I mentioned in
the last letter, we use plain NS rather than DAD NS. Whenever we use DAD,
the messages are not sent to the tentative node. Thus, SAVI-DHCP is actually
different from RFC6620.Actually, I do think sending DAD NS to the tentative
node will cause some problem.

 

Best regards,

Guang

 

From: savi [mailto:savi-bounces@ietf.org] On Behalf Of Leaf Yeh
Sent: Tuesday, April 22, 2014 2:24 PM
To: 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes'; 'SAVI Mailing
List'
Cc: draft-ietf-savi-dhcp@tools.ietf.org; 'Ted Lemon'
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Eric - Section 7.5.1.2 - I wonder what would be the end-result if the switch
send a DAD or and ARP and the legitimate owner interpret it as "someone
already has the address" (always possible depending on its current state).
That would seriously break DAD or ACD (rfc5227). I think we need a way to
distinguish  between the packets issued by the switch and normal DAD or ACD
packets.  (some field in the header? But that would be a protocol change.).

 

 

As for IPv6 address, I suppose the switch employs the same  process as that
described in section 3.2.3 of RFC6620, page 15 @
http://tools.ietf.org/html/rfc6620#section-3.2.3 

 

<quote>

Upon the reception through a Validating Port (VP) of a DATA packet

      containing IPAddr as the source address, the SAVI device SHOULD

      execute the process of sending Neighbor Solicitation messages of

      the Duplicate Address Detection process as described in Section
<http://tools.ietf.org/html/rfc6620#section-5.4.2> 

      5.4.2 <http://tools.ietf.org/html/rfc6620#section-5.4.2>  of [RFC4862
<http://tools.ietf.org/html/rfc4862> ] for the IPAddr using the following
default

      parameters: DupAddrDetectTransmits set to 2 (i.e., 2 Neighbor

      Solicitation messages for that address will be sent by the SAVI

      device) and RetransTimer set to T_WAIT milliseconds (i.e., the

      time between two Neighbor Solicitation messages is T_WAIT

      milliseconds).

</quote>

 

If you could agreed on the above in RFC6620, I guess you would have no doubt
here for the IPv6 address. J

 

 

Best Regards,

Leaf

 

 

 

From: savi [mailto:savi-bounces@ietf.org] On Behalf Of Eric Levy- Abegnoli
(elevyabe)
Sent: Thursday, April 17, 2014 8:09 PM
To: Jean-Michel Combes; SAVI Mailing List
Cc: <draft-ietf-savi-dhcp@tools.ietf.org>; Ted Lemon
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Hi,

In general, the document looks good. I spot a few substantial issues listed
below:

 

1) There seem to be a requirement in several places of the document (see
below) to send LEASEQUERY to the DHCP server.  That is certainly useful to
do so, but switches are sometimes pure layer-2 switches, and don't implement
a DHCP stack not they have a layer-3 address to source traffic from.

Even when the switches have a layer-3 leg,  setting then to reach out the
DHCP server is not a trivial operation, and not one which is typically done
on layer-2 access switches.

Whenever the LEASEQUERY is mandated,  I'd rather have it as a SHOULD, with
some alternate behavior (delete the entry for instance).

 

Section  6.4.2.2, paragrap 2.1: 

  the SAVI device MUST send a LEASEQUERY [RFC5007]

Section 7.5.2.1

  IPv4 address: Send a DHCPLEASEQUERY [RFC4388]

 IPv6 address: Send a LEASEQUERY [RFC5007]

 

2) Section 7.1 & 7.2

"To perform this process, the SAVI device MUST join the Solicited Node

   Multicast group of the source address of triggering IPv6 data packet

   whenever performing duplicate detection."

*	I don't think a layer-2 switch can and need to join the Solicited
Node  Multicast group of the source address. It does not have a layer-3
stack on top of every link it is bridging/switching. It has to snoop ND
traffic, like it snoops DHCP traffic. 

  Section 7.5.1.2

*	I wonder what would be the end-result if the switch send a DAD or
and ARP and the legitimate owner interpret it as "someone already has the
address" (always possible depending on its current state). That would
seriously break DAD or ACD (rfc5227). I think we need a way to distinguish
between the packets issued by the switch and normal DAD or ACD packets.
(some field in the header? But that would be a protocol change.).

Eric

 

From: Jean-Michel Combes <jeanmichel.combes@gmail.com>
Date: mardi 8 avril 2014 12:15
To: SAVI Mailing List <savi@ietf.org>
Cc: "<draft-ietf-savi-dhcp@tools.ietf.org>"
<draft-ietf-savi-dhcp@tools.ietf.org>, Ted Lemon <mellon@fugue.com>
Subject: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Folks,

As it has been deeply modified since the last WGLC (version -06), this is a
new two weeks WGLC for the following document: "SAVI Solution for DHCP"
(http://tools.ietf.org/html/draft-ietf-savi-dhcp-22).

Please, don't hesitate to give your opinion (i.e., agreement/disagreement to
move forward the document, comments, etc.)!

Thanks in advance.

Best regards,

JMC.


------=_NextPart_000_002B_01CF5E3A.5BCE6200
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 12 =
(filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:Tahoma;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
pre
	{mso-style-priority:99;
	mso-style-link:"HTML \9884\8BBE\683C\5F0F Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:SimSun;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
	{mso-style-priority:99;
	mso-style-link:"\6279\6CE8\6846\6587\672C Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:9.0pt;
	font-family:"Times New Roman","serif";}
span.HTMLChar
	{mso-style-name:"HTML \9884\8BBE\683C\5F0F Char";
	mso-style-priority:99;
	mso-style-link:"HTML \9884\8BBE\683C\5F0F";
	font-family:SimSun;}
span.Char
	{mso-style-name:"\6279\6CE8\6846\6587\672C Char";
	mso-style-priority:99;
	mso-style-link:\6279\6CE8\6846\6587\672C;
	font-family:SimSun;}
span.EmailStyle21
	{mso-style-type:personal;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.EmailStyle22
	{mso-style-type:personal;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.EmailStyle23
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:800878250;
	mso-list-template-ids:-1819782554;}
@list l0:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1
	{mso-list-id:1046950424;
	mso-list-template-ids:-498167776;}
@list l1:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
ol
	{margin-bottom:0cm;}
ul
	{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DZH-CN link=3Dblue =
vlink=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Guang - </span><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Whenever we use DAD, the messages are not sent to the tentative node. =
Thus, SAVI-DHCP is actually different from =
RFC6620.<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>I can&#8217;t read the difference you mentioned here. </span><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:Wingdings;color:#1F497D'>J</span><s=
pan lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Section 7.5.1.2 @ </span><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><a =
href=3D"https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/?include_te=
xt=3D1">https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/?include_te=
xt=3D1</a> <o:p></o:p></span></p><pre style=3D'line-height:14.4pt'><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;quote&gt;</span><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Courier New";color:black'>The =
messages MUST NOT be sent to the attachment from which =
the<o:p></o:p></span></pre><p class=3DMsoNormal =
style=3D'line-height:14.4pt'><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; triggering packet is =
received.</span><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;/quote&gt;<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Section</span><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'> 3.2.3 of RFC6620 @ <a =
href=3D"http://tools.ietf.org/html/rfc6620#section-3.2.3">http://tools.ie=
tf.org/html/rfc6620#section-3.2.3</a> <o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;quote&gt;</span><span lang=3DEN style=3D'font-family:SimSun'>The =
DAD_NS messages are not<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp; =
&nbsp;&nbsp;sent through any of the ports configured as Validating =
Ports.</span><span lang=3DEN =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'> </span><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;/quote&gt;</span><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best Regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Leaf<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span>=
</b><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Guang Yao =
[mailto:yaoguang@cernet.edu.cn] <br><b>Sent:</b> Tuesday, April 22, 2014 =
2:33 PM<br><b>To:</b> 'Leaf Yeh'; 'Eric Levy- Abegnoli (elevyabe)'; =
'Jean-Michel Combes'; 'SAVI Mailing List'<br><b>Cc:</b> =
draft-ietf-savi-dhcp@tools.ietf.org; 'Ted Lemon'<br><b>Subject:</b> RE: =
[savi] WGLC: draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Hi Leaf and Eric,<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Maybe there are some misunderstandings... In SAVI-DHCP, as I =
mentioned in the last letter, we use plain NS rather than DAD NS. =
Whenever we use DAD, the messages are not sent to the tentative node. =
Thus, SAVI-DHCP is actually different from RFC6620.Actually, I do think =
sending DAD NS to the tentative node will cause some =
problem.<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Guang<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span=
></b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'> savi [<a =
href=3D"mailto:savi-bounces@ietf.org">mailto:savi-bounces@ietf.org</a>] =
<b>On Behalf Of </b>Leaf Yeh<br><b>Sent:</b> Tuesday, April 22, 2014 =
2:24 PM<br><b>To:</b> 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel =
Combes'; 'SAVI Mailing List'<br><b>Cc:</b> <a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>; 'Ted Lemon'<br><b>Subject:</b> Re: [savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Eric - </span><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section 7.5.1.2 - I wonder what would be the end-result if the switch =
send a DAD or and ARP and the legitimate owner interpret it as =
&quot;someone already has the address&quot; (always possible depending =
on its current state). That would seriously break DAD or ACD (rfc5227). =
I think we need a way to distinguish &nbsp;between the packets issued by =
the switch and normal DAD or ACD packets. &nbsp;(some field in the =
header? But that would be a protocol =
change&#8230;).<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>As for IPv6 address, I suppose the switch employs the same =
&nbsp;process as that described in section 3.2.3 of RFC6620, page 15 @ =
<a =
href=3D"http://tools.ietf.org/html/rfc6620#section-3.2.3">http://tools.ie=
tf.org/html/rfc6620#section-3.2.3</a> <o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;quote&gt;<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'text-indent:36.0pt;page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>Upon the reception through a Validating =
Port (VP) of a DATA packet<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; containing =
IPAddr as the source address, the SAVI device =
SHOULD<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; execute the =
process of sending Neighbor Solicitation messages =
of<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; the =
Duplicate Address Detection process as described in <a =
href=3D"http://tools.ietf.org/html/rfc6620#section-5.4.2">Section</a><o:p=
></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a =
href=3D"http://tools.ietf.org/html/rfc6620#section-5.4.2">5.4.2</a> of =
[<a href=3D"http://tools.ietf.org/html/rfc4862" title=3D"&quot;IPv6 =
Stateless Address Autoconfiguration&quot;">RFC4862</a>] for the IPAddr =
using the following default<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; parameters: =
DupAddrDetectTransmits set to 2 (i.e., 2 =
Neighbor<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Solicitation =
messages for that address will be sent by the =
SAVI<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; device) and =
RetransTimer set to T_WAIT milliseconds (i.e., =
the<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; time between =
two Neighbor Solicitation messages is T_WAIT<o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
milliseconds).</span><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;/quote&gt;<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>If you could agreed on the above in RFC6620, I guess you would have =
no doubt here for the IPv6 address. </span><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:Wingdings;color:#1F497D'>J</span><s=
pan lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best Regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Leaf<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span>=
</b><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'> savi [<a =
href=3D"mailto:savi-bounces@ietf.org">mailto:savi-bounces@ietf.org</a>] =
<b>On Behalf Of </b>Eric Levy- Abegnoli (elevyabe)<br><b>Sent:</b> =
Thursday, April 17, 2014 8:09 PM<br><b>To:</b> Jean-Michel Combes; SAVI =
Mailing List<br><b>Cc:</b> &lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;; Ted Lemon<br><b>Subject:</b> Re: [savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Hi,<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>In general, the document looks good. I spot a few substantial issues =
listed below:<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>1) There seem to be a requirement in several places of the document =
(see below) to send LEASEQUERY to the DHCP server. &nbsp;That is =
certainly useful to do so, but switches are sometimes pure layer-2 =
switches, and don't implement a DHCP stack not they have a layer-3 =
address to source traffic from.<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Even when the switches have a layer-3 leg, &nbsp;setting then to reach =
out the DHCP server is not a trivial operation, and not one which is =
typically done on layer-2 access =
switches.<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Whenever the LEASEQUERY is mandated, &nbsp;I'd rather have it as a =
SHOULD, with some alternate behavior (delete the entry for =
instance).<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section &nbsp;6.4.2.2, paragrap =
2.1:&nbsp;<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;&nbsp;the SAVI device MUST send a LEASEQUERY =
[RFC5007]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section 7.5.2.1<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; IPv4 address: Send a DHCPLEASEQUERY =
[RFC4388]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;IPv6 address: Send a LEASEQUERY =
[RFC5007]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>2) Section 7.1 &amp; 7.2<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&quot;To perform this process, the SAVI device MUST join the Solicited =
Node<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;Multicast group of the source address of triggering IPv6 =
data packet<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;whenever performing duplicate =
detection.&quot;<o:p></o:p></span></p></div><ul type=3Ddisc><li =
class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l0 level1 lfo1'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I don't =
think a layer-2 switch can and need to join&nbsp;the Solicited =
Node&nbsp; Multicast group of the source address. It does not have a =
layer-3 stack on top of every link it is bridging/switching. It has to =
snoop ND traffic, like it snoops DHCP =
traffic.&nbsp;<o:p></o:p></span></li></ul><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; Section 7.5.1.2<o:p></o:p></span></p></div><ul type=3Ddisc><li =
class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l1 level1 lfo2'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I wonder =
what would be the end-result if the switch send a DAD or and ARP and the =
legitimate owner interpret it as &quot;someone already has the =
address&quot; (always possible depending on its current state). That =
would seriously break DAD or ACD (rfc5227). I think we need a way to =
distinguish &nbsp;between the packets issued by the switch and normal =
DAD or ACD packets. &nbsp;(some field in the header? But that would be a =
protocol change&#8230;).<o:p></o:p></span></li></ul><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Eric<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>From: </span></b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>Jean-Michel Combes &lt;<a =
href=3D"mailto:jeanmichel.combes@gmail.com">jeanmichel.combes@gmail.com</=
a>&gt;<br><b>Date: </b>mardi 8 avril 2014 12:15<br><b>To: </b>SAVI =
Mailing List &lt;<a =
href=3D"mailto:savi@ietf.org">savi@ietf.org</a>&gt;<br><b>Cc: =
</b>&quot;&lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;&quot; &lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;, Ted Lemon &lt;<a =
href=3D"mailto:mellon@fugue.com">mellon@fugue.com</a>&gt;<br><b>Subject: =
</b>[savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><blockquote =
style=3D'border:none;border-left:solid #B5C4DF 4.5pt;padding:0cm 0cm 0cm =
4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:=
5.0pt' =
id=3D"MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"><div><div><div><div><div><div><=
div><div><p class=3DMsoNormal style=3D'margin-bottom:12.0pt'><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Folks,<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>As it has been deeply modified since the last WGLC (version -06), this =
is a new two weeks WGLC for the following document: &quot;SAVI Solution =
for DHCP&quot; (<a =
href=3D"http://tools.ietf.org/html/draft-ietf-savi-dhcp-22">http://tools.=
ietf.org/html/draft-ietf-savi-dhcp-22</a>).<o:p></o:p></span></p></div><p=
 class=3DMsoNormal style=3D'margin-bottom:12.0pt'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Please, don't hesitate to give your opinion (i.e., =
agreement/disagreement to move forward the document, comments, =
etc.)!<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Thanks in advance.<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Best regards,<o:p></o:p></span></p></div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>JMC.<o:p></o:p></span></p></div></div></div></blockquote></div></body></=
html>
------=_NextPart_000_002B_01CF5E3A.5BCE6200--


From nobody Tue Apr 22 00:03:18 2014
Return-Path: <yaoguang@cernet.edu.cn>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD0F41A00CD for <savi@ietfa.amsl.com>; Tue, 22 Apr 2014 00:03:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.171
X-Spam-Level: 
X-Spam-Status: No, score=-4.171 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, GB_I_LETTER=-2, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.272] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0vGnIRlz4bBV for <savi@ietfa.amsl.com>; Tue, 22 Apr 2014 00:03:11 -0700 (PDT)
Received: from cernet.edu.cn (cernet.edu.cn [202.112.39.2]) by ietfa.amsl.com (Postfix) with ESMTP id BD5331A00D8 for <savi@ietf.org>; Tue, 22 Apr 2014 00:03:10 -0700 (PDT)
Received: from AndrewYaoPC (unknown [166.111.132.217]) by centos (Coremail) with SMTP id AQAAf3DbNgMbFFZTeeECAA--.151S2; Tue, 22 Apr 2014 15:02:51 +0800 (CST)
From: "Guang Yao" <yaoguang@cernet.edu.cn>
To: "'Leaf Yeh'" <leaf.yeh.sdo@gmail.com>, "'Eric Levy- Abegnoli \(elevyabe\)'" <elevyabe@cisco.com>, "'Jean-Michel Combes'" <jeanmichel.combes@gmail.com>, "'SAVI Mailing List'" <savi@ietf.org>
References: <CAA7e52osoEKeo=EqGF2=PTUrnxC=+8c+GkvF1v4DBQYELYQ6_A@mail.gmail.com> <CF758A35.38C12%elevyabe@cisco.com> <53560af5.c3b3440a.7a58.1cfd@mx.google.com> <001601cf5df4$b146bc00$13d43400$@cernet.edu.cn> <53561178.24d9440a.77a0.7bc6@mx.google.com>
In-Reply-To: <53561178.24d9440a.77a0.7bc6@mx.google.com>
Date: Tue, 22 Apr 2014 15:02:53 +0800
Message-ID: <003101cf5df8$e1f69560$a5e3c020$@cernet.edu.cn>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0032_01CF5E3B.F01CBB90"
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AQJ+SCgfdpNGCy/MpS4Q3KK7ONbjpgGWxBw8Al/KbiQBgyP+yQLsKylnmXwxLUA=
Content-Language: zh-cn
X-CM-TRANSID: AQAAf3DbNgMbFFZTeeECAA--.151S2
X-Coremail-Antispam: 1UD129KBjvJXoWxKr4fGF18uw45Ar17tw4ktFb_yoWxGF18pa ykGFW3K34DJw1xuw4kW34Ivw4fZrW0kay7GFn7Jw10ya98WFySyr12k398Xr9rJr4kAa1S qa9F934DZw43ZrJanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9qb7Iv0xC_tr1lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2z4x0Y4vE2Ix0cI8IcVAFwI0_JFI_Gr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_ Cr1l84ACjcxK6I8E87Iv67AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVCY1x0267AKxVWxJr 0_GcWle2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG67k08I80eVW5JVWrJwAqx4xG6c80 4VAFz4xC04v7Mc02F40Ew4AK048IF2xKxVWUJVW8JwAqx4xG6xAIxVCFxsxG0wAv7VC2z2 80aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48IcxkI7VAKI48JM4x0Y48I cxkI7VAKI48G6xCjnVAKz4kxMx8GjcxK6IxK0xIIj40E5I8CrwCY02Avz4vE14v_GF4l42 xK82IYc2Ij64vIr41lx2IqxVAqx4xG67AKxVWUGVWUWwC20s026x8GjcxK67AKxVWUGVWU WwC2zVAF1VAY17CE14v26r126r1DMIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr 0_JF4lIxAIcVC0I7IYx2IY6xkF7I0E14v26r1j6r4UMIIF0xvE42xK8VAvwI8IcIk0rVWr Jr0_WFyUJwCI42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r 4UJbIYCTnIWIevJa73UjIFyTuYvjxU2pBTUUUUU
X-CM-SenderInfo: 51drw3xdqjquphuqv3oohg3hdfq/
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/yDWXv-wWsjM_8GSydtoawqym9Bs
Cc: draft-ietf-savi-dhcp@tools.ietf.org, 'Ted Lemon' <mellon@fugue.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Apr 2014 07:03:17 -0000

This is a multipart message in MIME format.

------=_NextPart_000_0032_01CF5E3B.F01CBB90
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Well, I didn't read the sentence in RFC6620 you quoted.  If considering this
sentence, they are equivalent (since non-bound NA will be filtered on
Validating port).

 

Thank you for reminding!

 

Guang

 

From: savi [mailto:savi-bounces@ietf.org] On Behalf Of Leaf Yeh
Sent: Tuesday, April 22, 2014 2:51 PM
To: 'Guang Yao'; 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes';
'SAVI Mailing List'
Cc: draft-ietf-savi-dhcp@tools.ietf.org; 'Ted Lemon'
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Guang - Whenever we use DAD, the messages are not sent to the tentative
node. Thus, SAVI-DHCP is actually different from RFC6620.

 

 

I can't read the difference you mentioned here. :)

 

Section 7.5.1.2 @
https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/?include_text=1 

<quote>The messages MUST NOT be sent to the attachment from which the

   triggering packet is received.</quote>

 

Section 3.2.3 of RFC6620 @ http://tools.ietf.org/html/rfc6620#section-3.2.3 

<quote>The DAD_NS messages are not

      sent through any of the ports configured as Validating Ports. </quote>

 

 

Best Regards,

Leaf

 

 

 

From: Guang Yao [mailto:yaoguang@cernet.edu.cn] 
Sent: Tuesday, April 22, 2014 2:33 PM
To: 'Leaf Yeh'; 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes';
'SAVI Mailing List'
Cc: draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> ; 'Ted Lemon'
Subject: RE: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Hi Leaf and Eric,

 

Maybe there are some misunderstandings... In SAVI-DHCP, as I mentioned in
the last letter, we use plain NS rather than DAD NS. Whenever we use DAD,
the messages are not sent to the tentative node. Thus, SAVI-DHCP is actually
different from RFC6620.Actually, I do think sending DAD NS to the tentative
node will cause some problem.

 

Best regards,

Guang

 

From: savi [mailto:savi-bounces@ietf.org] On Behalf Of Leaf Yeh
Sent: Tuesday, April 22, 2014 2:24 PM
To: 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes'; 'SAVI Mailing
List'
Cc: draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> ; 'Ted Lemon'
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Eric - Section 7.5.1.2 - I wonder what would be the end-result if the switch
send a DAD or and ARP and the legitimate owner interpret it as "someone
already has the address" (always possible depending on its current state).
That would seriously break DAD or ACD (rfc5227). I think we need a way to
distinguish  between the packets issued by the switch and normal DAD or ACD
packets.  (some field in the header? But that would be a protocol change.).

 

 

As for IPv6 address, I suppose the switch employs the same  process as that
described in section 3.2.3 of RFC6620, page 15 @
http://tools.ietf.org/html/rfc6620#section-3.2.3 

 

<quote>

Upon the reception through a Validating Port (VP) of a DATA packet

      containing IPAddr as the source address, the SAVI device SHOULD

      execute the process of sending Neighbor Solicitation messages of

      the Duplicate Address Detection process as described in Section
<http://tools.ietf.org/html/rfc6620#section-5.4.2> 

      5.4.2 <http://tools.ietf.org/html/rfc6620#section-5.4.2>  of [RFC4862
<http://tools.ietf.org/html/rfc4862> ] for the IPAddr using the following
default

      parameters: DupAddrDetectTransmits set to 2 (i.e., 2 Neighbor

      Solicitation messages for that address will be sent by the SAVI

      device) and RetransTimer set to T_WAIT milliseconds (i.e., the

      time between two Neighbor Solicitation messages is T_WAIT

      milliseconds).

</quote>

 

If you could agreed on the above in RFC6620, I guess you would have no doubt
here for the IPv6 address. :)

 

 

Best Regards,

Leaf

 

 

 

From: savi [mailto:savi-bounces@ietf.org] On Behalf Of Eric Levy- Abegnoli
(elevyabe)
Sent: Thursday, April 17, 2014 8:09 PM
To: Jean-Michel Combes; SAVI Mailing List
Cc: <draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> >; Ted Lemon
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Hi,

In general, the document looks good. I spot a few substantial issues listed
below:

 

1) There seem to be a requirement in several places of the document (see
below) to send LEASEQUERY to the DHCP server.  That is certainly useful to
do so, but switches are sometimes pure layer-2 switches, and don't implement
a DHCP stack not they have a layer-3 address to source traffic from.

Even when the switches have a layer-3 leg,  setting then to reach out the
DHCP server is not a trivial operation, and not one which is typically done
on layer-2 access switches.

Whenever the LEASEQUERY is mandated,  I'd rather have it as a SHOULD, with
some alternate behavior (delete the entry for instance).

 

Section  6.4.2.2, paragrap 2.1: 

  the SAVI device MUST send a LEASEQUERY [RFC5007]

Section 7.5.2.1

  IPv4 address: Send a DHCPLEASEQUERY [RFC4388]

 IPv6 address: Send a LEASEQUERY [RFC5007]

 

2) Section 7.1 & 7.2

"To perform this process, the SAVI device MUST join the Solicited Node

   Multicast group of the source address of triggering IPv6 data packet

   whenever performing duplicate detection."

*	I don't think a layer-2 switch can and need to join the Solicited
Node  Multicast group of the source address. It does not have a layer-3
stack on top of every link it is bridging/switching. It has to snoop ND
traffic, like it snoops DHCP traffic. 

  Section 7.5.1.2

*	I wonder what would be the end-result if the switch send a DAD or
and ARP and the legitimate owner interpret it as "someone already has the
address" (always possible depending on its current state). That would
seriously break DAD or ACD (rfc5227). I think we need a way to distinguish
between the packets issued by the switch and normal DAD or ACD packets.
(some field in the header? But that would be a protocol change.).

Eric

 

From: Jean-Michel Combes <jeanmichel.combes@gmail.com
<mailto:jeanmichel.combes@gmail.com> >
Date: mardi 8 avril 2014 12:15
To: SAVI Mailing List <savi@ietf.org <mailto:savi@ietf.org> >
Cc: "<draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> >"
<draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> >, Ted Lemon <mellon@fugue.com
<mailto:mellon@fugue.com> >
Subject: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Folks,

As it has been deeply modified since the last WGLC (version -06), this is a
new two weeks WGLC for the following document: "SAVI Solution for DHCP"
(http://tools.ietf.org/html/draft-ietf-savi-dhcp-22).

Please, don't hesitate to give your opinion (i.e., agreement/disagreement to
move forward the document, comments, etc.)!

Thanks in advance.

Best regards,

JMC.


------=_NextPart_000_0032_01CF5E3B.F01CBB90
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 =
(filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:Tahoma;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
pre
	{mso-style-priority:99;
	mso-style-link:"HTML \9884\8BBE\683C\5F0F Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:SimSun;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
	{mso-style-priority:99;
	mso-style-link:"\6279\6CE8\6846\6587\672C Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:9.0pt;
	font-family:"Times New Roman","serif";}
span.HTMLChar
	{mso-style-name:"HTML \9884\8BBE\683C\5F0F Char";
	mso-style-priority:99;
	mso-style-link:"HTML \9884\8BBE\683C\5F0F";
	font-family:SimSun;}
span.Char
	{mso-style-name:"\6279\6CE8\6846\6587\672C Char";
	mso-style-priority:99;
	mso-style-link:\6279\6CE8\6846\6587\672C;
	font-family:SimSun;}
span.EmailStyle21
	{mso-style-type:personal;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.EmailStyle22
	{mso-style-type:personal;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.EmailStyle23
	{mso-style-type:personal;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.EmailStyle24
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:800878250;
	mso-list-template-ids:-1819782554;}
@list l0:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level2
	{mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l0:level3
	{mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l0:level4
	{mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l0:level5
	{mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l0:level6
	{mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l0:level7
	{mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l0:level8
	{mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l0:level9
	{mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1
	{mso-list-id:1046950424;
	mso-list-template-ids:-498167776;}
@list l1:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level2
	{mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level3
	{mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level4
	{mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level5
	{mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level6
	{mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level7
	{mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level8
	{mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level9
	{mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l2
	{mso-list-id:1966737873;
	mso-list-template-ids:-1497860958;}
@list l2:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2:level2
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l3
	{mso-list-id:2073042090;
	mso-list-template-ids:-1437436542;}
@list l3:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l3:level2
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l3:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l3:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l3:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l3:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l3:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l3:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l3:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
ol
	{margin-bottom:0cm;}
ul
	{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue =
vlink=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Well, I didn&#8217;t read the sentence in RFC6620 you quoted. =
&nbsp;If considering this sentence, they are equivalent (since non-bound =
NA will be filtered on Validating port).<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Thank you for reminding!<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Guang<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span=
></b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'> savi =
[mailto:savi-bounces@ietf.org] <b>On Behalf Of </b>Leaf =
Yeh<br><b>Sent:</b> Tuesday, April 22, 2014 2:51 PM<br><b>To:</b> 'Guang =
Yao'; 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes'; 'SAVI =
Mailing List'<br><b>Cc:</b> draft-ietf-savi-dhcp@tools.ietf.org; 'Ted =
Lemon'<br><b>Subject:</b> Re: [savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Guang - </span><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Whenever we use DAD, the messages are not sent to the tentative node. =
Thus, SAVI-DHCP is actually different from =
RFC6620.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>I can&#8217;t read the difference you mentioned here. </span><span =
style=3D'font-size:11.0pt;font-family:Wingdings;color:#1F497D'>J</span><s=
pan =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Section 7.5.1.2 @ </span><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><a =
href=3D"https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/?include_te=
xt=3D1">https://datatracker.ietf.org/doc/draft-ietf-savi-dhcp/?include_te=
xt=3D1</a> <o:p></o:p></span></p><pre style=3D'line-height:14.4pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;quote&gt;</span><span =
style=3D'font-size:10.0pt;font-family:"Courier New";color:black'>The =
messages MUST NOT be sent to the attachment from which =
the<o:p></o:p></span></pre><p class=3DMsoNormal =
style=3D'line-height:14.4pt'><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; triggering packet is =
received.</span><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;/quote&gt;<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Section</span><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'> 3.2.3 of RFC6620 @ <a =
href=3D"http://tools.ietf.org/html/rfc6620#section-3.2.3">http://tools.ie=
tf.org/html/rfc6620#section-3.2.3</a> <o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;quote&gt;</span><span lang=3DEN style=3D'font-family:SimSun'>The =
DAD_NS messages are not<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp; =
&nbsp;&nbsp;sent through any of the ports configured as Validating =
Ports.</span><span lang=3DEN =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'> </span><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;/quote&gt;</span><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best Regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Leaf<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span>=
</b><span style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'> =
Guang Yao [<a =
href=3D"mailto:yaoguang@cernet.edu.cn">mailto:yaoguang@cernet.edu.cn</a>]=
 <br><b>Sent:</b> Tuesday, April 22, 2014 2:33 PM<br><b>To:</b> 'Leaf =
Yeh'; 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes'; 'SAVI =
Mailing List'<br><b>Cc:</b> <a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>; 'Ted Lemon'<br><b>Subject:</b> RE: [savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Hi Leaf and Eric,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Maybe there are some misunderstandings... In SAVI-DHCP, as I =
mentioned in the last letter, we use plain NS rather than DAD NS. =
Whenever we use DAD, the messages are not sent to the tentative node. =
Thus, SAVI-DHCP is actually different from RFC6620.Actually, I do think =
sending DAD NS to the tentative node will cause some =
problem.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Guang<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span=
></b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'> savi [<a =
href=3D"mailto:savi-bounces@ietf.org">mailto:savi-bounces@ietf.org</a>] =
<b>On Behalf Of </b>Leaf Yeh<br><b>Sent:</b> Tuesday, April 22, 2014 =
2:24 PM<br><b>To:</b> 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel =
Combes'; 'SAVI Mailing List'<br><b>Cc:</b> <a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>; 'Ted Lemon'<br><b>Subject:</b> Re: [savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Eric - </span><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section 7.5.1.2 - I wonder what would be the end-result if the switch =
send a DAD or and ARP and the legitimate owner interpret it as =
&quot;someone already has the address&quot; (always possible depending =
on its current state). That would seriously break DAD or ACD (rfc5227). =
I think we need a way to distinguish &nbsp;between the packets issued by =
the switch and normal DAD or ACD packets. &nbsp;(some field in the =
header? But that would be a protocol =
change&#8230;).<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>As for IPv6 address, I suppose the switch employs the same =
&nbsp;process as that described in section 3.2.3 of RFC6620, page 15 @ =
<a =
href=3D"http://tools.ietf.org/html/rfc6620#section-3.2.3">http://tools.ie=
tf.org/html/rfc6620#section-3.2.3</a> <o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;quote&gt;<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'text-indent:36.0pt;page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>Upon the reception through a Validating =
Port (VP) of a DATA packet<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; containing =
IPAddr as the source address, the SAVI device =
SHOULD<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; execute the =
process of sending Neighbor Solicitation messages =
of<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; the =
Duplicate Address Detection process as described in <a =
href=3D"http://tools.ietf.org/html/rfc6620#section-5.4.2">Section</a><o:p=
></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a =
href=3D"http://tools.ietf.org/html/rfc6620#section-5.4.2">5.4.2</a> of =
[<a href=3D"http://tools.ietf.org/html/rfc4862" title=3D"&quot;IPv6 =
Stateless Address Autoconfiguration&quot;">RFC4862</a>] for the IPAddr =
using the following default<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; parameters: =
DupAddrDetectTransmits set to 2 (i.e., 2 =
Neighbor<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Solicitation =
messages for that address will be sent by the =
SAVI<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; device) and =
RetransTimer set to T_WAIT milliseconds (i.e., =
the<o:p></o:p></span></p><p class=3DMsoNormal =
style=3D'page-break-before:always'><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; time between =
two Neighbor Solicitation messages is T_WAIT<o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN =
style=3D'font-family:SimSun'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
milliseconds).</span><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;/quote&gt;<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>If you could agreed on the above in RFC6620, I guess you would have =
no doubt here for the IPv6 address. </span><span =
style=3D'font-size:10.5pt;font-family:Wingdings;color:#1F497D'>J</span><s=
pan =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best Regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Leaf<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span>=
</b><span style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'> =
savi [<a =
href=3D"mailto:savi-bounces@ietf.org">mailto:savi-bounces@ietf.org</a>] =
<b>On Behalf Of </b>Eric Levy- Abegnoli (elevyabe)<br><b>Sent:</b> =
Thursday, April 17, 2014 8:09 PM<br><b>To:</b> Jean-Michel Combes; SAVI =
Mailing List<br><b>Cc:</b> &lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;; Ted Lemon<br><b>Subject:</b> Re: [savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Hi,<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>In general, the document looks good. I spot a few substantial issues =
listed below:<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>1) There seem to be a requirement in several places of the document =
(see below) to send LEASEQUERY to the DHCP server. &nbsp;That is =
certainly useful to do so, but switches are sometimes pure layer-2 =
switches, and don't implement a DHCP stack not they have a layer-3 =
address to source traffic from.<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Even when the switches have a layer-3 leg, &nbsp;setting then to reach =
out the DHCP server is not a trivial operation, and not one which is =
typically done on layer-2 access =
switches.<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Whenever the LEASEQUERY is mandated, &nbsp;I'd rather have it as a =
SHOULD, with some alternate behavior (delete the entry for =
instance).<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section &nbsp;6.4.2.2, paragrap =
2.1:&nbsp;<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;&nbsp;the SAVI device MUST send a LEASEQUERY =
[RFC5007]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section 7.5.2.1<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; IPv4 address: Send a DHCPLEASEQUERY =
[RFC4388]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;IPv6 address: Send a LEASEQUERY =
[RFC5007]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>2) Section 7.1 &amp; 7.2<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&quot;To perform this process, the SAVI device MUST join the Solicited =
Node<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;Multicast group of the source address of triggering IPv6 =
data packet<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;whenever performing duplicate =
detection.&quot;<o:p></o:p></span></p></div><ul type=3Ddisc><li =
class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l0 level1 lfo3'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I don't =
think a layer-2 switch can and need to join&nbsp;the Solicited =
Node&nbsp; Multicast group of the source address. It does not have a =
layer-3 stack on top of every link it is bridging/switching. It has to =
snoop ND traffic, like it snoops DHCP =
traffic.&nbsp;<o:p></o:p></span></li></ul><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; Section 7.5.1.2<o:p></o:p></span></p></div><ul type=3Ddisc><li =
class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l1 level1 lfo6'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I wonder =
what would be the end-result if the switch send a DAD or and ARP and the =
legitimate owner interpret it as &quot;someone already has the =
address&quot; (always possible depending on its current state). That =
would seriously break DAD or ACD (rfc5227). I think we need a way to =
distinguish &nbsp;between the packets issued by the switch and normal =
DAD or ACD packets. &nbsp;(some field in the header? But that would be a =
protocol change&#8230;).<o:p></o:p></span></li></ul><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Eric<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>From: </span></b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>Jean-Michel Combes &lt;<a =
href=3D"mailto:jeanmichel.combes@gmail.com">jeanmichel.combes@gmail.com</=
a>&gt;<br><b>Date: </b>mardi 8 avril 2014 12:15<br><b>To: </b>SAVI =
Mailing List &lt;<a =
href=3D"mailto:savi@ietf.org">savi@ietf.org</a>&gt;<br><b>Cc: =
</b>&quot;&lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;&quot; &lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;, Ted Lemon &lt;<a =
href=3D"mailto:mellon@fugue.com">mellon@fugue.com</a>&gt;<br><b>Subject: =
</b>[savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><blockquote =
style=3D'border:none;border-left:solid #B5C4DF 4.5pt;padding:0cm 0cm 0cm =
4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:=
5.0pt' =
id=3D"MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"><div><div><div><div><div><div><=
div><div><p class=3DMsoNormal style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Folks,<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>As it has been deeply modified since the last WGLC (version -06), this =
is a new two weeks WGLC for the following document: &quot;SAVI Solution =
for DHCP&quot; (<a =
href=3D"http://tools.ietf.org/html/draft-ietf-savi-dhcp-22">http://tools.=
ietf.org/html/draft-ietf-savi-dhcp-22</a>).<o:p></o:p></span></p></div><p=
 class=3DMsoNormal style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Please, don't hesitate to give your opinion (i.e., =
agreement/disagreement to move forward the document, comments, =
etc.)!<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Thanks in advance.<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Best regards,<o:p></o:p></span></p></div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>JMC.<o:p></o:p></span></p></div></div></div></blockquote></div></body></=
html>
------=_NextPart_000_0032_01CF5E3B.F01CBB90--




From nobody Tue Apr 22 02:21:16 2014
Return-Path: <elevyabe@cisco.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD8681A01BA for <savi@ietfa.amsl.com>; Tue, 22 Apr 2014 02:21:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.773
X-Spam-Level: 
X-Spam-Status: No, score=-9.773 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.272, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EFIFmnskGhYb for <savi@ietfa.amsl.com>; Tue, 22 Apr 2014 02:21:09 -0700 (PDT)
Received: from alln-iport-4.cisco.com (alln-iport-4.cisco.com [173.37.142.91]) by ietfa.amsl.com (Postfix) with ESMTP id CC8D81A0186 for <savi@ietf.org>; Tue, 22 Apr 2014 02:21:08 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1269; q=dns/txt; s=iport; t=1398158464; x=1399368064; h=from:to:cc:subject:date:message-id:in-reply-to: content-id:content-transfer-encoding:mime-version; bh=sBBNH+yFowkuNZxPhQONVWELNWmxmV0qiGjKm8lhtXk=; b=S6n3k57GAEh+cYTuBYBow2RlD6R83djNrOk7lkZluRC8NtNxNhlc812P LGn2ADVk1iIowH/vEK3F2Wy+6bDcCmJqEPJ6QBrur0JzpWD75J6Z+UQUp 4O8xEgn+62hxFATlSOOjR8HLRKwuB4joJWFj8Tdiw6WjREA4Hjqe49yTr A=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AhcFAMozVlOtJV2Y/2dsb2JhbABZDoJ4gSbEFoEUFnSCLHkSAQgOaiUCBAENBYhBzC0XjlYHhDgBA5hwklKCcUCCKw
X-IronPort-AV: E=Sophos;i="4.97,902,1389744000"; d="scan'208";a="37699550"
Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by alln-iport-4.cisco.com with ESMTP; 22 Apr 2014 09:21:03 +0000
Received: from xhc-rcd-x05.cisco.com (xhc-rcd-x05.cisco.com [173.37.183.79]) by rcdn-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id s3M9L2xI005879 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Tue, 22 Apr 2014 09:21:02 GMT
Received: from xmb-rcd-x06.cisco.com ([169.254.6.41]) by xhc-rcd-x05.cisco.com ([173.37.183.79]) with mapi id 14.03.0123.003; Tue, 22 Apr 2014 04:21:03 -0500
From: "Eric Levy- Abegnoli (elevyabe)" <elevyabe@cisco.com>
To: Ted Lemon <mellon@fugue.com>, Guang Yao <yaoguang@cernet.edu.cn>
Thread-Topic: [savi] WGLC: draft-ietf-savi-dhcp-22
Thread-Index: AQHPXgwt8FdOhs9nvUWZJnpcp77q9A==
Date: Tue, 22 Apr 2014 09:21:02 +0000
Message-ID: <CF7BFCD2.38EA7%elevyabe@cisco.com>
In-Reply-To: <D0685C39-0755-4DBC-BED3-AF3684153ABC@fugue.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
user-agent: Microsoft-MacOutlook/14.3.2.130206
x-originating-ip: [10.49.80.39]
Content-Type: text/plain; charset="Windows-1252"
Content-ID: <3642B27867FC8E499FA7905041EB268B@emea.cisco.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/sh-uRQ_MP89gavXcSbYrp3wamSc
Cc: "draft-ietf-savi-dhcp@tools.ietf.org" <draft-ietf-savi-dhcp@tools.ietf.org>, SAVI Mailing List <savi@ietf.org>, Jean-Michel Combes <jeanmichel.combes@gmail.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Apr 2014 09:21:13 -0000

On 21/04/14 18:31, "Ted Lemon" <mellon@fugue.com> wrote:

>Do we really think there are modern layer 2 devices that will implement
>SAVI-DHCP that will not have IPv6 addresses?   This seems highly doubtful
>to me=8Bthe devices that would only have layer two addresses would be
>unmanaged switches.   I have a cheap managed switch, and it has an IPv4
>address and a web server in it.   I think this is a non-problem.
>

The issue is not so much whether they have layer-3 capability, but rather
how they are being deployed. The one thing we cannot impose is to have a
layer-3 stack/address in every subnet a switch is operating on. An access
switch can deal with hundreds, sometimes thousands of links (vlans) and
while it will always have a layer-3 uplink for management purpose,
mandating one layer-3 downlink per vlan is often not operationally
acceptable.
For LeaseQuery, it's a slightly different issue (should not require one
layer-3 per vlan). It drives quite an operational provisioning complexity:
configuration, security, etc wise. . It is currently not very common to
deploy DHCP on access switches when the L2/L3 boundary is one layer up (on
aggregation/distribution). And I am not talking about the one you have at
home.
Eric
=20


From nobody Tue Apr 22 02:46:17 2014
Return-Path: <yaoguang@cernet.edu.cn>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BBB9C1A0141 for <savi@ietfa.amsl.com>; Sun, 20 Apr 2014 19:20:36 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.801
X-Spam-Level: 
X-Spam-Status: No, score=0.801 tagged_above=-999 required=5 tests=[BAYES_50=0.8, HTML_MESSAGE=0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zHgl9GH2p3yv for <savi@ietfa.amsl.com>; Sun, 20 Apr 2014 19:20:32 -0700 (PDT)
Received: from cernet.edu.cn (sea.net.edu.cn [202.112.39.2]) by ietfa.amsl.com (Postfix) with ESMTP id D3B091A0140 for <savi@ietf.org>; Sun, 20 Apr 2014 19:20:31 -0700 (PDT)
Received: from AndrewYaoPC (unknown [101.5.139.26]) by centos (Coremail) with SMTP id AQAAf3A7zwRUgFRTxHkCAA--.75S2; Mon, 21 Apr 2014 10:20:04 +0800 (CST)
From: "Guang Yao" <yaoguang@cernet.edu.cn>
To: "'Eric Levy- Abegnoli \(elevyabe\)'" <elevyabe@cisco.com>, "'Jean-Michel Combes'" <jeanmichel.combes@gmail.com>, "'SAVI Mailing List'" <savi@ietf.org>
References: <CAA7e52osoEKeo=EqGF2=PTUrnxC=+8c+GkvF1v4DBQYELYQ6_A@mail.gmail.com> <CF758A35.38C12%elevyabe@cisco.com>
In-Reply-To: <CF758A35.38C12%elevyabe@cisco.com>
Date: Mon, 21 Apr 2014 10:20:06 +0800
Message-ID: <000901cf5d08$366676c0$a3336440$@cernet.edu.cn>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_000A_01CF5D4B.448B8B80"
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AQGWxBw8aOCAcInCS57YaewRMqhY0JuMhGCw
Content-Language: zh-cn
X-CM-TRANSID: AQAAf3A7zwRUgFRTxHkCAA--.75S2
X-Coremail-Antispam: 1UD129KBjvJXoWxGFy8urWfCF4fur1fWr4xXrb_yoW5tF1kpa yUJrW3tw1kCw4xu3ykuw4xZrWxZryfCFW7tF1DG3Wvyas8uFyxtr1Ikrn0vFy7Cr1kAa1F qanI9w1DAa43Z3DanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvmb7Iv0xC_Kw4lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2z4x0Y4vE2Ix0cI8IcVAFwI0_Gr0_Xr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_ Cr1l84ACjcxK6I8E87Iv67AKxVWxJVW8Jr1l84ACjcxK6I8E87Iv6xkF7I0E14v26r4UJV WxJr1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG67k08I80eVW5JVWrJwAqx4xG6c80 4VAFz4xC04v7Mc02F40Ew4AK048IF2xKxVWUJVW8JwAqx4xG6xAIxVCFxsxG0wAv7VC2z2 80aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48IcxkI7VAKI48JM4x0Y48I cxkI7VAKI48G6xCjnVAKz4kxMx8GjcxK6IxK0xIIj40E5I8CrwCF04k20xvY0x0EwIxGrw C20s026c02F40E14v26r106r1rMI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAF wI0_JF0_Jw1lIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjx v20xvEc7CjxVAFwI0_Jr0_Gr1lIxAIcVCF04k26cxKx2IYs7xG6rWUJVWrZr1UMIIF0xvE x4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Jr0_GrUvcSsGvfC2KfnxnU UI43ZEXa7IU5hXo7UUUUU==
X-CM-SenderInfo: 51drw3xdqjquphuqv3oohg3hdfq/
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/7n_6CGHFrWIT8RYNEqFazg2qBEc
X-Mailman-Approved-At: Tue, 22 Apr 2014 02:46:15 -0700
Cc: draft-ietf-savi-dhcp@tools.ietf.org, 'Ted Lemon' <mellon@fugue.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Apr 2014 02:20:37 -0000

This is a multipart message in MIME format.

------=_NextPart_000_000A_01CF5D4B.448B8B80
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Hi, Eric

 

Thank you very much for the comments!

 

1. 

For the first one, considering the whole "data snooping process" is actually
a "conditional should"(s7.1), the DHCP lease query process is actually no
more than a "conditional  should". The "MUST" just specifies if the data
snooping process is to be implemented, the lease query process will be a
MUST.

Besides, it seems there is no good alternative method to set up bindings
without DHCP lease query; however, if DHCP lease query cannot be performed,
the whole data snooping process is meaningless. Thus, we choose "MUST" on
DHCP lease query process.

 

2.

We fully accept the second comment and will revise the doc accordingly.

 

Best regards,

Guang

 

From: Eric Levy- Abegnoli (elevyabe) [mailto:elevyabe@cisco.com] 
Sent: Thursday, April 17, 2014 8:09 PM
To: Jean-Michel Combes; SAVI Mailing List
Cc: <draft-ietf-savi-dhcp@tools.ietf.org>; Ted Lemon
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Hi,

In general, the document looks good. I spot a few substantial issues listed
below:

 

1) There seem to be a requirement in several places of the document (see
below) to send LEASEQUERY to the DHCP server.  That is certainly useful to
do so, but switches are sometimes pure layer-2 switches, and don't implement
a DHCP stack not they have a layer-3 address to source traffic from.

Even when the switches have a layer-3 leg,  setting then to reach out the
DHCP server is not a trivial operation, and not one which is typically done
on layer-2 access switches.

Whenever the LEASEQUERY is mandated,  I'd rather have it as a SHOULD, with
some alternate behavior (delete the entry for instance).

 

Section  6.4.2.2, paragrap 2.1: 

  the SAVI device MUST send a LEASEQUERY [RFC5007]

Section 7.5.2.1

  IPv4 address: Send a DHCPLEASEQUERY [RFC4388]

 IPv6 address: Send a LEASEQUERY [RFC5007]

 

2) Section 7.1 & 7.2

"To perform this process, the SAVI device MUST join the Solicited Node

   Multicast group of the source address of triggering IPv6 data packet

   whenever performing duplicate detection."

*	I don't think a layer-2 switch can and need to join the Solicited
Node  Multicast group of the source address. It does not have a layer-3
stack on top of every link it is bridging/switching. It has to snoop ND
traffic, like it snoops DHCP traffic. 

  Section 7.5.1.2

*	I wonder what would be the end-result if the switch send a DAD or
and ARP and the legitimate owner interpret it as "someone already has the
address" (always possible depending on its current state). That would
seriously break DAD or ACD (rfc5227). I think we need a way to distinguish
between the packets issued by the switch and normal DAD or ACD packets.
(some field in the header? But that would be a protocol change.).

Eric

 

From: Jean-Michel Combes <jeanmichel.combes@gmail.com
<mailto:jeanmichel.combes@gmail.com> >
Date: mardi 8 avril 2014 12:15
To: SAVI Mailing List <savi@ietf.org <mailto:savi@ietf.org> >
Cc: "<draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> >"
<draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> >, Ted Lemon <mellon@fugue.com
<mailto:mellon@fugue.com> >
Subject: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Folks,

As it has been deeply modified since the last WGLC (version -06), this is a
new two weeks WGLC for the following document: "SAVI Solution for DHCP"
(http://tools.ietf.org/html/draft-ietf-savi-dhcp-22).

Please, don't hesitate to give your opinion (i.e., agreement/disagreement to
move forward the document, comments, etc.)!

Thanks in advance.

Best regards,

JMC.


------=_NextPart_000_000A_01CF5D4B.448B8B80
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 =
(filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
	{mso-style-priority:34;
	margin-top:0cm;
	margin-right:0cm;
	margin-bottom:0cm;
	margin-left:36.0pt;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
span.EmailStyle17
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:1008748575;
	mso-list-template-ids:636000716;}
@list l0:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l0:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l0:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l0:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l0:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l0:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l0:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l0:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1
	{mso-list-id:1186139267;
	mso-list-template-ids:2014202206;}
@list l1:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l1:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l1:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
ol
	{margin-bottom:0cm;}
ul
	{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue =
vlink=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Hi, Eric<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Thank you very much for the comments!<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>1. <o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>For the first one, considering the whole &#8220;data snooping =
process&#8221; is actually a &#8220;conditional should&#8221;(s7.1), the =
DHCP lease query process is actually no more than a &#8220;conditional =
&nbsp;should&#8221;. The &#8220;MUST&#8221; just specifies if the data =
snooping process is to be implemented, the lease query process will be a =
MUST.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Besides, it seems there is no good alternative method to set up =
bindings without DHCP lease query; however, if DHCP lease query cannot =
be performed, the whole data snooping process is meaningless. Thus, we =
choose &#8220;MUST&#8221; on DHCP lease query =
process.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>2.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>We fully accept the second comment and will revise the doc =
accordingly.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Guang<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span=
></b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'> Eric =
Levy- Abegnoli (elevyabe) [mailto:elevyabe@cisco.com] <br><b>Sent:</b> =
Thursday, April 17, 2014 8:09 PM<br><b>To:</b> Jean-Michel Combes; SAVI =
Mailing List<br><b>Cc:</b> &lt;draft-ietf-savi-dhcp@tools.ietf.org&gt;; =
Ted Lemon<br><b>Subject:</b> Re: [savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Hi,<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>In general, the document looks good. I spot a few substantial issues =
listed below:<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>1) There seem to be a requirement in several places of the document =
(see below) to send LEASEQUERY to the DHCP server. &nbsp;That is =
certainly useful to do so, but switches are sometimes pure layer-2 =
switches, and don't implement a DHCP stack not they have a layer-3 =
address to source traffic from.<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Even when the switches have a layer-3 leg, &nbsp;setting then to reach =
out the DHCP server is not a trivial operation, and not one which is =
typically done on layer-2 access =
switches.<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Whenever the LEASEQUERY is mandated, &nbsp;I'd rather have it as a =
SHOULD, with some alternate behavior (delete the entry for =
instance).<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section &nbsp;6.4.2.2, paragrap =
2.1:&nbsp;<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;&nbsp;the SAVI device MUST send a LEASEQUERY =
[RFC5007]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section 7.5.2.1<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; IPv4 address: Send a DHCPLEASEQUERY =
[RFC4388]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;IPv6 address: Send a LEASEQUERY =
[RFC5007]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>2) Section 7.1 &amp; 7.2<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&quot;To perform this process, the SAVI device MUST join the Solicited =
Node<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;Multicast group of the source address of triggering IPv6 =
data packet<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;whenever performing duplicate =
detection.&quot;<o:p></o:p></span></p></div><ul type=3Ddisc><li =
class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l0 level1 lfo1'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I don't =
think a layer-2 switch can and need to join&nbsp;the Solicited =
Node&nbsp; Multicast group of the source address. It does not have a =
layer-3 stack on top of every link it is bridging/switching. It has to =
snoop ND traffic, like it snoops DHCP =
traffic.&nbsp;<o:p></o:p></span></li></ul><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; Section 7.5.1.2<o:p></o:p></span></p></div><ul type=3Ddisc><li =
class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l1 level1 lfo2'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I wonder =
what would be the end-result if the switch send a DAD or and ARP and the =
legitimate owner interpret it as &quot;someone already has the =
address&quot; (always possible depending on its current state). That =
would seriously break DAD or ACD (rfc5227). I think we need a way to =
distinguish &nbsp;between the packets issued by the switch and normal =
DAD or ACD packets. &nbsp;(some field in the header? But that would be a =
protocol change&#8230;).<o:p></o:p></span></li></ul><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Eric<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>From: </span></b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>Jean-Michel Combes &lt;<a =
href=3D"mailto:jeanmichel.combes@gmail.com">jeanmichel.combes@gmail.com</=
a>&gt;<br><b>Date: </b>mardi 8 avril 2014 12:15<br><b>To: </b>SAVI =
Mailing List &lt;<a =
href=3D"mailto:savi@ietf.org">savi@ietf.org</a>&gt;<br><b>Cc: =
</b>&quot;&lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;&quot; &lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;, Ted Lemon &lt;<a =
href=3D"mailto:mellon@fugue.com">mellon@fugue.com</a>&gt;<br><b>Subject: =
</b>[savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><blockquote =
style=3D'border:none;border-left:solid #B5C4DF 4.5pt;padding:0cm 0cm 0cm =
4.0pt;margin-left:3.75pt;margin-right:0cm' =
id=3D"MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"><div><div><div><div><div><div><=
div><div><p class=3DMsoNormal style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Folks,<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>As it has been deeply modified since the last WGLC (version -06), this =
is a new two weeks WGLC for the following document: &quot;SAVI Solution =
for DHCP&quot; (<a =
href=3D"http://tools.ietf.org/html/draft-ietf-savi-dhcp-22">http://tools.=
ietf.org/html/draft-ietf-savi-dhcp-22</a>).<o:p></o:p></span></p></div><p=
 class=3DMsoNormal style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Please, don't hesitate to give your opinion (i.e., =
agreement/disagreement to move forward the document, comments, =
etc.)!<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Thanks in advance.<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Best regards,<o:p></o:p></span></p></div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>JMC.<o:p></o:p></span></p></div></div></div></blockquote></div></body></=
html>
------=_NextPart_000_000A_01CF5D4B.448B8B80--



From nobody Tue Apr 22 02:46:18 2014
Return-Path: <yaoguang@cernet.edu.cn>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 662331A016D for <savi@ietfa.amsl.com>; Sun, 20 Apr 2014 19:35:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.171
X-Spam-Level: 
X-Spam-Status: No, score=-2.171 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.272] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kcnPd7h-vEqK for <savi@ietfa.amsl.com>; Sun, 20 Apr 2014 19:35:17 -0700 (PDT)
Received: from cernet.edu.cn (cernet.edu.cn [202.112.39.2]) by ietfa.amsl.com (Postfix) with ESMTP id 44FF71A0173 for <savi@ietf.org>; Sun, 20 Apr 2014 19:35:16 -0700 (PDT)
Received: from AndrewYaoPC (unknown [101.5.139.26]) by centos (Coremail) with SMTP id AQAAf3BL3wTQg1RTWXoCAA--.76S2; Mon, 21 Apr 2014 10:34:56 +0800 (CST)
From: "Guang Yao" <yaoguang@cernet.edu.cn>
To: "'Eric Levy- Abegnoli \(elevyabe\)'" <elevyabe@cisco.com>, "'Jean-Michel Combes'" <jeanmichel.combes@gmail.com>, "'SAVI Mailing List'" <savi@ietf.org>
References: <CAA7e52osoEKeo=EqGF2=PTUrnxC=+8c+GkvF1v4DBQYELYQ6_A@mail.gmail.com> <CF758A35.38C12%elevyabe@cisco.com> 
In-Reply-To: 
Date: Mon, 21 Apr 2014 10:34:58 +0800
Message-ID: <000e01cf5d0a$4a279d40$de76d7c0$@cernet.edu.cn>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_000F_01CF5D4D.584D2730"
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AQGWxBw8aOCAcInCS57YaewRMqhY0JuMhGCwgAAHJdA=
Content-Language: zh-cn
X-CM-TRANSID: AQAAf3BL3wTQg1RTWXoCAA--.76S2
X-Coremail-Antispam: 1UD129KBjvJXoWxXryUCFWUurWrKF1kJw18Zrb_yoW7Jr1Dpa yDJFW3J34kGw1xW397Xw4xZrZ7urWFkFW2yF1DG3W0y3Z8uFyrtFy2kr1Yvry7Grn3Aa1Y vF4q934kA343Z3DanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUB0b7Iv0xC_Kw4lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2z4x0Y4vE2Ix0cI8IcVAFwI0_JFI_Gr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_ Cr1l84ACjcxK6I8E87Iv67AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVCY1x0267AKxVW8Jr 0_Cr1UM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVAYj202j2C_Xr0_Wr1l5I8CrVAq jxCE14ACF2xKxwAqx4xG64kEw2xG04xIwI0_Jr0_Gr1l5I8CrVCF0I0E4I0vr24lYx0E2I x0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWUJVW8 JwACjcxG0xvY0x0EwIxGrwACjcxG0xvY0x0EwIxGrVCF72vEw4AK0wCjr7xvwVCIw2I0I7 xG6c02F41l42xK82IYc2Ij64vIr41lx2IqxVAqx4xG67AKxVWUGVWUWwC20s026x8GjcxK 67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r126r1DMIIYrxkI7VAKI48JMIIF0xvE2Ix0cI 8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I0E14v26r1j6r4UMIIF0xvE42xK8VAv wI8IcIk0rVWrJr0_WFyUJwCI42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I 0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuYvjxUgWxRDUUUU
X-CM-SenderInfo: 51drw3xdqjquphuqv3oohg3hdfq/
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/w-nP7JGvWrVtC8mkbPCaxIRa5G0
X-Mailman-Approved-At: Tue, 22 Apr 2014 02:46:15 -0700
Cc: draft-ietf-savi-dhcp@tools.ietf.org, 'Ted Lemon' <mellon@fugue.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Apr 2014 02:35:21 -0000

This is a multipart message in MIME format.

------=_NextPart_000_000F_01CF5D4D.584D2730
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Hi, Eric

 

Before we begin modifying the SAVI-DHCP, we find some related text in
RFC6620:

 

1.

"   MLD Considerations

 

   The FCFS SAVI device MUST join the solicited node multicast group for

   all the addresses with a state other than NO_BIND.  This is needed to

   make sure that the FCFS SAVI device will receive the DAD_NS for those

   addresses.  Please note that it may not be enough to rely on the host

   behind the Validating Port to do so, since the node may move, and

   after a while, the packets for that particular solicited node

   multicast group will no longer be forwarded to the FCFS SAVI device.

   Therefore, the FCFS SAVI device MUST join the solicited node

   multicast groups for all the addresses that are in a state other than

   NO_BIND.

"

 

2.

"Upon the reception through a Validating Port (VP) of a DATA packet
      containing IPAddr as the source address, the SAVI device SHOULD
      execute the process of sending Neighbor Solicitation messages of
      the Duplicate Address Detection process as described in Section
      5.4.2 of [RFC4862]

"

 

Maybe such designs also violate your comments? Thank you very much!

 

Best regards,

Guang

 

From: Guang Yao [mailto:yaoguang@cernet.edu.cn] 
Sent: Monday, April 21, 2014 10:20 AM
To: 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes'; 'SAVI Mailing
List'
Cc: '<draft-ietf-savi-dhcp@tools.ietf.org>'; 'Ted Lemon'
Subject: RE: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Hi, Eric

 

Thank you very much for the comments!

 

1. 

For the first one, considering the whole "data snooping process" is actually
a "conditional should"(s7.1), the DHCP lease query process is actually no
more than a "conditional  should". The "MUST" just specifies if the data
snooping process is to be implemented, the lease query process will be a
MUST.

Besides, it seems there is no good alternative method to set up bindings
without DHCP lease query; however, if DHCP lease query cannot be performed,
the whole data snooping process is meaningless. Thus, we choose "MUST" on
DHCP lease query process.

 

2.

We fully accept the second comment and will revise the doc accordingly.

 

Best regards,

Guang

 

From: Eric Levy- Abegnoli (elevyabe) [mailto:elevyabe@cisco.com] 
Sent: Thursday, April 17, 2014 8:09 PM
To: Jean-Michel Combes; SAVI Mailing List
Cc: <draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> >; Ted Lemon
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Hi,

In general, the document looks good. I spot a few substantial issues listed
below:

 

1) There seem to be a requirement in several places of the document (see
below) to send LEASEQUERY to the DHCP server.  That is certainly useful to
do so, but switches are sometimes pure layer-2 switches, and don't implement
a DHCP stack not they have a layer-3 address to source traffic from.

Even when the switches have a layer-3 leg,  setting then to reach out the
DHCP server is not a trivial operation, and not one which is typically done
on layer-2 access switches.

Whenever the LEASEQUERY is mandated,  I'd rather have it as a SHOULD, with
some alternate behavior (delete the entry for instance).

 

Section  6.4.2.2, paragrap 2.1: 

  the SAVI device MUST send a LEASEQUERY [RFC5007]

Section 7.5.2.1

  IPv4 address: Send a DHCPLEASEQUERY [RFC4388]

 IPv6 address: Send a LEASEQUERY [RFC5007]

 

2) Section 7.1 & 7.2

"To perform this process, the SAVI device MUST join the Solicited Node

   Multicast group of the source address of triggering IPv6 data packet

   whenever performing duplicate detection."

*	I don't think a layer-2 switch can and need to join the Solicited
Node  Multicast group of the source address. It does not have a layer-3
stack on top of every link it is bridging/switching. It has to snoop ND
traffic, like it snoops DHCP traffic. 

  Section 7.5.1.2

*	I wonder what would be the end-result if the switch send a DAD or
and ARP and the legitimate owner interpret it as "someone already has the
address" (always possible depending on its current state). That would
seriously break DAD or ACD (rfc5227). I think we need a way to distinguish
between the packets issued by the switch and normal DAD or ACD packets.
(some field in the header? But that would be a protocol change.).

Eric

 

From: Jean-Michel Combes <jeanmichel.combes@gmail.com
<mailto:jeanmichel.combes@gmail.com> >
Date: mardi 8 avril 2014 12:15
To: SAVI Mailing List <savi@ietf.org <mailto:savi@ietf.org> >
Cc: "<draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> >"
<draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> >, Ted Lemon <mellon@fugue.com
<mailto:mellon@fugue.com> >
Subject: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Folks,

As it has been deeply modified since the last WGLC (version -06), this is a
new two weeks WGLC for the following document: "SAVI Solution for DHCP"
(http://tools.ietf.org/html/draft-ietf-savi-dhcp-22).

Please, don't hesitate to give your opinion (i.e., agreement/disagreement to
move forward the document, comments, etc.)!

Thanks in advance.

Best regards,

JMC.


------=_NextPart_000_000F_01CF5D4D.584D2730
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 =
(filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
pre
	{mso-style-priority:99;
	mso-style-link:"HTML \9884\8BBE\683C\5F0F Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:10.0pt;
	font-family:"Courier New";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
	{mso-style-priority:34;
	margin-top:0cm;
	margin-right:0cm;
	margin-bottom:0cm;
	margin-left:36.0pt;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
span.EmailStyle18
	{mso-style-type:personal;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.EmailStyle19
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.HTMLChar
	{mso-style-name:"HTML \9884\8BBE\683C\5F0F Char";
	mso-style-priority:99;
	mso-style-link:"HTML \9884\8BBE\683C\5F0F";
	font-family:"Courier New";}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:176892370;
	mso-list-template-ids:1356241456;}
@list l0:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level2
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1
	{mso-list-id:177549154;
	mso-list-type:hybrid;
	mso-list-template-ids:1484291688 67698703 67698713 67698715 67698703 =
67698713 67698715 67698703 67698713 67698715;}
@list l1:level1
	{mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level2
	{mso-level-number-format:alpha-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level3
	{mso-level-number-format:roman-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:right;
	text-indent:-9.0pt;}
@list l1:level4
	{mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level5
	{mso-level-number-format:alpha-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level6
	{mso-level-number-format:roman-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:right;
	text-indent:-9.0pt;}
@list l1:level7
	{mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level8
	{mso-level-number-format:alpha-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level9
	{mso-level-number-format:roman-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:right;
	text-indent:-9.0pt;}
@list l2
	{mso-list-id:1008748575;
	mso-list-template-ids:636000716;}
@list l2:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l2:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3
	{mso-list-id:1186139267;
	mso-list-template-ids:2014202206;}
@list l3:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l3:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l3:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l4
	{mso-list-id:2037656827;
	mso-list-template-ids:-1706927660;}
@list l4:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level2
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
ol
	{margin-bottom:0cm;}
ul
	{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue =
vlink=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Hi, Eric<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Before we begin modifying the SAVI-DHCP, we find some related text in =
RFC6620:<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>1.<o:p></o:p></span></p><pre><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&#8220;</span><span style=3D'color:black'>&nbsp;&nbsp; MLD =
Considerations<o:p></o:p></span></pre><p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; The FCFS SAVI device MUST join the =
solicited node multicast group for<o:p></o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; all the addresses with a state other than =
NO_BIND.&nbsp; This is needed to<o:p></o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; make sure that the FCFS SAVI device will =
receive the DAD_NS for those<o:p></o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; addresses.&nbsp; Please note that it may =
not be enough to rely on the host<o:p></o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; behind the Validating Port to do so, =
since the node may move, and<o:p></o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; after a while, the packets for that =
particular solicited node<o:p></o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; multicast group will no longer be =
forwarded to the FCFS SAVI device.<o:p></o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; Therefore, the FCFS SAVI device MUST join =
the solicited node<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; multicast groups for all the addresses =
that are in a state other than<o:p></o:p></span></p><p =
class=3DMsoNormal><span style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; NO_BIND.<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&#8221;<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>2.<o:p></o:p></span></p><pre><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&#8220;</span><span style=3D'color:black'>Upon the reception through =
a Validating Port (VP) of a DATA =
packet<o:p></o:p></span></pre><pre><span =
style=3D'color:black'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; containing IPAddr =
as the source address, the SAVI device =
SHOULD<o:p></o:p></span></pre><pre><span =
style=3D'color:black'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; execute the process =
of sending Neighbor Solicitation messages =
of<o:p></o:p></span></pre><pre><span =
style=3D'color:black'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; the Duplicate =
Address Detection process as described in =
Section<o:p></o:p></span></pre><pre><span =
style=3D'color:black'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 5.4.2 of =
[RFC4862]<o:p></o:p></span></pre><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&#8221;<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Maybe such designs also violate your comments? Thank you very =
much!<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Guang<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span=
></b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'> Guang Yao =
[mailto:yaoguang@cernet.edu.cn] <br><b>Sent:</b> Monday, April 21, 2014 =
10:20 AM<br><b>To:</b> 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel =
Combes'; 'SAVI Mailing List'<br><b>Cc:</b> =
'&lt;draft-ietf-savi-dhcp@tools.ietf.org&gt;'; 'Ted =
Lemon'<br><b>Subject:</b> RE: [savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Hi, Eric<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Thank you very much for the comments!<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>1. <o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>For the first one, considering the whole &#8220;data snooping =
process&#8221; is actually a &#8220;conditional should&#8221;(s7.1), the =
DHCP lease query process is actually no more than a &#8220;conditional =
&nbsp;should&#8221;. The &#8220;MUST&#8221; just specifies if the data =
snooping process is to be implemented, the lease query process will be a =
MUST.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Besides, it seems there is no good alternative method to set up =
bindings without DHCP lease query; however, if DHCP lease query cannot =
be performed, the whole data snooping process is meaningless. Thus, we =
choose &#8220;MUST&#8221; on DHCP lease query =
process.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>2.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>We fully accept the second comment and will revise the doc =
accordingly.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Guang<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span=
></b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'> Eric =
Levy- Abegnoli (elevyabe) [<a =
href=3D"mailto:elevyabe@cisco.com">mailto:elevyabe@cisco.com</a>] =
<br><b>Sent:</b> Thursday, April 17, 2014 8:09 PM<br><b>To:</b> =
Jean-Michel Combes; SAVI Mailing List<br><b>Cc:</b> &lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;; Ted Lemon<br><b>Subject:</b> Re: [savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Hi,<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>In general, the document looks good. I spot a few substantial issues =
listed below:<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>1) There seem to be a requirement in several places of the document =
(see below) to send LEASEQUERY to the DHCP server. &nbsp;That is =
certainly useful to do so, but switches are sometimes pure layer-2 =
switches, and don't implement a DHCP stack not they have a layer-3 =
address to source traffic from.<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Even when the switches have a layer-3 leg, &nbsp;setting then to reach =
out the DHCP server is not a trivial operation, and not one which is =
typically done on layer-2 access =
switches.<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Whenever the LEASEQUERY is mandated, &nbsp;I'd rather have it as a =
SHOULD, with some alternate behavior (delete the entry for =
instance).<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section &nbsp;6.4.2.2, paragrap =
2.1:&nbsp;<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;&nbsp;the SAVI device MUST send a LEASEQUERY =
[RFC5007]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section 7.5.2.1<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; IPv4 address: Send a DHCPLEASEQUERY =
[RFC4388]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;IPv6 address: Send a LEASEQUERY =
[RFC5007]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>2) Section 7.1 &amp; 7.2<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&quot;To perform this process, the SAVI device MUST join the Solicited =
Node<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;Multicast group of the source address of triggering IPv6 =
data packet<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;whenever performing duplicate =
detection.&quot;<o:p></o:p></span></p></div><ul type=3Ddisc><li =
class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l2 level1 lfo3'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I don't =
think a layer-2 switch can and need to join&nbsp;the Solicited =
Node&nbsp; Multicast group of the source address. It does not have a =
layer-3 stack on top of every link it is bridging/switching. It has to =
snoop ND traffic, like it snoops DHCP =
traffic.&nbsp;<o:p></o:p></span></li></ul><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; Section 7.5.1.2<o:p></o:p></span></p></div><ul type=3Ddisc><li =
class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l3 level1 lfo6'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I wonder =
what would be the end-result if the switch send a DAD or and ARP and the =
legitimate owner interpret it as &quot;someone already has the =
address&quot; (always possible depending on its current state). That =
would seriously break DAD or ACD (rfc5227). I think we need a way to =
distinguish &nbsp;between the packets issued by the switch and normal =
DAD or ACD packets. &nbsp;(some field in the header? But that would be a =
protocol change&#8230;).<o:p></o:p></span></li></ul><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Eric<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>From: </span></b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>Jean-Michel Combes &lt;<a =
href=3D"mailto:jeanmichel.combes@gmail.com">jeanmichel.combes@gmail.com</=
a>&gt;<br><b>Date: </b>mardi 8 avril 2014 12:15<br><b>To: </b>SAVI =
Mailing List &lt;<a =
href=3D"mailto:savi@ietf.org">savi@ietf.org</a>&gt;<br><b>Cc: =
</b>&quot;&lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;&quot; &lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;, Ted Lemon &lt;<a =
href=3D"mailto:mellon@fugue.com">mellon@fugue.com</a>&gt;<br><b>Subject: =
</b>[savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><blockquote =
style=3D'border:none;border-left:solid #B5C4DF 4.5pt;padding:0cm 0cm 0cm =
4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:=
5.0pt' =
id=3D"MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"><div><div><div><div><div><div><=
div><div><p class=3DMsoNormal style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Folks,<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>As it has been deeply modified since the last WGLC (version -06), this =
is a new two weeks WGLC for the following document: &quot;SAVI Solution =
for DHCP&quot; (<a =
href=3D"http://tools.ietf.org/html/draft-ietf-savi-dhcp-22">http://tools.=
ietf.org/html/draft-ietf-savi-dhcp-22</a>).<o:p></o:p></span></p></div><p=
 class=3DMsoNormal style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Please, don't hesitate to give your opinion (i.e., =
agreement/disagreement to move forward the document, comments, =
etc.)!<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Thanks in advance.<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Best regards,<o:p></o:p></span></p></div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>JMC.<o:p></o:p></span></p></div></div></div></blockquote></div></body></=
html>
------=_NextPart_000_000F_01CF5D4D.584D2730--



From nobody Tue Apr 22 02:46:20 2014
Return-Path: <yaoguang@cernet.edu.cn>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BBD641A0194 for <savi@ietfa.amsl.com>; Sun, 20 Apr 2014 21:17:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.171
X-Spam-Level: 
X-Spam-Status: No, score=-2.171 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.272] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PkSXodgsYMdx for <savi@ietfa.amsl.com>; Sun, 20 Apr 2014 21:17:18 -0700 (PDT)
Received: from cernet.edu.cn (cernet.edu.cn [202.112.39.2]) by ietfa.amsl.com (Postfix) with ESMTP id 6003F1A0100 for <savi@ietf.org>; Sun, 20 Apr 2014 21:17:17 -0700 (PDT)
Received: from AndrewYaoPC (unknown [101.5.139.26]) by centos (Coremail) with SMTP id AQAAf3BbRwewm1RTaX8CAA--.86S2; Mon, 21 Apr 2014 12:16:52 +0800 (CST)
From: "Guang Yao" <yaoguang@cernet.edu.cn>
To: "'Eric Levy- Abegnoli \(elevyabe\)'" <elevyabe@cisco.com>, "'Jean-Michel Combes'" <jeanmichel.combes@gmail.com>, "'SAVI Mailing List'" <savi@ietf.org>
References: <CAA7e52osoEKeo=EqGF2=PTUrnxC=+8c+GkvF1v4DBQYELYQ6_A@mail.gmail.com> <CF758A35.38C12%elevyabe@cisco.com> <000901cf5d08$366676c0$a3336440$@cernet.edu.cn>
In-Reply-To: <000901cf5d08$366676c0$a3336440$@cernet.edu.cn>
Date: Mon, 21 Apr 2014 12:16:51 +0800
Message-ID: <002101cf5d18$877b8090$967281b0$@cernet.edu.cn>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0022_01CF5D5B.95A0E370"
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AQJ+SCgfdpNGCy/MpS4Q3KK7ONbjpgGWxBw8AhngNo6ZoBjZ4A==
Content-Language: zh-cn
X-CM-TRANSID: AQAAf3BbRwewm1RTaX8CAA--.86S2
X-Coremail-Antispam: 1UD129KBjvJXoWxGr4UZw4DurWDGFy3uF4rXwb_yoWrCrW5pa yUJFW3t34kGw4xu3ykuw48ZrW8Zry8CFW3CF1DG3W0v3Z8ZFy8tr4Ikr1Yvry7Gr1DAa1F qa1a9w1DAa43Z3DanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvmb7Iv0xC_tr1lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2z4x0Y4vE2Ix0cI8IcVAFwI0_JFI_Gr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr0_ Cr1l84ACjcxK6I8E87Iv67AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVCY1x0267AKxVW8Jr 0_Cr1UM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVAYj202j2C_Xr0_Wr1l5I8CrVAq jxCE14ACF2xKxwAqx4xG64kEw2xG04xIwI0_Jr0_Gr1l5I8CrVCF0I0E4I0vr24lYx0Ex4 A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWUJVW8JwACjcxG0xvY0x0EwIxGrwACjcxG 0xvY0x0EwIxGrVCF72vEw4AK0wCjr7xvwVCIw2I0I7xG6c02F41l42xK82IYc2Ij64vIr4 1lx2IqxVAqx4xG67AKxVWUGVWUWwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE 14v26r126r1DMIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7 IYx2IY6xkF7I0E14v26r1j6r4UMIIF0xvE42xK8VAvwI8IcIk0rVWrZr1j6s0DMIIF0xvE x4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Jr0_GrUvcSsGvfC2KfnxnU UI43ZEXa7IU8c18PUUUUU==
X-CM-SenderInfo: 51drw3xdqjquphuqv3oohg3hdfq/
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/rYW7brYu2vVRATDTqnpRZ5xADeA
X-Mailman-Approved-At: Tue, 22 Apr 2014 02:46:15 -0700
Cc: draft-ietf-savi-dhcp@tools.ietf.org, 'Ted Lemon' <mellon@fugue.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Apr 2014 04:17:22 -0000

This is a multipart message in MIME format.

------=_NextPart_000_0022_01CF5D5B.95A0E370
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Hi, Eric

 

I realize something is omitted:

 

"Section  6.4.2.2, paragrap 2.1: 

  the SAVI device MUST send a LEASEQUERY [RFC5007]"

 

This procedure is not in the data snooping process. I propose revising these
words to:

 

"the SAVI device MUST send a LEASEQUERY. In case the SAVI device is not
capable of performing the DHCP leasequery process, a DHCP_DEFAULT_LEASE
should be set on the entry."

 

The DHCP_DEFAULT_LEASE can be set based on the purpose of the operator. If
zero is set, the entry will be deleted. 

 

Is this OK?

 

Best regards,

Guang

 

 

From: Guang Yao [mailto:yaoguang@cernet.edu.cn] 
Sent: Monday, April 21, 2014 10:20 AM
To: 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes'; 'SAVI Mailing
List'
Cc: draft-ietf-savi-dhcp@tools.ietf.org; 'Ted Lemon'
Subject: RE: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Hi, Eric

 

Thank you very much for the comments!

 

1. 

For the first one, considering the whole "data snooping process" is actually
a "conditional should"(s7.1), the DHCP lease query process is actually no
more than a "conditional  should". The "MUST" just specifies if the data
snooping process is to be implemented, the lease query process will be a
MUST.

Besides, it seems there is no good alternative method to set up bindings
without DHCP lease query; however, if DHCP lease query cannot be performed,
the whole data snooping process is meaningless. Thus, we choose "MUST" on
DHCP lease query process.

 

2.

We fully accept the second comment and will revise the doc accordingly.

 

Best regards,

Guang

 

From: Eric Levy- Abegnoli (elevyabe) [mailto:elevyabe@cisco.com] 
Sent: Thursday, April 17, 2014 8:09 PM
To: Jean-Michel Combes; SAVI Mailing List
Cc: <draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> >; Ted Lemon
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Hi,

In general, the document looks good. I spot a few substantial issues listed
below:

 

1) There seem to be a requirement in several places of the document (see
below) to send LEASEQUERY to the DHCP server.  That is certainly useful to
do so, but switches are sometimes pure layer-2 switches, and don't implement
a DHCP stack not they have a layer-3 address to source traffic from.

Even when the switches have a layer-3 leg,  setting then to reach out the
DHCP server is not a trivial operation, and not one which is typically done
on layer-2 access switches.

Whenever the LEASEQUERY is mandated,  I'd rather have it as a SHOULD, with
some alternate behavior (delete the entry for instance).

 

Section  6.4.2.2, paragrap 2.1: 

  the SAVI device MUST send a LEASEQUERY [RFC5007]

Section 7.5.2.1

  IPv4 address: Send a DHCPLEASEQUERY [RFC4388]

 IPv6 address: Send a LEASEQUERY [RFC5007]

 

2) Section 7.1 & 7.2

"To perform this process, the SAVI device MUST join the Solicited Node

   Multicast group of the source address of triggering IPv6 data packet

   whenever performing duplicate detection."

*	I don't think a layer-2 switch can and need to join the Solicited
Node  Multicast group of the source address. It does not have a layer-3
stack on top of every link it is bridging/switching. It has to snoop ND
traffic, like it snoops DHCP traffic. 

  Section 7.5.1.2

*	I wonder what would be the end-result if the switch send a DAD or
and ARP and the legitimate owner interpret it as "someone already has the
address" (always possible depending on its current state). That would
seriously break DAD or ACD (rfc5227). I think we need a way to distinguish
between the packets issued by the switch and normal DAD or ACD packets.
(some field in the header? But that would be a protocol change.).

Eric

 

From: Jean-Michel Combes <jeanmichel.combes@gmail.com
<mailto:jeanmichel.combes@gmail.com> >
Date: mardi 8 avril 2014 12:15
To: SAVI Mailing List <savi@ietf.org <mailto:savi@ietf.org> >
Cc: "<draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> >"
<draft-ietf-savi-dhcp@tools.ietf.org
<mailto:draft-ietf-savi-dhcp@tools.ietf.org> >, Ted Lemon <mellon@fugue.com
<mailto:mellon@fugue.com> >
Subject: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Folks,

As it has been deeply modified since the last WGLC (version -06), this is a
new two weeks WGLC for the following document: "SAVI Solution for DHCP"
(http://tools.ietf.org/html/draft-ietf-savi-dhcp-22).

Please, don't hesitate to give your opinion (i.e., agreement/disagreement to
move forward the document, comments, etc.)!

Thanks in advance.

Best regards,

JMC.


------=_NextPart_000_0022_01CF5D5B.95A0E370
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 =
(filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
	{mso-style-priority:34;
	margin-top:0cm;
	margin-right:0cm;
	margin-bottom:0cm;
	margin-left:36.0pt;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
span.EmailStyle18
	{mso-style-type:personal;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.EmailStyle19
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:93520574;
	mso-list-template-ids:-857801212;}
@list l0:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level2
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1
	{mso-list-id:674845703;
	mso-list-template-ids:-1723815590;}
@list l1:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level2
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2
	{mso-list-id:1008748575;
	mso-list-template-ids:636000716;}
@list l2:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l2:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3
	{mso-list-id:1186139267;
	mso-list-template-ids:2014202206;}
@list l3:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l3:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l3:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
ol
	{margin-bottom:0cm;}
ul
	{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DEN-US link=3Dblue =
vlink=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Hi, Eric<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>I realize something is omitted:<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&#8220;Section &nbsp;6.4.2.2, paragrap =
2.1:&nbsp;<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;&nbsp;the SAVI device MUST send a LEASEQUERY =
[RFC5007]&#8221;<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>This procedure is not in the data snooping process. I propose revising =
these words to:<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&#8220;the SAVI device MUST send a LEASEQUERY. In case the SAVI device =
is not capable of performing the DHCP leasequery process, a =
DHCP_DEFAULT_LEASE should be set on the =
entry.&#8221;<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>The DHCP_DEFAULT_LEASE can be set based on the purpose of the operator. =
If zero is set, the entry will be deleted. <o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Is this OK</span><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>?<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Best regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Guang<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span=
></b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'> Guang Yao =
[mailto:yaoguang@cernet.edu.cn] <br><b>Sent:</b> Monday, April 21, 2014 =
10:20 AM<br><b>To:</b> 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel =
Combes'; 'SAVI Mailing List'<br><b>Cc:</b> =
draft-ietf-savi-dhcp@tools.ietf.org; 'Ted Lemon'<br><b>Subject:</b> RE: =
[savi] WGLC: draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Hi, Eric<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Thank you very much for the comments!<o:p></o:p></span></p><p =
class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>1. <o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>For the first one, considering the whole &#8220;data snooping =
process&#8221; is actually a &#8220;conditional should&#8221;(s7.1), the =
DHCP lease query process is actually no more than a &#8220;conditional =
&nbsp;should&#8221;. The &#8220;MUST&#8221; just specifies if the data =
snooping process is to be implemented, the lease query process will be a =
MUST.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Besides, it seems there is no good alternative method to set up =
bindings without DHCP lease query; however, if DHCP lease query cannot =
be performed, the whole data snooping process is meaningless. Thus, we =
choose &#8220;MUST&#8221; on DHCP lease query =
process.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>2.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>We fully accept the second comment and will revise the doc =
accordingly.<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Guang<o:p></o:p></span></p><p class=3DMsoNormal><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:</span=
></b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'> Eric =
Levy- Abegnoli (elevyabe) [<a =
href=3D"mailto:elevyabe@cisco.com">mailto:elevyabe@cisco.com</a>] =
<br><b>Sent:</b> Thursday, April 17, 2014 8:09 PM<br><b>To:</b> =
Jean-Michel Combes; SAVI Mailing List<br><b>Cc:</b> &lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;; Ted Lemon<br><b>Subject:</b> Re: [savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><o:p>&nbsp;</o:p></p><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Hi,<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>In general, the document looks good. I spot a few substantial issues =
listed below:<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>1) There seem to be a requirement in several places of the document =
(see below) to send LEASEQUERY to the DHCP server. &nbsp;That is =
certainly useful to do so, but switches are sometimes pure layer-2 =
switches, and don't implement a DHCP stack not they have a layer-3 =
address to source traffic from.<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Even when the switches have a layer-3 leg, &nbsp;setting then to reach =
out the DHCP server is not a trivial operation, and not one which is =
typically done on layer-2 access =
switches.<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Whenever the LEASEQUERY is mandated, &nbsp;I'd rather have it as a =
SHOULD, with some alternate behavior (delete the entry for =
instance).<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section &nbsp;6.4.2.2, paragrap =
2.1:&nbsp;<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;&nbsp;the SAVI device MUST send a LEASEQUERY =
[RFC5007]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section 7.5.2.1<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; IPv4 address: Send a DHCPLEASEQUERY =
[RFC4388]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;IPv6 address: Send a LEASEQUERY =
[RFC5007]<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>2) Section 7.1 &amp; 7.2<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&quot;To perform this process, the SAVI device MUST join the Solicited =
Node<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;Multicast group of the source address of triggering IPv6 =
data packet<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;whenever performing duplicate =
detection.&quot;<o:p></o:p></span></p></div><ul type=3Ddisc><li =
class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l2 level1 lfo3'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I don't =
think a layer-2 switch can and need to join&nbsp;the Solicited =
Node&nbsp; Multicast group of the source address. It does not have a =
layer-3 stack on top of every link it is bridging/switching. It has to =
snoop ND traffic, like it snoops DHCP =
traffic.&nbsp;<o:p></o:p></span></li></ul><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; Section 7.5.1.2<o:p></o:p></span></p></div><ul type=3Ddisc><li =
class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l3 level1 lfo6'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I wonder =
what would be the end-result if the switch send a DAD or and ARP and the =
legitimate owner interpret it as &quot;someone already has the =
address&quot; (always possible depending on its current state). That =
would seriously break DAD or ACD (rfc5227). I think we need a way to =
distinguish &nbsp;between the packets issued by the switch and normal =
DAD or ACD packets. &nbsp;(some field in the header? But that would be a =
protocol change&#8230;).<o:p></o:p></span></li></ul><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Eric<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>From: </span></b><span =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>Jean-Michel Combes &lt;<a =
href=3D"mailto:jeanmichel.combes@gmail.com">jeanmichel.combes@gmail.com</=
a>&gt;<br><b>Date: </b>mardi 8 avril 2014 12:15<br><b>To: </b>SAVI =
Mailing List &lt;<a =
href=3D"mailto:savi@ietf.org">savi@ietf.org</a>&gt;<br><b>Cc: =
</b>&quot;&lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;&quot; &lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;, Ted Lemon &lt;<a =
href=3D"mailto:mellon@fugue.com">mellon@fugue.com</a>&gt;<br><b>Subject: =
</b>[savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><blockquote =
style=3D'border:none;border-left:solid #B5C4DF 4.5pt;padding:0cm 0cm 0cm =
4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:=
5.0pt' =
id=3D"MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"><div><div><div><div><div><div><=
div><div><p class=3DMsoNormal style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Folks,<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>As it has been deeply modified since the last WGLC (version -06), this =
is a new two weeks WGLC for the following document: &quot;SAVI Solution =
for DHCP&quot; (<a =
href=3D"http://tools.ietf.org/html/draft-ietf-savi-dhcp-22">http://tools.=
ietf.org/html/draft-ietf-savi-dhcp-22</a>).<o:p></o:p></span></p></div><p=
 class=3DMsoNormal style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Please, don't hesitate to give your opinion (i.e., =
agreement/disagreement to move forward the document, comments, =
etc.)!<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Thanks in advance.<o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Best regards,<o:p></o:p></span></p></div><p class=3DMsoNormal><span =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>JMC.<o:p></o:p></span></p></div></div></div></blockquote></div></body></=
html>
------=_NextPart_000_0022_01CF5D5B.95A0E370--



From nobody Tue Apr 22 02:46:41 2014
Return-Path: <mellon@fugue.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D55F1A0243 for <savi@ietfa.amsl.com>; Mon, 21 Apr 2014 09:31:40 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.173
X-Spam-Level: 
X-Spam-Status: No, score=-2.173 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.272, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QHK_sNhLv4RT for <savi@ietfa.amsl.com>; Mon, 21 Apr 2014 09:31:38 -0700 (PDT)
Received: from toccata.fugue.com (toccata.fugue.com [204.152.186.142]) by ietfa.amsl.com (Postfix) with ESMTP id 9EF261A0234 for <savi@ietf.org>; Mon, 21 Apr 2014 09:31:38 -0700 (PDT)
Received: from [10.0.10.40] (c-174-62-147-182.hsd1.nh.comcast.net [174.62.147.182]) by toccata.fugue.com (Postfix) with ESMTPSA id B231123805D9; Mon, 21 Apr 2014 12:31:31 -0400 (EDT)
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Ted Lemon <mellon@fugue.com>
In-Reply-To: <000e01cf5d0a$4a279d40$de76d7c0$@cernet.edu.cn>
Date: Mon, 21 Apr 2014 12:31:29 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <D0685C39-0755-4DBC-BED3-AF3684153ABC@fugue.com>
References: <CAA7e52osoEKeo=EqGF2=PTUrnxC=+8c+GkvF1v4DBQYELYQ6_A@mail.gmail.com> <CF758A35.38C12%elevyabe@cisco.com> <000e01cf5d0a$4a279d40$de76d7c0$@cernet.edu.cn>
To: Guang Yao <yaoguang@cernet.edu.cn>
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/RnRXTkYdA_uIg3VFAuCAAGHPvwM
X-Mailman-Approved-At: Tue, 22 Apr 2014 02:46:36 -0700
Cc: draft-ietf-savi-dhcp@tools.ietf.org, SAVI Mailing List <savi@ietf.org>, Jean-Michel Combes <jeanmichel.combes@gmail.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Apr 2014 16:31:40 -0000

Do we really think there are modern layer 2 devices that will implement =
SAVI-DHCP that will not have IPv6 addresses?   This seems highly =
doubtful to me=97the devices that would only have layer two addresses =
would be unmanaged switches.   I have a cheap managed switch, and it has =
an IPv4 address and a web server in it.   I think this is a non-problem.


From nobody Wed Apr 23 03:30:36 2014
Return-Path: <mellon@fugue.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A67A01A03B4 for <savi@ietfa.amsl.com>; Tue, 22 Apr 2014 04:41:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.173
X-Spam-Level: 
X-Spam-Status: No, score=-2.173 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.272, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S5dFPcHTVLeN for <savi@ietfa.amsl.com>; Tue, 22 Apr 2014 04:41:47 -0700 (PDT)
Received: from toccata.fugue.com (toccata.fugue.com [204.152.186.142]) by ietfa.amsl.com (Postfix) with ESMTP id 1D8631A03A3 for <savi@ietf.org>; Tue, 22 Apr 2014 04:41:47 -0700 (PDT)
Received: from [10.0.10.40] (c-174-62-147-182.hsd1.nh.comcast.net [174.62.147.182]) by toccata.fugue.com (Postfix) with ESMTPSA id 97B612380424; Tue, 22 Apr 2014 07:41:40 -0400 (EDT)
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Ted Lemon <mellon@fugue.com>
In-Reply-To: <CF7BFCD2.38EA7%elevyabe@cisco.com>
Date: Tue, 22 Apr 2014 07:41:38 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <52D2BDC7-9E55-43BC-8248-23C43DCDEF96@fugue.com>
References: <CF7BFCD2.38EA7%elevyabe@cisco.com>
To: "Eric Levy- Abegnoli (elevyabe)" <elevyabe@cisco.com>
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/znbLpQWTNncX8Iv97iCBtV5ULr4
X-Mailman-Approved-At: Wed, 23 Apr 2014 03:30:34 -0700
Cc: "draft-ietf-savi-dhcp@tools.ietf.org" <draft-ietf-savi-dhcp@tools.ietf.org>, Jean-Michel Combes <jeanmichel.combes@gmail.com>, SAVI Mailing List <savi@ietf.org>, Guang Yao <yaoguang@cernet.edu.cn>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Apr 2014 11:41:51 -0000

On Apr 22, 2014, at 5:21 AM, Eric Levy- Abegnoli (elevyabe) =
<elevyabe@cisco.com> wrote:
> The one thing we cannot impose is to have a
> layer-3 stack/address in every subnet a switch is operating on.

IOW the switch can't have a link-local address per subnet?

> For LeaseQuery, it's a slightly different issue (should not require =
one
> layer-3 per vlan). It drives quite an operational provisioning =
complexity:
> configuration, security, etc wise.

Again, if it's a managed switch, it doesn't make sense that you wouldn't =
want it to have a routable L3 address.   You might want to constrain =
what L3 address it has, and yes, there are operational ramifications to =
this.   But are you saying that you aren't managing the switch?

> . It is currently not very common to
> deploy DHCP on access switches when the L2/L3 boundary is one layer up =
(on
> aggregation/distribution). And I am not talking about the one you have =
at
> home.

Of course not.   Mine doesn't do leasequery or SAVI.   I was using it as =
an example of the minimum functionality one might expect in a switch =
that _does_ do SAVI.


From nobody Wed Apr 23 05:01:48 2014
Return-Path: <pthubert@cisco.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 938061A0353 for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 05:01:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.773
X-Spam-Level: 
X-Spam-Status: No, score=-14.773 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.272, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HYtoK1iahDz6 for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 05:01:31 -0700 (PDT)
Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by ietfa.amsl.com (Postfix) with ESMTP id 3D19A1A034A for <savi@ietf.org>; Wed, 23 Apr 2014 05:01:31 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2946; q=dns/txt; s=iport; t=1398254486; x=1399464086; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=NKiD2e+UU7z/RDHv6w/A0BGkflBZ5joVCGaqtJjr8C0=; b=DvC2se1BQL+teQ1waN7RriUO6oPIHByNOlOxHFqpiKOVK5RCRxvvKVsp n7LtTej19pvfkhfrrdO541vvavDZPNENHQx3biVwk6RgoENsIcUMctoeR 0cIvBbt8eOX/dMfhKUkF2a5d6J5AMT+3RN6r6WXFq0wY+pyUNB+TLgWSN 4=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AmUFAEqrV1OtJA2B/2dsb2JhbABZgwZPV7x6hzqBGBZ0giUBAQEDAQEBATc0CwULAgEIDhQUECcLJQIEAQ0FCIgxCA3PIhMEjicxB4MkgRUElQSWRoMxgWsfBRw
X-IronPort-AV: E=Sophos;i="4.97,911,1389744000"; d="scan'208";a="319743631"
Received: from alln-core-9.cisco.com ([173.36.13.129]) by rcdn-iport-8.cisco.com with ESMTP; 23 Apr 2014 12:01:25 +0000
Received: from xhc-aln-x09.cisco.com (xhc-aln-x09.cisco.com [173.36.12.83]) by alln-core-9.cisco.com (8.14.5/8.14.5) with ESMTP id s3NC1P9K031693 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Wed, 23 Apr 2014 12:01:25 GMT
Received: from xmb-rcd-x01.cisco.com ([169.254.1.229]) by xhc-aln-x09.cisco.com ([173.36.12.83]) with mapi id 14.03.0123.003; Wed, 23 Apr 2014 07:01:24 -0500
From: "Pascal Thubert (pthubert)" <pthubert@cisco.com>
To: Ted Lemon <mellon@fugue.com>, "Eric Levy- Abegnoli (elevyabe)" <elevyabe@cisco.com>
Thread-Topic: [savi] WGLC: draft-ietf-savi-dhcp-22
Thread-Index: AQHPXgwtN38N06KZ3k+UXesy9jYewpsd110AgAEwLCA=
Date: Wed, 23 Apr 2014 12:01:24 +0000
Deferred-Delivery: Wed, 23 Apr 2014 12:01:00 +0000
Message-ID: <E045AECD98228444A58C61C200AE1BD842614572@xmb-rcd-x01.cisco.com>
References: <CF7BFCD2.38EA7%elevyabe@cisco.com> <52D2BDC7-9E55-43BC-8248-23C43DCDEF96@fugue.com>
In-Reply-To: <52D2BDC7-9E55-43BC-8248-23C43DCDEF96@fugue.com>
Accept-Language: fr-FR, en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [10.55.22.4]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/cddOWZ6FGUNS4T-E84Vqg3maYqE
Cc: "draft-ietf-savi-dhcp@tools.ietf.org" <draft-ietf-savi-dhcp@tools.ietf.org>, Guang Yao <yaoguang@cernet.edu.cn>, SAVI Mailing List <savi@ietf.org>, Jean-Michel Combes <jeanmichel.combes@gmail.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Apr 2014 12:01:37 -0000

Hello Ted:

> IOW the switch can't have a link-local address per subnet?

[PT]=20

I've never fully made up my mind that a vlan is a subnet. E.g., we use priv=
ate vlans that segregate the subnet in order to isolate some clients or def=
eat some unwanted linklocal scope broadcast storms (because as we know ther=
e's no such a thing as a workable linkscope MLD snooping). This is one of t=
hese multilink subnets that are not supposed to exist...=20

Anyway; whether they are private or not, there can be a great many vlans an=
d it can become a real hassle to configure one SVI per vlan. On top of the =
operator work for CLI and management, there's also all the CPU and memory i=
nvolved. It's not that the switch can't do it but rather that it's not nece=
ssarily a good idea to force the admin to configure an SVI on all vlans.

> Again, if it's a managed switch, it doesn't make sense that you wouldn't =
want
> it to have a routable L3 address.   You might want to constrain what L3
> address it has, and yes, there are operational ramifications to this.   B=
ut are
> you saying that you aren't managing the switch?

[PT] I actually implemented a client to lease query in our SAVI switches, t=
hat will revalidate an address as learnt through DHCP.
It turned out that a function like that can rapidly become a real hassle to=
 configure, with dependencies between otherwise unrelated CLIs.=20
So yes, there is at least one vlan with an SVI on it in a managed switch, a=
nd yes we can use it to source LQ. But it does not mean that it is an easy =
thing to deploy.
=20
> > . It is currently not very common to
> > deploy DHCP on access switches when the L2/L3 boundary is one layer up
> > (on aggregation/distribution). And I am not talking about the one you
> > have at home.
>=20
> Of course not.   Mine doesn't do leasequery or SAVI.   I was using it as =
an
> example of the minimum functionality one might expect in a switch that
> _does_ do SAVI.

[PT] I would not complain that the switch is expected to support the LQ bas=
ed validation function, though adding a dhcpv6 client to a switch image doe=
s not necessarily come for free. It seems to me that the draft goes very de=
ep into the implementation of the guts of the FSM as opposed to the externa=
lly observable behavior, and I'm not sure that this particular FSM is the o=
nly way to implement the function and get all the necessary interoperation.=
 At least there should be enough options to implement some user policies su=
ch as use LQ or not to validate the SAVI state, which, all in all, looks a =
lot like an operator decision.=20

I agree with Guang's proposed change, and maybe we should be documenting th=
e value / risk involved in using LQ or not?

Cheers,

Pascal

> _______________________________________________
> savi mailing list
> savi@ietf.org
> https://www.ietf.org/mailman/listinfo/savi


From nobody Wed Apr 23 08:11:15 2014
Return-Path: <elevyabe@cisco.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 754931A02B5 for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 08:11:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.772
X-Spam-Level: 
X-Spam-Status: No, score=-9.772 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.272, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id va1wVAb372qM for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 08:11:00 -0700 (PDT)
Received: from alln-iport-1.cisco.com (alln-iport-1.cisco.com [173.37.142.88]) by ietfa.amsl.com (Postfix) with ESMTP id 9072D1A03DA for <savi@ietf.org>; Wed, 23 Apr 2014 08:10:52 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=40220; q=dns/txt; s=iport; t=1398265847; x=1399475447; h=from:to:cc:subject:date:message-id:in-reply-to: mime-version; bh=ARMdlicqy38h2yjdh2zupiUUrLnAYcPhv3nNbil6le8=; b=ic0RGVeFP+kOQVag9xLQeFLWQ79aVio7sucRJKp9N87NuJJdeVLCKVKG nxs7X7qsGBv4AmYuo3OXKUDmsaFWMF9Iiff1iFIq5+t6e+umSn1paSTei tngX5MfQk2OBQzx+em8wwBcbSvDl14d8GP/uyYQQtdpILPwWl8ATgJAZj o=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AncFAOnWV1OtJA2M/2dsb2JhbABZDoI0RE9XuzmIeoEaFnSCJQEBAQQtQQsSAQgRAwEBASEBBigRFAkIAgQBDQUbiBIDEQ3IPw2GVBeMQIIHEQYBhDkElwWBcIE3i0uFU4JxQIFrJBw
X-IronPort-AV: E=Sophos; i="4.97,912,1389744000"; d="scan'208,217"; a="38092033"
Received: from alln-core-7.cisco.com ([173.36.13.140]) by alln-iport-1.cisco.com with ESMTP; 23 Apr 2014 15:10:46 +0000
Received: from xhc-rcd-x12.cisco.com (xhc-rcd-x12.cisco.com [173.37.183.86]) by alln-core-7.cisco.com (8.14.5/8.14.5) with ESMTP id s3NFAkXL011839 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Wed, 23 Apr 2014 15:10:46 GMT
Received: from xmb-rcd-x06.cisco.com ([169.254.6.41]) by xhc-rcd-x12.cisco.com ([173.37.183.86]) with mapi id 14.03.0123.003; Wed, 23 Apr 2014 10:10:45 -0500
From: "Eric Levy- Abegnoli (elevyabe)" <elevyabe@cisco.com>
To: Guang Yao <yaoguang@cernet.edu.cn>, "'Jean-Michel Combes'" <jeanmichel.combes@gmail.com>, "'SAVI Mailing List'" <savi@ietf.org>
Thread-Topic: [savi] WGLC: draft-ietf-savi-dhcp-22
Thread-Index: AQHPXwYz8FdOhs9nvUWZJnpcp77q9A==
Date: Wed, 23 Apr 2014 15:10:45 +0000
Message-ID: <CF7DA1D3.390B5%elevyabe@cisco.com>
In-Reply-To: <000e01cf5d0a$4a279d40$de76d7c0$@cernet.edu.cn>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
user-agent: Microsoft-MacOutlook/14.3.2.130206
x-originating-ip: [10.49.80.39]
Content-Type: multipart/alternative; boundary="_000_CF7DA1D3390B5elevyabeciscocom_"
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/oO5d4bLCBG9xLYnhWoPqo4Wj91I
Cc: "draft-ietf-savi-dhcp@tools.ietf.org" <draft-ietf-savi-dhcp@tools.ietf.org>, 'Ted Lemon' <mellon@fugue.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Apr 2014 15:11:07 -0000

--_000_CF7DA1D3390B5elevyabeciscocom_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Hi Guang,
I  find the below section very confusing.  SAVI devices are switches, hence=
 they have other means to punt any traffic they  want to inspect to cpu lev=
el. They would not "join multicast groups". A wild guess on the intention i=
s to get around the case where some MLD snooping device is at stake in the =
network. Works for addresses that you know but can't possibly work for addr=
esses that you don't know yet and that are being DAD'ed.  MLD snooping is j=
ust incompatible with SAVI, and if we accept that fact, joining MLD solicit=
ed group is not needed.
And it has the same issue I raised: access switches cannot reasonably have =
a layer-3 interface on every subnet (link/vlan) they operate on, which coul=
d be thousands.
Sorry that I missed that in 6620.
Eric


From: Guang Yao <yaoguang@cernet.edu.cn<mailto:yaoguang@cernet.edu.cn>>
Date: lundi 21 avril 2014 04:34
To: elevyabe levy-abegnoli <elevyabe@cisco.com<mailto:elevyabe@cisco.com>>,=
 'Jean-Michel Combes' <jeanmichel.combes@gmail.com<mailto:jeanmichel.combes=
@gmail.com>>, 'SAVI Mailing List' <savi@ietf.org<mailto:savi@ietf.org>>
Cc: "draft-ietf-savi-dhcp@tools.ietf.org<mailto:draft-ietf-savi-dhcp@tools.=
ietf.org>" <draft-ietf-savi-dhcp@tools.ietf.org<mailto:draft-ietf-savi-dhcp=
@tools.ietf.org>>, 'Ted Lemon' <mellon@fugue.com<mailto:mellon@fugue.com>>
Subject: RE: [savi] WGLC: draft-ietf-savi-dhcp-22

Hi, Eric

Before we begin modifying the SAVI-DHCP, we find some related text in RFC66=
20:

1.

=93   MLD Considerations

   The FCFS SAVI device MUST join the solicited node multicast group for
   all the addresses with a state other than NO_BIND.  This is needed to
   make sure that the FCFS SAVI device will receive the DAD_NS for those
   addresses.  Please note that it may not be enough to rely on the host
   behind the Validating Port to do so, since the node may move, and
   after a while, the packets for that particular solicited node
   multicast group will no longer be forwarded to the FCFS SAVI device.
   Therefore, the FCFS SAVI device MUST join the solicited node
   multicast groups for all the addresses that are in a state other than
   NO_BIND.
=94

2.

=93Upon the reception through a Validating Port (VP) of a DATA packet

      containing IPAddr as the source address, the SAVI device SHOULD

      execute the process of sending Neighbor Solicitation messages of

      the Duplicate Address Detection process as described in Section

      5.4.2 of [RFC4862]
=94

Maybe such designs also violate your comments? Thank you very much!

Best regards,
Guang

From: Guang Yao [mailto:yaoguang@cernet.edu.cn]
Sent: Monday, April 21, 2014 10:20 AM
To: 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes'; 'SAVI Mailing L=
ist'
Cc: '<draft-ietf-savi-dhcp@tools.ietf.org<mailto:draft-ietf-savi-dhcp@tools=
.ietf.org>>'; 'Ted Lemon'
Subject: RE: [savi] WGLC: draft-ietf-savi-dhcp-22

Hi, Eric

Thank you very much for the comments!

1.
For the first one, considering the whole =93data snooping process=94 is act=
ually a =93conditional should=94(s7.1), the DHCP lease query process is act=
ually no more than a =93conditional  should=94. The =93MUST=94 just specifi=
es if the data snooping process is to be implemented, the lease query proce=
ss will be a MUST.
Besides, it seems there is no good alternative method to set up bindings wi=
thout DHCP lease query; however, if DHCP lease query cannot be performed, t=
he whole data snooping process is meaningless. Thus, we choose =93MUST=94 o=
n DHCP lease query process.

2.
We fully accept the second comment and will revise the doc accordingly.

Best regards,
Guang

From: Eric Levy- Abegnoli (elevyabe) [mailto:elevyabe@cisco.com]
Sent: Thursday, April 17, 2014 8:09 PM
To: Jean-Michel Combes; SAVI Mailing List
Cc: <draft-ietf-savi-dhcp@tools.ietf.org<mailto:draft-ietf-savi-dhcp@tools.=
ietf.org>>; Ted Lemon
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

Hi,
In general, the document looks good. I spot a few substantial issues listed=
 below:

1) There seem to be a requirement in several places of the document (see be=
low) to send LEASEQUERY to the DHCP server.  That is certainly useful to do=
 so, but switches are sometimes pure layer-2 switches, and don't implement =
a DHCP stack not they have a layer-3 address to source traffic from.
Even when the switches have a layer-3 leg,  setting then to reach out the D=
HCP server is not a trivial operation, and not one which is typically done =
on layer-2 access switches.
Whenever the LEASEQUERY is mandated,  I'd rather have it as a SHOULD, with =
some alternate behavior (delete the entry for instance).

Section  6.4.2.2, paragrap 2.1:
  the SAVI device MUST send a LEASEQUERY [RFC5007]
Section 7.5.2.1
  IPv4 address: Send a DHCPLEASEQUERY [RFC4388]
 IPv6 address: Send a LEASEQUERY [RFC5007]

2) Section 7.1 & 7.2
"To perform this process, the SAVI device MUST join the Solicited Node
   Multicast group of the source address of triggering IPv6 data packet
   whenever performing duplicate detection."

  *   I don't think a layer-2 switch can and need to join the Solicited Nod=
e  Multicast group of the source address. It does not have a layer-3 stack =
on top of every link it is bridging/switching. It has to snoop ND traffic, =
like it snoops DHCP traffic.
  Section 7.5.1.2

  *   I wonder what would be the end-result if the switch send a DAD or and=
 ARP and the legitimate owner interpret it as "someone already has the addr=
ess" (always possible depending on its current state). That would seriously=
 break DAD or ACD (rfc5227). I think we need a way to distinguish  between =
the packets issued by the switch and normal DAD or ACD packets.  (some fiel=
d in the header? But that would be a protocol change=85).
Eric

From: Jean-Michel Combes <jeanmichel.combes@gmail.com<mailto:jeanmichel.com=
bes@gmail.com>>
Date: mardi 8 avril 2014 12:15
To: SAVI Mailing List <savi@ietf.org<mailto:savi@ietf.org>>
Cc: "<draft-ietf-savi-dhcp@tools.ietf.org<mailto:draft-ietf-savi-dhcp@tools=
.ietf.org>>" <draft-ietf-savi-dhcp@tools.ietf.org<mailto:draft-ietf-savi-dh=
cp@tools.ietf.org>>, Ted Lemon <mellon@fugue.com<mailto:mellon@fugue.com>>
Subject: [savi] WGLC: draft-ietf-savi-dhcp-22

Folks,
As it has been deeply modified since the last WGLC (version -06), this is a=
 new two weeks WGLC for the following document: "SAVI Solution for DHCP" (h=
ttp://tools.ietf.org/html/draft-ietf-savi-dhcp-22).
Please, don't hesitate to give your opinion (i.e., agreement/disagreement t=
o move forward the document, comments, etc.)!
Thanks in advance.
Best regards,
JMC.

--_000_CF7DA1D3390B5elevyabeciscocom_
Content-Type: text/html; charset="Windows-1252"
Content-ID: <7EAEEF5004D6174B93646E4C71AE8B21@emea.cisco.com>
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
</head>
<body style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-lin=
e-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-fami=
ly: Calibri, sans-serif; ">
<div>Hi Guang,</div>
<div>I &nbsp;find the below section very confusing. &nbsp;SAVI devices are =
switches, hence they have other means to punt any traffic they &nbsp;want t=
o inspect to cpu level. They would not &quot;join multicast groups&quot;. A=
 wild guess on the intention is to get around the case where
 some MLD snooping device is at stake in the network. Works for addresses t=
hat you know but can't possibly work for addresses that you don't know yet =
and that are being DAD'ed. &nbsp;MLD snooping is just incompatible with SAV=
I, and if we accept that fact, joining
 MLD solicited group is not needed.&nbsp;</div>
<div>And it has the same issue I raised: access switches cannot reasonably =
have a layer-3 interface on every subnet (link/vlan) they operate on, which=
 could be thousands.</div>
<div>Sorry that I missed that in 6620.&nbsp;</div>
<div>Eric</div>
<div>&nbsp;</div>
<div><br>
</div>
<span id=3D"OLK_SRC_BODY_SECTION">
<div style=3D"font-family:Calibri; font-size:11pt; text-align:left; color:b=
lack; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM:=
 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid;=
 BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style=3D"font-weight:bold">From: </span>Guang Yao &lt;<a href=3D"mail=
to:yaoguang@cernet.edu.cn">yaoguang@cernet.edu.cn</a>&gt;<br>
<span style=3D"font-weight:bold">Date: </span>lundi 21 avril 2014 04:34<br>
<span style=3D"font-weight:bold">To: </span>elevyabe levy-abegnoli &lt;<a h=
ref=3D"mailto:elevyabe@cisco.com">elevyabe@cisco.com</a>&gt;, 'Jean-Michel =
Combes' &lt;<a href=3D"mailto:jeanmichel.combes@gmail.com">jeanmichel.combe=
s@gmail.com</a>&gt;, 'SAVI Mailing List' &lt;<a href=3D"mailto:savi@ietf.or=
g">savi@ietf.org</a>&gt;<br>
<span style=3D"font-weight:bold">Cc: </span>&quot;<a href=3D"mailto:draft-i=
etf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@tools.ietf.org</a>&quot;=
 &lt;<a href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi=
-dhcp@tools.ietf.org</a>&gt;, 'Ted Lemon' &lt;<a href=3D"mailto:mellon@fugu=
e.com">mellon@fugue.com</a>&gt;<br>
<span style=3D"font-weight:bold">Subject: </span>RE: [savi] WGLC: draft-iet=
f-savi-dhcp-22<br>
</div>
<div><br>
</div>
<blockquote id=3D"MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style=3D"BORDER-LEFT:=
 #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micro=
soft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" x=
mlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:/=
/www.w3.org/TR/REC-html40">
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
pre
	{mso-style-priority:99;
	mso-style-link:"HTML \9884\8BBE\683C\5F0F Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:10.0pt;
	font-family:"Courier New";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
	{mso-style-priority:34;
	margin-top:0cm;
	margin-right:0cm;
	margin-bottom:0cm;
	margin-left:36.0pt;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
span.EmailStyle18
	{mso-style-type:personal;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.EmailStyle19
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.HTMLChar
	{mso-style-name:"HTML \9884\8BBE\683C\5F0F Char";
	mso-style-priority:99;
	mso-style-link:"HTML \9884\8BBE\683C\5F0F";
	font-family:"Courier New";}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:176892370;
	mso-list-template-ids:1356241456;}
@list l0:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level2
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1
	{mso-list-id:177549154;
	mso-list-type:hybrid;
	mso-list-template-ids:1484291688 67698703 67698713 67698715 67698703 67698=
713 67698715 67698703 67698713 67698715;}
@list l1:level1
	{mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level2
	{mso-level-number-format:alpha-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level3
	{mso-level-number-format:roman-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:right;
	text-indent:-9.0pt;}
@list l1:level4
	{mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level5
	{mso-level-number-format:alpha-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level6
	{mso-level-number-format:roman-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:right;
	text-indent:-9.0pt;}
@list l1:level7
	{mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level8
	{mso-level-number-format:alpha-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:left;
	text-indent:-18.0pt;}
@list l1:level9
	{mso-level-number-format:roman-lower;
	mso-level-tab-stop:none;
	mso-level-number-position:right;
	text-indent:-9.0pt;}
@list l2
	{mso-list-id:1008748575;
	mso-list-template-ids:636000716;}
@list l2:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l2:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3
	{mso-list-id:1186139267;
	mso-list-template-ids:2014202206;}
@list l3:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l3:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l3:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l4
	{mso-list-id:2037656827;
	mso-list-template-ids:-1706927660;}
@list l4:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level2
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l4:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
ol
	{margin-bottom:0cm;}
ul
	{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
<div lang=3D"EN-US" link=3D"blue" vlink=3D"purple">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Hi, Eric<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Before we begin modifying the SAVI=
-DHCP, we find some related text in RFC6620:<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">1.<o:p></o:p></span></p>
<pre><span style=3D"font-size: 11pt; font-family: Calibri, sans-serif; colo=
r: rgb(31, 73, 125); ">=93</span><span style=3D"color:black">&nbsp;&nbsp; M=
LD Considerations<o:p></o:p></span></pre>
<p class=3D"MsoNormal"><span style=3D"font-size: 10pt; font-family: 'Courie=
r New'; color: black; "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10pt; font-family: 'Courie=
r New'; color: black; ">&nbsp;&nbsp; The FCFS SAVI device MUST join the sol=
icited node multicast group for<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10pt; font-family: 'Courie=
r New'; color: black; ">&nbsp;&nbsp; all the addresses with a state other t=
han NO_BIND.&nbsp; This is needed to<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10pt; font-family: 'Courie=
r New'; color: black; ">&nbsp;&nbsp; make sure that the FCFS SAVI device wi=
ll receive the DAD_NS for those<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10pt; font-family: 'Courie=
r New'; color: black; ">&nbsp;&nbsp; addresses.&nbsp; Please note that it m=
ay not be enough to rely on the host<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10pt; font-family: 'Courie=
r New'; color: black; ">&nbsp;&nbsp; behind the Validating Port to do so, s=
ince the node may move, and<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10pt; font-family: 'Courie=
r New'; color: black; ">&nbsp;&nbsp; after a while, the packets for that pa=
rticular solicited node<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10pt; font-family: 'Courie=
r New'; color: black; ">&nbsp;&nbsp; multicast group will no longer be forw=
arded to the FCFS SAVI device.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10pt; font-family: 'Courie=
r New'; color: black; ">&nbsp;&nbsp; Therefore, the FCFS SAVI device MUST j=
oin the solicited node<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10pt; font-family: 'Courie=
r New'; color: black; ">&nbsp;&nbsp; multicast groups for all the addresses=
 that are in a state other than<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10pt; font-family: 'Courie=
r New'; color: black; ">&nbsp;&nbsp; NO_BIND.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">=94<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">2.<o:p></o:p></span></p>
<pre><span style=3D"font-size: 11pt; font-family: Calibri, sans-serif; colo=
r: rgb(31, 73, 125); ">=93</span><span style=3D"color:black">Upon the recep=
tion through a Validating Port (VP) of a DATA packet<o:p></o:p></span></pre=
>
<pre><span style=3D"color:black">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; containing =
IPAddr as the source address, the SAVI device SHOULD<o:p></o:p></span></pre=
>
<pre><span style=3D"color:black">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; execute the=
 process of sending Neighbor Solicitation messages of<o:p></o:p></span></pr=
e>
<pre><span style=3D"color:black">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; the Duplica=
te Address Detection process as described in Section<o:p></o:p></span></pre=
>
<pre><span style=3D"color:black">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 5.4.2 of [R=
FC4862]<o:p></o:p></span></pre>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">=94<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Maybe such designs also violate yo=
ur comments? Thank you very much!<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Best regards,<o:p></o:p></span></p=
>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Guang<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal"><b><span style=3D"font-size: 11pt; font-family: Cali=
bri, sans-serif; ">From:</span></b><span style=3D"font-size: 11pt; font-fam=
ily: Calibri, sans-serif; "> Guang Yao [<a href=3D"mailto:yaoguang@cernet.e=
du.cn">mailto:yaoguang@cernet.edu.cn</a>]
<br>
<b>Sent:</b> Monday, April 21, 2014 10:20 AM<br>
<b>To:</b> 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes'; 'SAVI Ma=
iling List'<br>
<b>Cc:</b> '&lt;<a href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draf=
t-ietf-savi-dhcp@tools.ietf.org</a>&gt;'; 'Ted Lemon'<br>
<b>Subject:</b> RE: [savi] WGLC: draft-ietf-savi-dhcp-22<o:p></o:p></span><=
/p>
</div>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Hi, Eric<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Thank you very much for the commen=
ts!<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">1.
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">For the first one, considering the=
 whole =93data snooping process=94 is actually a =93conditional should=94(s=
7.1), the DHCP lease query process is actually
 no more than a =93conditional &nbsp;should=94. The =93MUST=94 just specifi=
es if the data snooping process is to be implemented, the lease query proce=
ss will be a MUST.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Besides, it seems there is no good=
 alternative method to set up bindings without DHCP lease query; however, i=
f DHCP lease query cannot be performed,
 the whole data snooping process is meaningless. Thus, we choose =93MUST=94=
 on DHCP lease query process.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">2.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">We fully accept the second comment=
 and will revise the doc accordingly.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Best regards,<o:p></o:p></span></p=
>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Guang<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal"><b><span style=3D"font-size: 11pt; font-family: Cali=
bri, sans-serif; ">From:</span></b><span style=3D"font-size: 11pt; font-fam=
ily: Calibri, sans-serif; "> Eric Levy- Abegnoli (elevyabe) [<a href=3D"mai=
lto:elevyabe@cisco.com">mailto:elevyabe@cisco.com</a>]
<br>
<b>Sent:</b> Thursday, April 17, 2014 8:09 PM<br>
<b>To:</b> Jean-Michel Combes; SAVI Mailing List<br>
<b>Cc:</b> &lt;<a href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft=
-ietf-savi-dhcp@tools.ietf.org</a>&gt;; Ted Lemon<br>
<b>Subject:</b> Re: [savi] WGLC: draft-ietf-savi-dhcp-22<o:p></o:p></span><=
/p>
</div>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">Hi,<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">In general, the document looks good. I spot=
 a few substantial issues listed below:<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; "><o:p>&nbsp;</o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">1) There seem to be a requirement in severa=
l places of the document (see below) to send LEASEQUERY to the DHCP server.=
 &nbsp;That is certainly useful to do so,
 but switches are sometimes pure layer-2 switches, and don't implement a DH=
CP stack not they have a layer-3 address to source traffic from.<o:p></o:p>=
</span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">Even when the switches have a layer-3 leg, =
&nbsp;setting then to reach out the DHCP server is not a trivial operation,=
 and not one which is typically done on layer-2
 access switches.<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">Whenever the LEASEQUERY is mandated, &nbsp;=
I'd rather have it as a SHOULD, with some alternate behavior (delete the en=
try for instance).<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; "><o:p>&nbsp;</o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">Section &nbsp;6.4.2.2, paragrap 2.1:&nbsp;<=
o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">&nbsp;&nbsp;the SAVI device MUST send a LEA=
SEQUERY [RFC5007]<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">Section 7.5.2.1<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">&nbsp; IPv4 address: Send a DHCPLEASEQUERY =
[RFC4388]<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">&nbsp;IPv6 address: Send a LEASEQUERY [RFC5=
007]<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; "><o:p>&nbsp;</o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">2) Section 7.1 &amp; 7.2<o:p></o:p></span><=
/p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">&quot;To perform this process, the SAVI dev=
ice MUST join the Solicited Node<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">&nbsp; &nbsp;Multicast group of the source =
address of triggering IPv6 data packet<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">&nbsp; &nbsp;whenever performing duplicate =
detection.&quot;<o:p></o:p></span></p>
</div>
<ul type=3D"disc">
<li class=3D"MsoNormal" style=3D"color:black;mso-margin-top-alt:auto;mso-ma=
rgin-bottom-alt:auto;mso-list:l2 level1 lfo3">
<span style=3D"font-size: 10.5pt; font-family: Calibri, sans-serif; ">I don=
't think a layer-2 switch can and need to join&nbsp;the Solicited Node&nbsp=
; Multicast group of the source address. It does not have a layer-3 stack o=
n top of every link it is bridging/switching.
 It has to snoop ND traffic, like it snoops DHCP traffic.&nbsp;<o:p></o:p><=
/span></li></ul>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">&nbsp; Section 7.5.1.2<o:p></o:p></span></p=
>
</div>
<ul type=3D"disc">
<li class=3D"MsoNormal" style=3D"color:black;mso-margin-top-alt:auto;mso-ma=
rgin-bottom-alt:auto;mso-list:l3 level1 lfo6">
<span style=3D"font-size: 10.5pt; font-family: Calibri, sans-serif; ">I won=
der what would be the end-result if the switch send a DAD or and ARP and th=
e legitimate owner interpret it as &quot;someone already has the address&qu=
ot; (always possible depending on its current
 state). That would seriously break DAD or ACD (rfc5227). I think we need a=
 way to distinguish &nbsp;between the packets issued by the switch and norm=
al DAD or ACD packets. &nbsp;(some field in the header? But that would be a=
 protocol change=85).<o:p></o:p></span></li></ul>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">Eric<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; "><o:p>&nbsp;</o:p></span></p>
</div>
<div style=3D"border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal"><b><span style=3D"font-size: 11pt; font-family: Cali=
bri, sans-serif; color: black; ">From:
</span></b><span style=3D"font-size: 11pt; font-family: Calibri, sans-serif=
; color: black; ">Jean-Michel Combes &lt;<a href=3D"mailto:jeanmichel.combe=
s@gmail.com">jeanmichel.combes@gmail.com</a>&gt;<br>
<b>Date: </b>mardi 8 avril 2014 12:15<br>
<b>To: </b>SAVI Mailing List &lt;<a href=3D"mailto:savi@ietf.org">savi@ietf=
.org</a>&gt;<br>
<b>Cc: </b>&quot;&lt;<a href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org"=
>draft-ietf-savi-dhcp@tools.ietf.org</a>&gt;&quot; &lt;<a href=3D"mailto:dr=
aft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@tools.ietf.org</a>&=
gt;, Ted Lemon &lt;<a href=3D"mailto:mellon@fugue.com">mellon@fugue.com</a>=
&gt;<br>
<b>Subject: </b>[savi] WGLC: draft-ietf-savi-dhcp-22<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; "><o:p>&nbsp;</o:p></span></p>
</div>
<blockquote style=3D"border:none;border-left:solid #B5C4DF 4.5pt;padding:0c=
m 0cm 0cm 4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0cm;margin=
-bottom:5.0pt" id=3D"MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s=
ize: 10.5pt; font-family: Calibri, sans-serif; color: black; ">Folks,<o:p><=
/o:p></span></p>
</div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s=
ize: 10.5pt; font-family: Calibri, sans-serif; color: black; ">As it has be=
en deeply modified since the last WGLC (version -06), this is a new two wee=
ks WGLC for the following document: &quot;SAVI
 Solution for DHCP&quot; (<a href=3D"http://tools.ietf.org/html/draft-ietf-=
savi-dhcp-22">http://tools.ietf.org/html/draft-ietf-savi-dhcp-22</a>).<o:p>=
</o:p></span></p>
</div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s=
ize: 10.5pt; font-family: Calibri, sans-serif; color: black; ">Please, don'=
t hesitate to give your opinion (i.e., agreement/disagreement to move forwa=
rd the document, comments, etc.)!<o:p></o:p></span></p>
</div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s=
ize: 10.5pt; font-family: Calibri, sans-serif; color: black; ">Thanks in ad=
vance.<o:p></o:p></span></p>
</div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s=
ize: 10.5pt; font-family: Calibri, sans-serif; color: black; ">Best regards=
,<o:p></o:p></span></p>
</div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">JMC.<o:p></o:p></span></p>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
</span>
</body>
</html>

--_000_CF7DA1D3390B5elevyabeciscocom_--


From nobody Wed Apr 23 08:13:49 2014
Return-Path: <elevyabe@cisco.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7ED751A03DF for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 08:13:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -14.772
X-Spam-Level: 
X-Spam-Status: No, score=-14.772 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.272, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZBjx3qMfTbZU for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 08:13:31 -0700 (PDT)
Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by ietfa.amsl.com (Postfix) with ESMTP id ED7041A03D1 for <savi@ietf.org>; Wed, 23 Apr 2014 08:13:30 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=34346; q=dns/txt; s=iport; t=1398266005; x=1399475605; h=from:to:cc:subject:date:message-id:in-reply-to: mime-version; bh=ungGW6Q3yO7zE20LGyvrPy+gBMW9q6dNhZ9POQv4W5c=; b=D50HgDlSS4ssDl0zUcVSbwx8zC2UXTdCkfsdQR8ogNtbIIHRHW1lfs6V nh/V7O5RtPIqqWsZR6Y9ADkiOpt34HZvpOZkNpGTCaOpG39C4u/AkoENy ieXKYL36Nzc1JbIrt/CU4S2ylI/5JcllF2X3EN/23qigCxSY6m9/F0T6k M=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AncFADTXV1OtJV2c/2dsb2JhbABZDoI0RE9XuzmIeoEaFnSCJQEBAQQtQQsSAQgRAwEBASEBBigRFAkIAgQBDQUbhgKCEAMRDchBDYZUF4xAggcRBgGEOQSXBYFwgTeLS4VTgnFAgWlC
X-IronPort-AV: E=Sophos;i="4.97,912,1389744000";  d="scan'208,217";a="319740434"
Received: from rcdn-core-5.cisco.com ([173.37.93.156]) by rcdn-iport-2.cisco.com with ESMTP; 23 Apr 2014 15:13:22 +0000
Received: from xhc-rcd-x12.cisco.com (xhc-rcd-x12.cisco.com [173.37.183.86]) by rcdn-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id s3NFDMWu032343 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Wed, 23 Apr 2014 15:13:22 GMT
Received: from xmb-rcd-x06.cisco.com ([169.254.6.41]) by xhc-rcd-x12.cisco.com ([173.37.183.86]) with mapi id 14.03.0123.003; Wed, 23 Apr 2014 10:13:22 -0500
From: "Eric Levy- Abegnoli (elevyabe)" <elevyabe@cisco.com>
To: Guang Yao <yaoguang@cernet.edu.cn>, "'Jean-Michel Combes'" <jeanmichel.combes@gmail.com>, "'SAVI Mailing List'" <savi@ietf.org>
Thread-Topic: [savi] WGLC: draft-ietf-savi-dhcp-22
Thread-Index: AQHPXwaQ8FdOhs9nvUWZJnpcp77q9A==
Date: Wed, 23 Apr 2014 15:13:21 +0000
Message-ID: <CF7DA49E.390D0%elevyabe@cisco.com>
In-Reply-To: <002101cf5d18$877b8090$967281b0$@cernet.edu.cn>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
user-agent: Microsoft-MacOutlook/14.3.2.130206
x-originating-ip: [10.49.80.39]
Content-Type: multipart/alternative; boundary="_000_CF7DA49E390D0elevyabeciscocom_"
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/3zzXSGYcaLFgDDteZFk7cScEbmw
Cc: "draft-ietf-savi-dhcp@tools.ietf.org" <draft-ietf-savi-dhcp@tools.ietf.org>, 'Ted Lemon' <mellon@fugue.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Apr 2014 15:13:35 -0000

--_000_CF7DA49E390D0elevyabeciscocom_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Hi Guang,
I am not sure how to read this ("MUST" followed but "if it can't").  Isn't =
it contradictory? I thought "SHOULD" was exactly the way to say that.
Eric

From: Guang Yao <yaoguang@cernet.edu.cn<mailto:yaoguang@cernet.edu.cn>>
Date: lundi 21 avril 2014 06:16
To: elevyabe levy-abegnoli <elevyabe@cisco.com<mailto:elevyabe@cisco.com>>,=
 'Jean-Michel Combes' <jeanmichel.combes@gmail.com<mailto:jeanmichel.combes=
@gmail.com>>, 'SAVI Mailing List' <savi@ietf.org<mailto:savi@ietf.org>>
Cc: "draft-ietf-savi-dhcp@tools.ietf.org<mailto:draft-ietf-savi-dhcp@tools.=
ietf.org>" <draft-ietf-savi-dhcp@tools.ietf.org<mailto:draft-ietf-savi-dhcp=
@tools.ietf.org>>, 'Ted Lemon' <mellon@fugue.com<mailto:mellon@fugue.com>>
Subject: RE: [savi] WGLC: draft-ietf-savi-dhcp-22

Hi, Eric

I realize something is omitted:

=93Section  6.4.2.2, paragrap 2.1:
  the SAVI device MUST send a LEASEQUERY [RFC5007]=94

This procedure is not in the data snooping process. I propose revising thes=
e words to:

=93the SAVI device MUST send a LEASEQUERY. In case the SAVI device is not c=
apable of performing the DHCP leasequery process, a DHCP_DEFAULT_LEASE shou=
ld be set on the entry.=94

The DHCP_DEFAULT_LEASE can be set based on the purpose of the operator. If =
zero is set, the entry will be deleted.

Is this OK?

Best regards,
Guang


From: Guang Yao [mailto:yaoguang@cernet.edu.cn]
Sent: Monday, April 21, 2014 10:20 AM
To: 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes'; 'SAVI Mailing L=
ist'
Cc: draft-ietf-savi-dhcp@tools.ietf.org<mailto:draft-ietf-savi-dhcp@tools.i=
etf.org>; 'Ted Lemon'
Subject: RE: [savi] WGLC: draft-ietf-savi-dhcp-22

Hi, Eric

Thank you very much for the comments!

1.
For the first one, considering the whole =93data snooping process=94 is act=
ually a =93conditional should=94(s7.1), the DHCP lease query process is act=
ually no more than a =93conditional  should=94. The =93MUST=94 just specifi=
es if the data snooping process is to be implemented, the lease query proce=
ss will be a MUST.
Besides, it seems there is no good alternative method to set up bindings wi=
thout DHCP lease query; however, if DHCP lease query cannot be performed, t=
he whole data snooping process is meaningless. Thus, we choose =93MUST=94 o=
n DHCP lease query process.

2.
We fully accept the second comment and will revise the doc accordingly.

Best regards,
Guang

From: Eric Levy- Abegnoli (elevyabe) [mailto:elevyabe@cisco.com]
Sent: Thursday, April 17, 2014 8:09 PM
To: Jean-Michel Combes; SAVI Mailing List
Cc: <draft-ietf-savi-dhcp@tools.ietf.org<mailto:draft-ietf-savi-dhcp@tools.=
ietf.org>>; Ted Lemon
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

Hi,
In general, the document looks good. I spot a few substantial issues listed=
 below:

1) There seem to be a requirement in several places of the document (see be=
low) to send LEASEQUERY to the DHCP server.  That is certainly useful to do=
 so, but switches are sometimes pure layer-2 switches, and don't implement =
a DHCP stack not they have a layer-3 address to source traffic from.
Even when the switches have a layer-3 leg,  setting then to reach out the D=
HCP server is not a trivial operation, and not one which is typically done =
on layer-2 access switches.
Whenever the LEASEQUERY is mandated,  I'd rather have it as a SHOULD, with =
some alternate behavior (delete the entry for instance).

Section  6.4.2.2, paragrap 2.1:
  the SAVI device MUST send a LEASEQUERY [RFC5007]
Section 7.5.2.1
  IPv4 address: Send a DHCPLEASEQUERY [RFC4388]
 IPv6 address: Send a LEASEQUERY [RFC5007]

2) Section 7.1 & 7.2
"To perform this process, the SAVI device MUST join the Solicited Node
   Multicast group of the source address of triggering IPv6 data packet
   whenever performing duplicate detection."

  *   I don't think a layer-2 switch can and need to join the Solicited Nod=
e  Multicast group of the source address. It does not have a layer-3 stack =
on top of every link it is bridging/switching. It has to snoop ND traffic, =
like it snoops DHCP traffic.
  Section 7.5.1.2

  *   I wonder what would be the end-result if the switch send a DAD or and=
 ARP and the legitimate owner interpret it as "someone already has the addr=
ess" (always possible depending on its current state). That would seriously=
 break DAD or ACD (rfc5227). I think we need a way to distinguish  between =
the packets issued by the switch and normal DAD or ACD packets.  (some fiel=
d in the header? But that would be a protocol change=85).
Eric

From: Jean-Michel Combes <jeanmichel.combes@gmail.com<mailto:jeanmichel.com=
bes@gmail.com>>
Date: mardi 8 avril 2014 12:15
To: SAVI Mailing List <savi@ietf.org<mailto:savi@ietf.org>>
Cc: "<draft-ietf-savi-dhcp@tools.ietf.org<mailto:draft-ietf-savi-dhcp@tools=
.ietf.org>>" <draft-ietf-savi-dhcp@tools.ietf.org<mailto:draft-ietf-savi-dh=
cp@tools.ietf.org>>, Ted Lemon <mellon@fugue.com<mailto:mellon@fugue.com>>
Subject: [savi] WGLC: draft-ietf-savi-dhcp-22

Folks,
As it has been deeply modified since the last WGLC (version -06), this is a=
 new two weeks WGLC for the following document: "SAVI Solution for DHCP" (h=
ttp://tools.ietf.org/html/draft-ietf-savi-dhcp-22).
Please, don't hesitate to give your opinion (i.e., agreement/disagreement t=
o move forward the document, comments, etc.)!
Thanks in advance.
Best regards,
JMC.

--_000_CF7DA49E390D0elevyabeciscocom_
Content-Type: text/html; charset="Windows-1252"
Content-ID: <A34C64CCBF39DE499B8E743412D25AA7@emea.cisco.com>
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
</head>
<body style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-lin=
e-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-fami=
ly: Calibri, sans-serif; ">
<div>Hi Guang,</div>
<div>I am not sure how to read this (&quot;MUST&quot; followed but &quot;if=
 it can't&quot;). &nbsp;Isn't it contradictory? I thought &quot;SHOULD&quot=
; was exactly the way to say that.&nbsp;</div>
<div>Eric</div>
<div><br>
</div>
<span id=3D"OLK_SRC_BODY_SECTION">
<div style=3D"font-family:Calibri; font-size:11pt; text-align:left; color:b=
lack; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM:=
 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid;=
 BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style=3D"font-weight:bold">From: </span>Guang Yao &lt;<a href=3D"mail=
to:yaoguang@cernet.edu.cn">yaoguang@cernet.edu.cn</a>&gt;<br>
<span style=3D"font-weight:bold">Date: </span>lundi 21 avril 2014 06:16<br>
<span style=3D"font-weight:bold">To: </span>elevyabe levy-abegnoli &lt;<a h=
ref=3D"mailto:elevyabe@cisco.com">elevyabe@cisco.com</a>&gt;, 'Jean-Michel =
Combes' &lt;<a href=3D"mailto:jeanmichel.combes@gmail.com">jeanmichel.combe=
s@gmail.com</a>&gt;, 'SAVI Mailing List' &lt;<a href=3D"mailto:savi@ietf.or=
g">savi@ietf.org</a>&gt;<br>
<span style=3D"font-weight:bold">Cc: </span>&quot;<a href=3D"mailto:draft-i=
etf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@tools.ietf.org</a>&quot;=
 &lt;<a href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi=
-dhcp@tools.ietf.org</a>&gt;, 'Ted Lemon' &lt;<a href=3D"mailto:mellon@fugu=
e.com">mellon@fugue.com</a>&gt;<br>
<span style=3D"font-weight:bold">Subject: </span>RE: [savi] WGLC: draft-iet=
f-savi-dhcp-22<br>
</div>
<div><br>
</div>
<blockquote id=3D"MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style=3D"BORDER-LEFT:=
 #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micro=
soft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" x=
mlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:/=
/www.w3.org/TR/REC-html40">
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
	{mso-style-priority:34;
	margin-top:0cm;
	margin-right:0cm;
	margin-bottom:0cm;
	margin-left:36.0pt;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
span.EmailStyle18
	{mso-style-type:personal;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.EmailStyle19
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:93520574;
	mso-list-template-ids:-857801212;}
@list l0:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level2
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l0:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1
	{mso-list-id:674845703;
	mso-list-template-ids:-1723815590;}
@list l1:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level2
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2
	{mso-list-id:1008748575;
	mso-list-template-ids:636000716;}
@list l2:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l2:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l2:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l2:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3
	{mso-list-id:1186139267;
	mso-list-template-ids:2014202206;}
@list l3:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l3:level2
	{mso-level-number-format:bullet;
	mso-level-text:o;
	mso-level-tab-stop:72.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:"Courier New";
	mso-bidi-font-family:"Times New Roman";}
@list l3:level3
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:108.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level4
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:144.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level5
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:180.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level6
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:216.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level7
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:252.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level8
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:288.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
@list l3:level9
	{mso-level-number-format:bullet;
	mso-level-text:\F0A7;
	mso-level-tab-stop:324.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Wingdings;}
ol
	{margin-bottom:0cm;}
ul
	{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
<div lang=3D"EN-US" link=3D"blue" vlink=3D"purple">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Hi, Eric<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">I realize something is omitted:<o:=
p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">=93Section &nbsp;6.4.2.2, paragrap 2.1:&nbs=
p;<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">&nbsp;&nbsp;the SAVI device MUST send a LEA=
SEQUERY [RFC5007]=94<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">This procedure is not in the data snooping =
process. I propose revising these words to:<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">=93the SAVI device MUST send a LEASEQUERY. =
In case the SAVI device is not capable of performing the DHCP leasequery pr=
ocess, a DHCP_DEFAULT_LEASE should be
 set on the entry.=94<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">The DHCP_DEFAULT_LEASE can be set based on =
the purpose of the operator. If zero is set, the entry will be deleted.
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">Is this OK</span><span style=3D"font-size: =
10.5pt; font-family: Calibri, sans-serif; color: black; ">?<o:p></o:p></spa=
n></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">Best regards,<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">Guang<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal"><b><span style=3D"font-size: 11pt; font-family: Cali=
bri, sans-serif; ">From:</span></b><span style=3D"font-size: 11pt; font-fam=
ily: Calibri, sans-serif; "> Guang Yao [<a href=3D"mailto:yaoguang@cernet.e=
du.cn">mailto:yaoguang@cernet.edu.cn</a>]
<br>
<b>Sent:</b> Monday, April 21, 2014 10:20 AM<br>
<b>To:</b> 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes'; 'SAVI Ma=
iling List'<br>
<b>Cc:</b> <a href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-iet=
f-savi-dhcp@tools.ietf.org</a>; 'Ted Lemon'<br>
<b>Subject:</b> RE: [savi] WGLC: draft-ietf-savi-dhcp-22<o:p></o:p></span><=
/p>
</div>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Hi, Eric<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Thank you very much for the commen=
ts!<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">1.
<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">For the first one, considering the=
 whole =93data snooping process=94 is actually a =93conditional should=94(s=
7.1), the DHCP lease query process is actually
 no more than a =93conditional &nbsp;should=94. The =93MUST=94 just specifi=
es if the data snooping process is to be implemented, the lease query proce=
ss will be a MUST.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Besides, it seems there is no good=
 alternative method to set up bindings without DHCP lease query; however, i=
f DHCP lease query cannot be performed,
 the whole data snooping process is meaningless. Thus, we choose =93MUST=94=
 on DHCP lease query process.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">2.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">We fully accept the second comment=
 and will revise the doc accordingly.<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Best regards,<o:p></o:p></span></p=
>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); ">Guang<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size: 11pt; font-family: Calibri=
, sans-serif; color: rgb(31, 73, 125); "><o:p>&nbsp;</o:p></span></p>
<div>
<div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal"><b><span style=3D"font-size: 11pt; font-family: Cali=
bri, sans-serif; ">From:</span></b><span style=3D"font-size: 11pt; font-fam=
ily: Calibri, sans-serif; "> Eric Levy- Abegnoli (elevyabe) [<a href=3D"mai=
lto:elevyabe@cisco.com">mailto:elevyabe@cisco.com</a>]
<br>
<b>Sent:</b> Thursday, April 17, 2014 8:09 PM<br>
<b>To:</b> Jean-Michel Combes; SAVI Mailing List<br>
<b>Cc:</b> &lt;<a href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft=
-ietf-savi-dhcp@tools.ietf.org</a>&gt;; Ted Lemon<br>
<b>Subject:</b> Re: [savi] WGLC: draft-ietf-savi-dhcp-22<o:p></o:p></span><=
/p>
</div>
</div>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">Hi,<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">In general, the document looks good. I spot=
 a few substantial issues listed below:<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; "><o:p>&nbsp;</o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">1) There seem to be a requirement in severa=
l places of the document (see below) to send LEASEQUERY to the DHCP server.=
 &nbsp;That is certainly useful to do so,
 but switches are sometimes pure layer-2 switches, and don't implement a DH=
CP stack not they have a layer-3 address to source traffic from.<o:p></o:p>=
</span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">Even when the switches have a layer-3 leg, =
&nbsp;setting then to reach out the DHCP server is not a trivial operation,=
 and not one which is typically done on layer-2
 access switches.<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">Whenever the LEASEQUERY is mandated, &nbsp;=
I'd rather have it as a SHOULD, with some alternate behavior (delete the en=
try for instance).<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; "><o:p>&nbsp;</o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">Section &nbsp;6.4.2.2, paragrap 2.1:&nbsp;<=
o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">&nbsp;&nbsp;the SAVI device MUST send a LEA=
SEQUERY [RFC5007]<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">Section 7.5.2.1<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">&nbsp; IPv4 address: Send a DHCPLEASEQUERY =
[RFC4388]<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">&nbsp;IPv6 address: Send a LEASEQUERY [RFC5=
007]<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; "><o:p>&nbsp;</o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">2) Section 7.1 &amp; 7.2<o:p></o:p></span><=
/p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">&quot;To perform this process, the SAVI dev=
ice MUST join the Solicited Node<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">&nbsp; &nbsp;Multicast group of the source =
address of triggering IPv6 data packet<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">&nbsp; &nbsp;whenever performing duplicate =
detection.&quot;<o:p></o:p></span></p>
</div>
<ul type=3D"disc">
<li class=3D"MsoNormal" style=3D"color:black;mso-margin-top-alt:auto;mso-ma=
rgin-bottom-alt:auto;mso-list:l2 level1 lfo3">
<span style=3D"font-size: 10.5pt; font-family: Calibri, sans-serif; ">I don=
't think a layer-2 switch can and need to join&nbsp;the Solicited Node&nbsp=
; Multicast group of the source address. It does not have a layer-3 stack o=
n top of every link it is bridging/switching.
 It has to snoop ND traffic, like it snoops DHCP traffic.&nbsp;<o:p></o:p><=
/span></li></ul>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">&nbsp; Section 7.5.1.2<o:p></o:p></span></p=
>
</div>
<ul type=3D"disc">
<li class=3D"MsoNormal" style=3D"color:black;mso-margin-top-alt:auto;mso-ma=
rgin-bottom-alt:auto;mso-list:l3 level1 lfo6">
<span style=3D"font-size: 10.5pt; font-family: Calibri, sans-serif; ">I won=
der what would be the end-result if the switch send a DAD or and ARP and th=
e legitimate owner interpret it as &quot;someone already has the address&qu=
ot; (always possible depending on its current
 state). That would seriously break DAD or ACD (rfc5227). I think we need a=
 way to distinguish &nbsp;between the packets issued by the switch and norm=
al DAD or ACD packets. &nbsp;(some field in the header? But that would be a=
 protocol change=85).<o:p></o:p></span></li></ul>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">Eric<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; "><o:p>&nbsp;</o:p></span></p>
</div>
<div style=3D"border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm">
<p class=3D"MsoNormal"><b><span style=3D"font-size: 11pt; font-family: Cali=
bri, sans-serif; color: black; ">From:
</span></b><span style=3D"font-size: 11pt; font-family: Calibri, sans-serif=
; color: black; ">Jean-Michel Combes &lt;<a href=3D"mailto:jeanmichel.combe=
s@gmail.com">jeanmichel.combes@gmail.com</a>&gt;<br>
<b>Date: </b>mardi 8 avril 2014 12:15<br>
<b>To: </b>SAVI Mailing List &lt;<a href=3D"mailto:savi@ietf.org">savi@ietf=
.org</a>&gt;<br>
<b>Cc: </b>&quot;&lt;<a href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org"=
>draft-ietf-savi-dhcp@tools.ietf.org</a>&gt;&quot; &lt;<a href=3D"mailto:dr=
aft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@tools.ietf.org</a>&=
gt;, Ted Lemon &lt;<a href=3D"mailto:mellon@fugue.com">mellon@fugue.com</a>=
&gt;<br>
<b>Subject: </b>[savi] WGLC: draft-ietf-savi-dhcp-22<o:p></o:p></span></p>
</div>
<div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; "><o:p>&nbsp;</o:p></span></p>
</div>
<blockquote style=3D"border:none;border-left:solid #B5C4DF 4.5pt;padding:0c=
m 0cm 0cm 4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0cm;margin=
-bottom:5.0pt" id=3D"MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE">
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s=
ize: 10.5pt; font-family: Calibri, sans-serif; color: black; ">Folks,<o:p><=
/o:p></span></p>
</div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s=
ize: 10.5pt; font-family: Calibri, sans-serif; color: black; ">As it has be=
en deeply modified since the last WGLC (version -06), this is a new two wee=
ks WGLC for the following document: &quot;SAVI
 Solution for DHCP&quot; (<a href=3D"http://tools.ietf.org/html/draft-ietf-=
savi-dhcp-22">http://tools.ietf.org/html/draft-ietf-savi-dhcp-22</a>).<o:p>=
</o:p></span></p>
</div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s=
ize: 10.5pt; font-family: Calibri, sans-serif; color: black; ">Please, don'=
t hesitate to give your opinion (i.e., agreement/disagreement to move forwa=
rd the document, comments, etc.)!<o:p></o:p></span></p>
</div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s=
ize: 10.5pt; font-family: Calibri, sans-serif; color: black; ">Thanks in ad=
vance.<o:p></o:p></span></p>
</div>
<p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt"><span style=3D"font-s=
ize: 10.5pt; font-family: Calibri, sans-serif; color: black; ">Best regards=
,<o:p></o:p></span></p>
</div>
<p class=3D"MsoNormal"><span style=3D"font-size: 10.5pt; font-family: Calib=
ri, sans-serif; color: black; ">JMC.<o:p></o:p></span></p>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
</span>
</body>
</html>

--_000_CF7DA49E390D0elevyabeciscocom_--


From nobody Wed Apr 23 08:31:15 2014
Return-Path: <mellon@fugue.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 014251A0016 for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 08:31:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.173
X-Spam-Level: 
X-Spam-Status: No, score=-2.173 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.272, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hsR8YMoe-pk2 for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 08:31:12 -0700 (PDT)
Received: from toccata.fugue.com (toccata.fugue.com [204.152.186.142]) by ietfa.amsl.com (Postfix) with ESMTP id 668481A02A2 for <savi@ietf.org>; Wed, 23 Apr 2014 08:31:10 -0700 (PDT)
Received: from [10.0.10.40] (c-174-62-147-182.hsd1.nh.comcast.net [174.62.147.182]) by toccata.fugue.com (Postfix) with ESMTPSA id 745CB2380609; Wed, 23 Apr 2014 11:31:03 -0400 (EDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Ted Lemon <mellon@fugue.com>
In-Reply-To: <E045AECD98228444A58C61C200AE1BD842614572@xmb-rcd-x01.cisco.com>
Date: Wed, 23 Apr 2014 11:31:01 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <CA02A4C7-285B-4CC6-A756-BABF0EDDE94F@fugue.com>
References: <CF7BFCD2.38EA7%elevyabe@cisco.com> <52D2BDC7-9E55-43BC-8248-23C43DCDEF96@fugue.com> <E045AECD98228444A58C61C200AE1BD842614572@xmb-rcd-x01.cisco.com>
To: "Pascal Thubert (pthubert)" <pthubert@cisco.com>
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/W1aWomVVAfjTWLwgQXDXaU9md_M
Cc: "draft-ietf-savi-dhcp@tools.ietf.org" <draft-ietf-savi-dhcp@tools.ietf.org>, Guang Yao <yaoguang@cernet.edu.cn>, SAVI Mailing List <savi@ietf.org>, Jean-Michel Combes <jeanmichel.combes@gmail.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Apr 2014 15:31:14 -0000

On Apr 23, 2014, at 8:01 AM, Pascal Thubert (pthubert) =
<pthubert@cisco.com> wrote:
> It seems to me that the draft goes very deep into the implementation =
of the guts of the FSM as opposed to the externally observable behavior, =
and I'm not sure that this particular FSM is the only way to implement =
the function and get all the necessary interoperation.

BTW, I am reluctant to weigh in on this question because I don't think =
there's energy to do this work.   The level of detail here seems similar =
to SAVI-send, and while I think in principle you may be right that there =
are multiple ways to solve this problem, getting the state machine right =
is actually pretty hard, and required a lot of review from DHCP experts. =
  I'm not convinced it's completely perfect, but it's improved a lot as =
a result of this review.   I think the added flexibility you are talking =
about might in theory be a good thing, but might in practice actually be =
a bad outcome.   In any case, it's certainly true that implementors can =
do this differently if they like, as long as their implementation =
behaves in a way that interoperate with implementations that follow the =
documented FSM.   There's always room for a document update later that =
talks about this if someone gains experience doing it.


From nobody Wed Apr 23 09:11:44 2014
Return-Path: <elevyabe@cisco.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2ABED1A03AA for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 09:11:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.773
X-Spam-Level: 
X-Spam-Status: No, score=-9.773 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.272, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ED13DkhWbiAj for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 09:11:27 -0700 (PDT)
Received: from alln-iport-6.cisco.com (alln-iport-6.cisco.com [173.37.142.93]) by ietfa.amsl.com (Postfix) with ESMTP id 39C5C1A0380 for <savi@ietf.org>; Wed, 23 Apr 2014 09:11:06 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3077; q=dns/txt; s=iport; t=1398269460; x=1399479060; h=from:to:cc:subject:date:message-id:in-reply-to: content-id:content-transfer-encoding:mime-version; bh=g6tOU4q0+alKp6sc1nJoA7YnCAcsp4H9s2v+TZSbsII=; b=ZZRXLKHxcCccsWE3K3C3qyekITDE2QIPh0+Wk9ey4g71ktwLKzAPD9dV izR/6/w8nvGwDOLXfRPON07AYDVNnWpHtvqQ8XC4W4Rv7bkRmxsUS2/kE +EAIqq7lSO7GSyehcBI9Q+paW5ohYNrn1Ny9wMTl2mXLxEXHY5eIpp3uh I=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AmIFAEHlV1OtJA2K/2dsb2JhbABaDoJ4gSbENIEaFnSCJQEBAQQ6NAsMBgEIEQQBAR8JORQJCAIEAQ0FGYgoznUXjlgHBoQzBJh1klWCcUCCKw
X-IronPort-AV: E=Sophos;i="4.97,912,1389744000"; d="scan'208";a="38103587"
Received: from alln-core-5.cisco.com ([173.36.13.138]) by alln-iport-6.cisco.com with ESMTP; 23 Apr 2014 16:11:00 +0000
Received: from xhc-rcd-x08.cisco.com (xhc-rcd-x08.cisco.com [173.37.183.82]) by alln-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id s3NGB0DZ017650 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Wed, 23 Apr 2014 16:11:00 GMT
Received: from xmb-rcd-x06.cisco.com ([169.254.6.41]) by xhc-rcd-x08.cisco.com ([173.37.183.82]) with mapi id 14.03.0123.003; Wed, 23 Apr 2014 11:10:59 -0500
From: "Eric Levy- Abegnoli (elevyabe)" <elevyabe@cisco.com>
To: Guang Yao <yaoguang@cernet.edu.cn>, "'Ted Lemon'" <mellon@fugue.com>
Thread-Topic: [savi] WGLC: draft-ietf-savi-dhcp-22
Thread-Index: AQHPXw6d8FdOhs9nvUWZJnpcp77q9A==
Date: Wed, 23 Apr 2014 16:10:59 +0000
Message-ID: <CF7DA550.390DB%elevyabe@cisco.com>
In-Reply-To: <000001cf5dde$e493d450$adbb7cf0$@cernet.edu.cn>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
user-agent: Microsoft-MacOutlook/14.3.2.130206
x-originating-ip: [10.49.80.39]
Content-Type: text/plain; charset="us-ascii"
Content-ID: <05F9BD81D4BF84408A9E4F3C1A2BACDF@emea.cisco.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/SLbVJXP8DsuFsmncv72gyK2asaY
Cc: "draft-ietf-savi-dhcp@tools.ietf.org" <draft-ietf-savi-dhcp@tools.ietf.org>, 'SAVI Mailing List' <savi@ietf.org>, 'Jean-Michel Combes' <jeanmichel.combes@gmail.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Apr 2014 16:11:39 -0000

Hi Guang,

On 22/04/14 05:56, "Guang Yao" <yaoguang@cernet.edu.cn> wrote:

>Hi, Ted
>
>Thank you very much for your comments! I agree with you. It's safe to
>assume
>all the SAVI devices have layer-3 stack. But it seems Eric also concerns
>the
>implementation of DHCP leasequery and NDP snooping.
>
>On the MLD problem mentioned by Eric, I wonder should SAVI-DHCP be
>consistent with RFC6620, or be different?
>
>Hi, Eric
>
>On the DAD problem:
>
>I read the doc again and find DAD NS will not be sent to the tentative
>node.
>Whenever probe should be sent to the tentative node, we use plain NS
>instead
>of DAD NS. Thus would it be OK?

I am a little bit confused on the scenario we are talking about (apologies
if this is my reading of the text).
The scenario I have in mind is
 1) SAVI device gets a data packet sourced with an address not found in
its table=20
 2) the SAVI device creates the binding (in DETECTION)
 3) The SAVI device send and ARP/DAD to look for a conflict (I guess to
the entire vlan but the receive interface).
 4) If no conflict was detected, it does the LQ
I'll tend to argue that if LQ is required, the DETECTION state is not
necessary and should be removed.
If LQ is optional, and DETECTION failed to detect a conflict, then the
entry should not move back right away to NO_BIND?

DETECTION in general is problematic. The state in the SAVI device and on
the end-node which has the conflicting address are independent. When he
SAVI switch sends a DAD, while the end-node is right in TENTATIVE (bad
luck), this DAD would shutdown the end-node interface. Maybe that is a
problem we have to deal with, but these probe packets are causing exactly
this type of issues, seen in real life. I thought I should mention it.

In your response, you said it could also send a regular NS, which I assume
is an NS lookup. I could not find a reference in the text about sending NS
lookup instead of DAD. This is certainly a good practice (we have
implemented it that way) provided that you have an address to source it
from. However (my usual objection) the access switches often don't have a
l3 address per link/vlan, not even a link-local address. So NS-lookup
should be an option. Which leaves only DAD or LQ.
=20

Thank you.
Eric




>
>We are looking forward to your further comments, thanks!
>
>Best regards,
>Guang
>
>-----Original Message-----
>From: Ted Lemon [mailto:mellon@fugue.com]
>Sent: Tuesday, April 22, 2014 12:31 AM
>To: Guang Yao
>Cc: Eric Levy- Abegnoli (elevyabe); Jean-Michel Combes; SAVI Mailing List;
>draft-ietf-savi-dhcp@tools.ietf.org
>Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
>
>Do we really think there are modern layer 2 devices that will implement
>SAVI-DHCP that will not have IPv6 addresses?   This seems highly doubtful
>to
>me-the devices that would only have layer two addresses would be unmanaged
>switches.   I have a cheap managed switch, and it has an IPv4 address and
>a
>web server in it.   I think this is a non-problem.
>
>
>


From nobody Wed Apr 23 23:13:35 2014
Return-Path: <leaf.yeh.sdo@gmail.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16E021A079C for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 23:13:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level: 
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9,  DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jCefP-fl7pCO for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 23:12:38 -0700 (PDT)
Received: from mail-pa0-x22a.google.com (mail-pa0-x22a.google.com [IPv6:2607:f8b0:400e:c03::22a]) by ietfa.amsl.com (Postfix) with ESMTP id 80A7D1A0062 for <savi@ietf.org>; Wed, 23 Apr 2014 23:12:38 -0700 (PDT)
Received: by mail-pa0-f42.google.com with SMTP id fa1so1075151pad.15 for <savi@ietf.org>; Wed, 23 Apr 2014 23:12:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=from:to:cc:references:in-reply-to:subject:date:message-id :mime-version:content-type:content-transfer-encoding:thread-index :content-language; bh=pNpD+PMjz7M0XLBc4WV5ufqFL/AyKH5rIgyqRNVtmJ4=; b=q+TrWYxytIq23U95cvF/7bnGbAq9yY6ITMJLdNmByJcgTouxQhenxqTZNJOHRY52PL FNPi2+gbliEp6Db7AoZ2vlJCk0xD4n/EVC5ZfhNkRxyiwRSzKkt/lIPoaDtV848psjMD Mi2NY/aUXza2oMzCyVVsUGXR1XFE4q8WB8jmkGhH5vfekWHvL1u2srMwX2kv8p2LwbYA 8OpiwJtRebymKQYU8ZkWu8XH+aFyMscVOw6Xz3R84Uq80M9mSDDsuSMoknqY+uk8aSuN 1faWpu8IZq6wm7Cnb7mKh+8PkMs+ONwLfyQPqodacRyNb2mXf5LBRymrFd2PNnxL1eSe 8Mkg==
X-Received: by 10.68.159.228 with SMTP id xf4mr61944812pbb.74.1398319952650; Wed, 23 Apr 2014 23:12:32 -0700 (PDT)
Received: from PC ([218.241.103.172]) by mx.google.com with ESMTPSA id gu11sm6713796pbd.38.2014.04.23.23.12.28 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 23 Apr 2014 23:12:30 -0700 (PDT)
X-Google-Original-Message-ID: <006301cf5f84$2c806ed0$85814c70$@yeh.sdo@gmail.com>
From: "Leaf Yeh" <leaf.yeh.sdo@gmail.com>
To: "'Eric Levy- Abegnoli \(elevyabe\)'" <elevyabe@cisco.com>, "'Guang Yao'" <yaoguang@cernet.edu.cn>, "'Ted Lemon'" <mellon@fugue.com>
References: <000001cf5dde$e493d450$adbb7cf0$@cernet.edu.cn> <CF7DA550.390DB%elevyabe@cisco.com>
In-Reply-To: <CF7DA550.390DB%elevyabe@cisco.com>
Date: Thu, 24 Apr 2014 14:12:26 +0800
Message-ID: <5358ab4e.8b13450a.682c.0dd4@mx.google.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AQHPXw6d8FdOhs9nvUWZJnpcp77q9JsgHGIw
Content-Language: zh-cn
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/irTDiKsWh7RNdMjdEw0gwTH9YLs
Cc: draft-ietf-savi-dhcp@tools.ietf.org, 'SAVI Mailing List' <savi@ietf.org>, 'Jean-Michel Combes' <jeanmichel.combes@gmail.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Apr 2014 06:13:26 -0000

Eric - 3) The SAVI device send and ARP/DAD to look for a conflict (I guess
to the entire vlan but the receive interface).
Eric - DETECTION in general is problematic. The state in the SAVI device and
on the end-node which has the conflicting address are independent. When he
SAVI switch sends a DAD, while the end-node is right in TENTATIVE (bad
luck), this DAD would shutdown the end-node interface. Maybe that is a
problem we have to deal with, but these probe packets are causing exactly
this type of issues, seen in real life. I thought I should mention it.

This sounds also the same argue to the FSM (including the states of 'No
Bind') described in Fig.2 of RFC6620, which needs the SAVI device (or
switch) to send out DAD_NS. 

<quote>
      Upon the reception through a Validating Port (VP) of a DATA packet
      containing IPAddr as the source address, the SAVI device SHOULD
      execute the process of sending Neighbor Solicitation messages of
      the Duplicate Address Detection process ... The DAD_NS messages are
not
      sent through any of the ports configured as Validating Ports.  The
      DAD_NSOL messages are sent through Trusted Ports...
</quote> @ Page 15 of RFC6620.

Right?

Best Regards,
Leaf



-----Original Message-----
From: savi [mailto:savi-bounces@ietf.org] On Behalf Of Eric Levy- Abegnoli
(elevyabe)
Sent: Thursday, April 24, 2014 12:11 AM
To: Guang Yao; 'Ted Lemon'
Cc: draft-ietf-savi-dhcp@tools.ietf.org; 'SAVI Mailing List'; 'Jean-Michel
Combes'
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

Hi Guang,

On 22/04/14 05:56, "Guang Yao" <yaoguang@cernet.edu.cn> wrote:

>Hi, Ted
>
>Thank you very much for your comments! I agree with you. It's safe to 
>assume all the SAVI devices have layer-3 stack. But it seems Eric also 
>concerns the implementation of DHCP leasequery and NDP snooping.
>
>On the MLD problem mentioned by Eric, I wonder should SAVI-DHCP be 
>consistent with RFC6620, or be different?
>
>Hi, Eric
>
>On the DAD problem:
>
>I read the doc again and find DAD NS will not be sent to the tentative 
>node.
>Whenever probe should be sent to the tentative node, we use plain NS 
>instead of DAD NS. Thus would it be OK?

I am a little bit confused on the scenario we are talking about (apologies
if this is my reading of the text).
The scenario I have in mind is
 1) SAVI device gets a data packet sourced with an address not found in its
table
 2) the SAVI device creates the binding (in DETECTION)
 3) The SAVI device send and ARP/DAD to look for a conflict (I guess to the
entire vlan but the receive interface).
 4) If no conflict was detected, it does the LQ I'll tend to argue that if
LQ is required, the DETECTION state is not necessary and should be removed.
If LQ is optional, and DETECTION failed to detect a conflict, then the entry
should not move back right away to NO_BIND?

DETECTION in general is problematic. The state in the SAVI device and on the
end-node which has the conflicting address are independent. When he SAVI
switch sends a DAD, while the end-node is right in TENTATIVE (bad luck),
this DAD would shutdown the end-node interface. Maybe that is a problem we
have to deal with, but these probe packets are causing exactly this type of
issues, seen in real life. I thought I should mention it.

In your response, you said it could also send a regular NS, which I assume
is an NS lookup. I could not find a reference in the text about sending NS
lookup instead of DAD. This is certainly a good practice (we have
implemented it that way) provided that you have an address to source it
from. However (my usual objection) the access switches often don't have a
l3 address per link/vlan, not even a link-local address. So NS-lookup should
be an option. Which leaves only DAD or LQ.
 

Thank you.
Eric




>
>We are looking forward to your further comments, thanks!
>
>Best regards,
>Guang
>
>-----Original Message-----
>From: Ted Lemon [mailto:mellon@fugue.com]
>Sent: Tuesday, April 22, 2014 12:31 AM
>To: Guang Yao
>Cc: Eric Levy- Abegnoli (elevyabe); Jean-Michel Combes; SAVI Mailing 
>List; draft-ietf-savi-dhcp@tools.ietf.org
>Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
>
>Do we really think there are modern layer 2 devices that will implement
>SAVI-DHCP that will not have IPv6 addresses?   This seems highly doubtful
>to
>me-the devices that would only have layer two addresses would be unmanaged
>switches.   I have a cheap managed switch, and it has an IPv4 address and
>a
>web server in it.   I think this is a non-problem.
>
>
>

_______________________________________________
savi mailing list
savi@ietf.org
https://www.ietf.org/mailman/listinfo/savi


From nobody Wed Apr 23 23:23:09 2014
Return-Path: <leaf.yeh.sdo@gmail.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4573C1A030F for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 23:23:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level: 
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mmONnziotBID for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 23:23:00 -0700 (PDT)
Received: from mail-pb0-x22b.google.com (mail-pb0-x22b.google.com [IPv6:2607:f8b0:400e:c01::22b]) by ietfa.amsl.com (Postfix) with ESMTP id 3709D1A02CA for <savi@ietf.org>; Wed, 23 Apr 2014 23:23:00 -0700 (PDT)
Received: by mail-pb0-f43.google.com with SMTP id um1so1606930pbc.2 for <savi@ietf.org>; Wed, 23 Apr 2014 23:22:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=from:to:cc:references:in-reply-to:subject:date:message-id :mime-version:content-type:thread-index:content-language; bh=4xMIQIm3Iu83tboaBV+x+8F7ONj6MrwSrwuKL6EXVYQ=; b=rTKvMA/N+KJhTusKvZYbVo7mpJ27gdKuEM5pn8A0y8QePeas35hcHKTL3hFEvtEqIr THtgOR7p71i9D7/fqHc98yvhnmckkfvpB772eCN6D6KmfhNmO2aB2h/tj6qsVC1Q5feo h0T8fBXaWs8wWAh5RBpYWBiZ/JjgJKOZxkWgeB/iuJLnlVMeAhVgfSbtLE5XH87dU8nE /rjcsyPtZSFG/48BOAGJfEvKlf1GubiYKZJiTgc4xW+/y0OiodusrG9c+CHSNVFs6W31 X6MOUQIfr2MBBzzv3Rq9kqXW3sLngicWRb/xhCEczEVaECKrHe4X2XakGB44VhQ1zZQx 6KCg==
X-Received: by 10.68.181.165 with SMTP id dx5mr65413pbc.38.1398320574329; Wed, 23 Apr 2014 23:22:54 -0700 (PDT)
Received: from PC ([218.241.103.172]) by mx.google.com with ESMTPSA id kt8sm15578206pab.7.2014.04.23.23.22.50 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 23 Apr 2014 23:22:53 -0700 (PDT)
X-Google-Original-Message-ID: <006701cf5f85$9efdb570$dcf92050$@yeh.sdo@gmail.com>
From: "Leaf Yeh" <leaf.yeh.sdo@gmail.com>
To: "'Eric Levy- Abegnoli \(elevyabe\)'" <elevyabe@cisco.com>, "'Guang Yao'" <yaoguang@cernet.edu.cn>, "'Jean-Michel Combes'" <jeanmichel.combes@gmail.com>, "'SAVI Mailing List'" <savi@ietf.org>
References: <000e01cf5d0a$4a279d40$de76d7c0$@cernet.edu.cn> <CF7DA1D3.390B5%elevyabe@cisco.com>
In-Reply-To: <CF7DA1D3.390B5%elevyabe@cisco.com>
Date: Thu, 24 Apr 2014 14:22:47 +0800
Message-ID: <5358adbd.6877420a.1025.0bb4@mx.google.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0068_01CF5FC8.AD20F570"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AQHPXwYz8FdOhs9nvUWZJnpcp77q9JsgFiMg
Content-Language: zh-cn
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/eQwgpDkpi_mf7lpWuO2dX9q_ZRk
Cc: draft-ietf-savi-dhcp@tools.ietf.org, 'Ted Lemon' <mellon@fugue.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 24 Apr 2014 06:23:06 -0000

This is a multi-part message in MIME format.

------=_NextPart_000_0068_01CF5FC8.AD20F570
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Hi Eric,

 

I also wonder a further explanation on the following statement.

 

<quote>
MLD Considerations

 

   The FCFS SAVI device MUST join the solicited node multicast group for

   all the addresses with a state other than NO_BIND.  This is needed to

   make sure that the FCFS SAVI device will receive the DAD_NS for those

   addresses.  Please note that it may not be enough to rely on the host

   behind the Validating Port to do so, since the node may move, and

   after a while, the packets for that particular solicited node

   multicast group will no longer be forwarded to the FCFS SAVI device.

   Therefore, the FCFS SAVI device MUST join the solicited node

   multicast groups for all the addresses that are in a state other than

   NO_BIND.

</quote> @ page 20 of RFC6620

 

If we believe it sounds a wrong message, would you like submit a Errata for
it? J

 

 

Best Regards,

Leaf

 

 

 

From: savi [mailto:savi-bounces@ietf.org] On Behalf Of Eric Levy- Abegnoli
(elevyabe)
Sent: Wednesday, April 23, 2014 11:11 PM
To: Guang Yao; 'Jean-Michel Combes'; 'SAVI Mailing List'
Cc: draft-ietf-savi-dhcp@tools.ietf.org; 'Ted Lemon'
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Hi Guang,

I  find the below section very confusing.  SAVI devices are switches, hence
they have other means to punt any traffic they  want to inspect to cpu
level. They would not "join multicast groups". A wild guess on the intention
is to get around the case where some MLD snooping device is at stake in the
network. Works for addresses that you know but can't possibly work for
addresses that you don't know yet and that are being DAD'ed.  MLD snooping
is just incompatible with SAVI, and if we accept that fact, joining MLD
solicited group is not needed. 

And it has the same issue I raised: access switches cannot reasonably have a
layer-3 interface on every subnet (link/vlan) they operate on, which could
be thousands.

Sorry that I missed that in 6620. 

Eric

 

 

From: Guang Yao <yaoguang@cernet.edu.cn>
Date: lundi 21 avril 2014 04:34
To: elevyabe levy-abegnoli <elevyabe@cisco.com>, 'Jean-Michel Combes'
<jeanmichel.combes@gmail.com>, 'SAVI Mailing List' <savi@ietf.org>
Cc: "draft-ietf-savi-dhcp@tools.ietf.org"
<draft-ietf-savi-dhcp@tools.ietf.org>, 'Ted Lemon' <mellon@fugue.com>
Subject: RE: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Hi, Eric

 

Before we begin modifying the SAVI-DHCP, we find some related text in
RFC6620:

 

1.

"   MLD Considerations

 

   The FCFS SAVI device MUST join the solicited node multicast group for

   all the addresses with a state other than NO_BIND.  This is needed to

   make sure that the FCFS SAVI device will receive the DAD_NS for those

   addresses.  Please note that it may not be enough to rely on the host

   behind the Validating Port to do so, since the node may move, and

   after a while, the packets for that particular solicited node

   multicast group will no longer be forwarded to the FCFS SAVI device.

   Therefore, the FCFS SAVI device MUST join the solicited node

   multicast groups for all the addresses that are in a state other than

   NO_BIND.

"

 

2.

"Upon the reception through a Validating Port (VP) of a DATA packet
      containing IPAddr as the source address, the SAVI device SHOULD
      execute the process of sending Neighbor Solicitation messages of
      the Duplicate Address Detection process as described in Section
      5.4.2 of [RFC4862]

"

 

Maybe such designs also violate your comments? Thank you very much!

 

Best regards,

Guang

 

From: Guang Yao [mailto:yaoguang@cernet.edu.cn] 
Sent: Monday, April 21, 2014 10:20 AM
To: 'Eric Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes'; 'SAVI Mailing
List'
Cc: '<draft-ietf-savi-dhcp@tools.ietf.org>'; 'Ted Lemon'
Subject: RE: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Hi, Eric

 

Thank you very much for the comments!

 

1. 

For the first one, considering the whole "data snooping process" is actually
a "conditional should"(s7.1), the DHCP lease query process is actually no
more than a "conditional  should". The "MUST" just specifies if the data
snooping process is to be implemented, the lease query process will be a
MUST.

Besides, it seems there is no good alternative method to set up bindings
without DHCP lease query; however, if DHCP lease query cannot be performed,
the whole data snooping process is meaningless. Thus, we choose "MUST" on
DHCP lease query process.

 

2.

We fully accept the second comment and will revise the doc accordingly.

 

Best regards,

Guang

 

From: Eric Levy- Abegnoli (elevyabe) [mailto:elevyabe@cisco.com] 
Sent: Thursday, April 17, 2014 8:09 PM
To: Jean-Michel Combes; SAVI Mailing List
Cc: <draft-ietf-savi-dhcp@tools.ietf.org>; Ted Lemon
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Hi,

In general, the document looks good. I spot a few substantial issues listed
below:

 

1) There seem to be a requirement in several places of the document (see
below) to send LEASEQUERY to the DHCP server.  That is certainly useful to
do so, but switches are sometimes pure layer-2 switches, and don't implement
a DHCP stack not they have a layer-3 address to source traffic from.

Even when the switches have a layer-3 leg,  setting then to reach out the
DHCP server is not a trivial operation, and not one which is typically done
on layer-2 access switches.

Whenever the LEASEQUERY is mandated,  I'd rather have it as a SHOULD, with
some alternate behavior (delete the entry for instance).

 

Section  6.4.2.2, paragrap 2.1: 

  the SAVI device MUST send a LEASEQUERY [RFC5007]

Section 7.5.2.1

  IPv4 address: Send a DHCPLEASEQUERY [RFC4388]

 IPv6 address: Send a LEASEQUERY [RFC5007]

 

2) Section 7.1 & 7.2

"To perform this process, the SAVI device MUST join the Solicited Node

   Multicast group of the source address of triggering IPv6 data packet

   whenever performing duplicate detection."

*	I don't think a layer-2 switch can and need to join the Solicited
Node  Multicast group of the source address. It does not have a layer-3
stack on top of every link it is bridging/switching. It has to snoop ND
traffic, like it snoops DHCP traffic. 

  Section 7.5.1.2

*	I wonder what would be the end-result if the switch send a DAD or
and ARP and the legitimate owner interpret it as "someone already has the
address" (always possible depending on its current state). That would
seriously break DAD or ACD (rfc5227). I think we need a way to distinguish
between the packets issued by the switch and normal DAD or ACD packets.
(some field in the header? But that would be a protocol change.).

Eric

 

From: Jean-Michel Combes <jeanmichel.combes@gmail.com>
Date: mardi 8 avril 2014 12:15
To: SAVI Mailing List <savi@ietf.org>
Cc: "<draft-ietf-savi-dhcp@tools.ietf.org>"
<draft-ietf-savi-dhcp@tools.ietf.org>, Ted Lemon <mellon@fugue.com>
Subject: [savi] WGLC: draft-ietf-savi-dhcp-22

 

Folks,

As it has been deeply modified since the last WGLC (version -06), this is a
new two weeks WGLC for the following document: "SAVI Solution for DHCP"
(http://tools.ietf.org/html/draft-ietf-savi-dhcp-22).

Please, don't hesitate to give your opinion (i.e., agreement/disagreement to
move forward the document, comments, etc.)!

Thanks in advance.

Best regards,

JMC.


------=_NextPart_000_0068_01CF5FC8.AD20F570
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" =
xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =
xmlns=3D"http://www.w3.org/TR/REC-html40"><head><meta =
http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 12 =
(filtered medium)"><style><!--
/* Font Definitions */
@font-face
	{font-family:Wingdings;
	panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
	{font-family:SimSun;
	panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
	{font-family:Tahoma;
	panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:purple;
	text-decoration:underline;}
pre
	{mso-style-priority:99;
	mso-style-link:"HTML \9884\8BBE\683C\5F0F Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:10.0pt;
	font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
	{mso-style-priority:99;
	mso-style-link:"\6279\6CE8\6846\6587\672C Char";
	margin:0cm;
	margin-bottom:.0001pt;
	font-size:9.0pt;
	font-family:"Times New Roman","serif";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
	{mso-style-priority:34;
	margin-top:0cm;
	margin-right:0cm;
	margin-bottom:0cm;
	margin-left:36.0pt;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman","serif";}
span.HTMLChar
	{mso-style-name:"HTML \9884\8BBE\683C\5F0F Char";
	mso-style-priority:99;
	mso-style-link:"HTML \9884\8BBE\683C\5F0F";
	font-family:"Courier New";}
span.EmailStyle20
	{mso-style-type:personal;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.EmailStyle21
	{mso-style-type:personal;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
span.Char
	{mso-style-name:"\6279\6CE8\6846\6587\672C Char";
	mso-style-priority:99;
	mso-style-link:\6279\6CE8\6846\6587\672C;
	font-family:SimSun;}
span.EmailStyle24
	{mso-style-type:personal-reply;
	font-family:"Calibri","sans-serif";
	color:#1F497D;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-size:10.0pt;}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
	{page:WordSection1;}
/* List Definitions */
@list l0
	{mso-list-id:458885736;
	mso-list-template-ids:-617826544;}
@list l0:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
@list l1
	{mso-list-id:1195341681;
	mso-list-template-ids:-415460618;}
@list l1:level1
	{mso-level-number-format:bullet;
	mso-level-text:\F0B7;
	mso-level-tab-stop:36.0pt;
	mso-level-number-position:left;
	text-indent:-18.0pt;
	mso-ansi-font-size:10.0pt;
	font-family:Symbol;}
ol
	{margin-bottom:0cm;}
ul
	{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--></head><body lang=3DZH-CN link=3Dblue =
vlink=3Dpurple><div class=3DWordSection1><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Hi Eric,<o:p></o:p></span></p><pre><span lang=3DEN-US =
style=3D'color:black'><o:p>&nbsp;</o:p></span></pre><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>I also wonder a further explanation on the following =
statement.<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><pre><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;quote&gt;<o:p></o:p></span></pre><pre =
style=3D'text-indent:20.0pt'><span lang=3DEN-US =
style=3D'color:black'>MLD Considerations<o:p></o:p></span></pre><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; The FCFS SAVI device MUST join the =
solicited node multicast group for</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; all the addresses with a state other than =
NO_BIND.&nbsp; This is needed to</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; make sure that the FCFS SAVI device will =
receive the DAD_NS for those</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; addresses.&nbsp; Please note that it may =
not be enough to rely on the host</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; behind the Validating Port to do so, =
since the node may move, and</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; after a while, the packets for that =
particular solicited node</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; multicast group will no longer be =
forwarded to the FCFS SAVI device.</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; Therefore, the FCFS SAVI device MUST join =
the solicited node</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; multicast groups for all the addresses =
that are in a state other than</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; NO_BIND.</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&lt;/quote&gt; @ page 20 of RFC6620<o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>If we believe it sounds a wrong message, would you like submit a =
Errata for it? </span><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:Wingdings;color:#1F497D'>J</span><s=
pan lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best Regards,<o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Leaf<o:p></o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497=
D'><o:p>&nbsp;</o:p></span></p><div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span>=
</b><span lang=3DEN-US =
style=3D'font-size:10.0pt;font-family:"Tahoma","sans-serif"'> savi =
[mailto:savi-bounces@ietf.org] <b>On Behalf Of </b>Eric Levy- Abegnoli =
(elevyabe)<br><b>Sent:</b> Wednesday, April 23, 2014 11:11 =
PM<br><b>To:</b> Guang Yao; 'Jean-Michel Combes'; 'SAVI Mailing =
List'<br><b>Cc:</b> draft-ietf-savi-dhcp@tools.ietf.org; 'Ted =
Lemon'<br><b>Subject:</b> Re: [savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><span lang=3DEN-US><o:p>&nbsp;</o:p></span></p><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Hi Guang,<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>I &nbsp;find the below section very confusing. &nbsp;SAVI devices are =
switches, hence they have other means to punt any traffic they =
&nbsp;want to inspect to cpu level. They would not &quot;join multicast =
groups&quot;. A wild guess on the intention is to get around the case =
where some MLD snooping device is at stake in the network. Works for =
addresses that you know but can't possibly work for addresses that you =
don't know yet and that are being DAD'ed. &nbsp;MLD snooping is just =
incompatible with SAVI, and if we accept that fact, joining MLD =
solicited group is not needed.&nbsp;<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>And it has the same issue I raised: access switches cannot reasonably =
have a layer-3 interface on every subnet (link/vlan) they operate on, =
which could be thousands.<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Sorry that I missed that in =
6620.&nbsp;<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Eric<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;<o:p></o:p></span></p></div><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>From: </span></b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>Guang Yao &lt;<a =
href=3D"mailto:yaoguang@cernet.edu.cn">yaoguang@cernet.edu.cn</a>&gt;<br>=
<b>Date: </b>lundi 21 avril 2014 04:34<br><b>To: </b>elevyabe =
levy-abegnoli &lt;<a =
href=3D"mailto:elevyabe@cisco.com">elevyabe@cisco.com</a>&gt;, =
'Jean-Michel Combes' &lt;<a =
href=3D"mailto:jeanmichel.combes@gmail.com">jeanmichel.combes@gmail.com</=
a>&gt;, 'SAVI Mailing List' &lt;<a =
href=3D"mailto:savi@ietf.org">savi@ietf.org</a>&gt;<br><b>Cc: =
</b>&quot;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&quot; &lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;, 'Ted Lemon' &lt;<a =
href=3D"mailto:mellon@fugue.com">mellon@fugue.com</a>&gt;<br><b>Subject: =
</b>RE: [savi] WGLC: =
draft-ietf-savi-dhcp-22<o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
><o:p>&nbsp;</o:p></span></p></div><blockquote =
style=3D'border:none;border-left:solid #B5C4DF 4.5pt;padding:0cm 0cm 0cm =
4.0pt;margin-left:3.75pt;margin-right:0cm' =
id=3D"MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"><div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Hi, Eric</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Before we begin modifying the SAVI-DHCP, we find some related text in =
RFC6620:</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>1.</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><pre><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&#8220;</span><span lang=3DEN-US style=3D'color:black'>&nbsp;&nbsp; =
MLD Considerations<o:p></o:p></span></pre><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; The FCFS SAVI device MUST join the =
solicited node multicast group for</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; all the addresses with a state other than =
NO_BIND.&nbsp; This is needed to</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; make sure that the FCFS SAVI device will =
receive the DAD_NS for those</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; addresses.&nbsp; Please note that it may =
not be enough to rely on the host</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; behind the Validating Port to do so, =
since the node may move, and</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; after a while, the packets for that =
particular solicited node</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; multicast group will no longer be =
forwarded to the FCFS SAVI device.</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; Therefore, the FCFS SAVI device MUST join =
the solicited node</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; multicast groups for all the addresses =
that are in a state other than</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US style=3D'font-size:10.0pt;font-family:"Courier =
New";color:black'>&nbsp;&nbsp; NO_BIND.</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&#8221;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>2.</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><pre><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&#8220;</span><span lang=3DEN-US style=3D'color:black'>Upon the =
reception through a Validating Port (VP) of a DATA =
packet<o:p></o:p></span></pre><pre><span lang=3DEN-US =
style=3D'color:black'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; containing IPAddr =
as the source address, the SAVI device =
SHOULD<o:p></o:p></span></pre><pre><span lang=3DEN-US =
style=3D'color:black'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; execute the process =
of sending Neighbor Solicitation messages =
of<o:p></o:p></span></pre><pre><span lang=3DEN-US =
style=3D'color:black'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; the Duplicate =
Address Detection process as described in =
Section<o:p></o:p></span></pre><pre><span lang=3DEN-US =
style=3D'color:black'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 5.4.2 of =
[RFC4862]<o:p></o:p></span></pre><p class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&#8221;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Maybe such designs also violate your comments? Thank you very =
much!</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best regards,</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Guang</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><div><div =
style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>From:</span></b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
> Guang Yao [<a =
href=3D"mailto:yaoguang@cernet.edu.cn">mailto:yaoguang@cernet.edu.cn</a>]=
 <br><b>Sent:</b> Monday, April 21, 2014 10:20 AM<br><b>To:</b> 'Eric =
Levy- Abegnoli (elevyabe)'; 'Jean-Michel Combes'; 'SAVI Mailing =
List'<br><b>Cc:</b> '&lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;'; 'Ted Lemon'<br><b>Subject:</b> RE: [savi] WGLC: =
draft-ietf-savi-dhcp-22</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'color:black'>&nbsp;<o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Hi, Eric</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Thank you very much for the comments!</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>1. </span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>For the first one, considering the whole &#8220;data snooping =
process&#8221; is actually a &#8220;conditional should&#8221;(s7.1), the =
DHCP lease query process is actually no more than a &#8220;conditional =
&nbsp;should&#8221;. The &#8220;MUST&#8221; just specifies if the data =
snooping process is to be implemented, the lease query process will be a =
MUST.</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Besides, it seems there is no good alternative method to set up =
bindings without DHCP lease query; however, if DHCP lease query cannot =
be performed, the whole data snooping process is meaningless. Thus, we =
choose &#8220;MUST&#8221; on DHCP lease query process.</span><span =
lang=3DEN-US style=3D'color:black'><o:p></o:p></span></p><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>2.</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>We fully accept the second comment and will revise the doc =
accordingly.</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Best regards,</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>Guang</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497=
D'>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p><div><div =
style=3D'border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>From:</span></b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
> Eric Levy- Abegnoli (elevyabe) [<a =
href=3D"mailto:elevyabe@cisco.com">mailto:elevyabe@cisco.com</a>] =
<br><b>Sent:</b> Thursday, April 17, 2014 8:09 PM<br><b>To:</b> =
Jean-Michel Combes; SAVI Mailing List<br><b>Cc:</b> &lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;; Ted Lemon<br><b>Subject:</b> Re: [savi] WGLC: =
draft-ietf-savi-dhcp-22</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div></div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'color:black'>&nbsp;<o:p></o:p></span></p><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Hi,</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>In general, the document looks good. I spot a few substantial issues =
listed below:</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>1) There seem to be a requirement in several places of the document =
(see below) to send LEASEQUERY to the DHCP server. &nbsp;That is =
certainly useful to do so, but switches are sometimes pure layer-2 =
switches, and don't implement a DHCP stack not they have a layer-3 =
address to source traffic from.</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Even when the switches have a layer-3 leg, &nbsp;setting then to reach =
out the DHCP server is not a trivial operation, and not one which is =
typically done on layer-2 access switches.</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Whenever the LEASEQUERY is mandated, &nbsp;I'd rather have it as a =
SHOULD, with some alternate behavior (delete the entry for =
instance).</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section &nbsp;6.4.2.2, paragrap 2.1:&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;&nbsp;the SAVI device MUST send a LEASEQUERY =
[RFC5007]</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Section 7.5.2.1</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; IPv4 address: Send a DHCPLEASEQUERY [RFC4388]</span><span =
lang=3DEN-US style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;IPv6 address: Send a LEASEQUERY [RFC5007]</span><span =
lang=3DEN-US style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>2) Section 7.1 &amp; 7.2</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&quot;To perform this process, the SAVI device MUST join the Solicited =
Node</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;Multicast group of the source address of triggering IPv6 =
data packet</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; &nbsp;whenever performing duplicate detection.&quot;</span><span =
lang=3DEN-US style=3D'color:black'><o:p></o:p></span></p></div><ul =
type=3Ddisc><li class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l1 level1 lfo1'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I don't =
think a layer-2 switch can and need to join&nbsp;the Solicited =
Node&nbsp; Multicast group of the source address. It does not have a =
layer-3 stack on top of every link it is bridging/switching. It has to =
snoop ND traffic, like it snoops DHCP traffic.&nbsp;</span><span =
lang=3DEN-US><o:p></o:p></span></li></ul><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp; Section 7.5.1.2</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><ul type=3Ddisc><li =
class=3DMsoNormal =
style=3D'color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;m=
so-list:l0 level1 lfo2'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif"'>I wonder =
what would be the end-result if the switch send a DAD or and ARP and the =
legitimate owner interpret it as &quot;someone already has the =
address&quot; (always possible depending on its current state). That =
would seriously break DAD or ACD (rfc5227). I think we need a way to =
distinguish &nbsp;between the packets issued by the switch and normal =
DAD or ACD packets. &nbsp;(some field in the header? But that would be a =
protocol change&#8230;).</span><span =
lang=3DEN-US><o:p></o:p></span></li></ul><div><p class=3DMsoNormal><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Eric</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div =
style=3D'border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm =
0cm 0cm'><p class=3DMsoNormal><b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>From: </span></b><span lang=3DEN-US =
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:black'=
>Jean-Michel Combes &lt;<a =
href=3D"mailto:jeanmichel.combes@gmail.com">jeanmichel.combes@gmail.com</=
a>&gt;<br><b>Date: </b>mardi 8 avril 2014 12:15<br><b>To: </b>SAVI =
Mailing List &lt;<a =
href=3D"mailto:savi@ietf.org">savi@ietf.org</a>&gt;<br><b>Cc: =
</b>&quot;&lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;&quot; &lt;<a =
href=3D"mailto:draft-ietf-savi-dhcp@tools.ietf.org">draft-ietf-savi-dhcp@=
tools.ietf.org</a>&gt;, Ted Lemon &lt;<a =
href=3D"mailto:mellon@fugue.com">mellon@fugue.com</a>&gt;<br><b>Subject: =
</b>[savi] WGLC: draft-ietf-savi-dhcp-22</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>&nbsp;</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><blockquote =
style=3D'border:none;border-left:solid #B5C4DF 4.5pt;padding:0cm 0cm 0cm =
4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:=
5.0pt' =
id=3D"MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE"><div><div><div><div><div><div><=
div><div><p class=3DMsoNormal style=3D'margin-bottom:12.0pt'><span =
lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Folks,</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>As it has been deeply modified since the last WGLC (version -06), this =
is a new two weeks WGLC for the following document: &quot;SAVI Solution =
for DHCP&quot; (<a =
href=3D"http://tools.ietf.org/html/draft-ietf-savi-dhcp-22">http://tools.=
ietf.org/html/draft-ietf-savi-dhcp-22</a>).</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Please, don't hesitate to give your opinion (i.e., =
agreement/disagreement to move forward the document, comments, =
etc.)!</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Thanks in advance.</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><p class=3DMsoNormal =
style=3D'margin-bottom:12.0pt'><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>Best regards,</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div><p =
class=3DMsoNormal><span lang=3DEN-US =
style=3D'font-size:10.5pt;font-family:"Calibri","sans-serif";color:black'=
>JMC.</span><span lang=3DEN-US =
style=3D'color:black'><o:p></o:p></span></p></div></div></div></blockquot=
e></div></div></blockquote></div></body></html>
------=_NextPart_000_0068_01CF5FC8.AD20F570--



From nobody Fri Apr 25 06:26:14 2014
Return-Path: <mellon@fugue.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DB9F1A029E for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 08:18:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.173
X-Spam-Level: 
X-Spam-Status: No, score=-2.173 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.272, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6e0x1HG2z62n for <savi@ietfa.amsl.com>; Wed, 23 Apr 2014 08:18:09 -0700 (PDT)
Received: from toccata.fugue.com (toccata.fugue.com [204.152.186.142]) by ietfa.amsl.com (Postfix) with ESMTP id BE69E1A03D1 for <savi@ietf.org>; Wed, 23 Apr 2014 08:18:08 -0700 (PDT)
Received: from [10.0.10.40] (c-174-62-147-182.hsd1.nh.comcast.net [174.62.147.182]) by toccata.fugue.com (Postfix) with ESMTPSA id F19342380609; Wed, 23 Apr 2014 11:18:00 -0400 (EDT)
Content-Type: text/plain; charset=windows-1252
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Ted Lemon <mellon@fugue.com>
In-Reply-To: <E045AECD98228444A58C61C200AE1BD842614572@xmb-rcd-x01.cisco.com>
Date: Wed, 23 Apr 2014 11:17:58 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <E12CF964-53BC-4D05-8B03-3D5543BDC60A@fugue.com>
References: <CF7BFCD2.38EA7%elevyabe@cisco.com> <52D2BDC7-9E55-43BC-8248-23C43DCDEF96@fugue.com> <E045AECD98228444A58C61C200AE1BD842614572@xmb-rcd-x01.cisco.com>
To: "Pascal Thubert (pthubert)" <pthubert@cisco.com>
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/aGHJbvlUcU47KbnsWajlju0sfxQ
X-Mailman-Approved-At: Fri, 25 Apr 2014 06:26:11 -0700
Cc: "draft-ietf-savi-dhcp@tools.ietf.org" <draft-ietf-savi-dhcp@tools.ietf.org>, Guang Yao <yaoguang@cernet.edu.cn>, SAVI Mailing List <savi@ietf.org>, Jean-Michel Combes <jeanmichel.combes@gmail.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 23 Apr 2014 15:18:11 -0000

On Apr 23, 2014, at 8:01 AM, Pascal Thubert (pthubert) =
<pthubert@cisco.com> wrote:
[...]

Thanks for the detailed explanations=97it's very helpful, since I'm a =
bit out of my depth when it comes to big switches.

> I agree with Guang's proposed change, and maybe we should be =
documenting the value / risk involved in using LQ or not?

Can you send text?   :)

BTW, I agree with Eric that the MUST there should be a SHOULD...


From nobody Mon Apr 28 04:01:20 2014
Return-Path: <yaoguang@cernet.edu.cn>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 305911A09B4 for <savi@ietfa.amsl.com>; Mon, 28 Apr 2014 04:01:19 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.149
X-Spam-Level: 
X-Spam-Status: No, score=0.149 tagged_above=-999 required=5 tests=[BAYES_50=0.8, RP_MATCHES_RCVD=-0.651] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FnMBJbS-xUOf for <savi@ietfa.amsl.com>; Mon, 28 Apr 2014 04:01:17 -0700 (PDT)
Received: from cernet.edu.cn (cernet.edu.cn [202.112.39.2]) by ietfa.amsl.com (Postfix) with ESMTP id 5A4031A09A9 for <savi@ietf.org>; Mon, 28 Apr 2014 04:01:16 -0700 (PDT)
Received: from AndrewYaoPC (unknown [166.111.132.217]) by centos (Coremail) with SMTP id AQAAf3BL3wTnNF5TgTwFAA--.197S2; Mon, 28 Apr 2014 19:00:57 +0800 (CST)
From: "Guang Yao" <yaoguang@cernet.edu.cn>
To: "'Ted Lemon'" <mellon@fugue.com>, "'Pascal Thubert \(pthubert\)'" <pthubert@cisco.com>
References: <CF7BFCD2.38EA7%elevyabe@cisco.com> <52D2BDC7-9E55-43BC-8248-23C43DCDEF96@fugue.com> <E045AECD98228444A58C61C200AE1BD842614572@xmb-rcd-x01.cisco.com> <E12CF964-53BC-4D05-8B03-3D5543BDC60A@fugue.com>
In-Reply-To: <E12CF964-53BC-4D05-8B03-3D5543BDC60A@fugue.com>
Date: Mon, 28 Apr 2014 19:00:55 +0800
Message-ID: <000c01cf62d1$21c68920$65539b60$@cernet.edu.cn>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AQHz29Xah5gSK3gNlrPJIuMg2SittAGPDjalAZVDszYCKNAaUZqzf7QA
Content-Language: zh-cn
X-CM-TRANSID: AQAAf3BL3wTnNF5TgTwFAA--.197S2
X-Coremail-Antispam: 1UD129KBjvJXoWxKw4fAFy3tFWrAr15uryrtFb_yoW3uF1rpa yDKa15Gw1DGw18Xw4xZw1xZryfurWkCFW3GF15GFWjvwn8uryftryS9rW5ZFWxCrn3Ca1Y vF1Y9rWDAas8ZaDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUgjb7Iv0xC_Kw4lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2z4x0Y4vE2Ix0cI8IcVAFwI0_Jr0_JF4l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Jr0_ Gr1l84ACjcxK6I8E87Iv67AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVCY1x0267AKxVW0oV Cq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC2 z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48IcxkI7VAKI48JM4x0Y4 8IcxkI7VAKI48G6xCjnVAKz4kxMxkIecxEwVAFwVW8KwCF04k20xvY0x0EwIxGrwC20s02 6c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_JF 0_Jw1lIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvE c7CjxVAFwI0_Jr0_Gr1lIxAIcVCF04k26cxKx2IYs7xG6rW3Jr0E3s1lIxAIcVC2z280aV AFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVWUJVW8JbIYCTnIWIevJa73UjIFyTuY vjxUy77aUUUUU
X-CM-SenderInfo: 51drw3xdqjquphuqv3oohg3hdfq/
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/2YqoiSbLxwQynXBmijo7R9trYOs
Cc: draft-ietf-savi-dhcp@tools.ietf.org, 'SAVI Mailing List' <savi@ietf.org>, 'Jean-Michel Combes' <jeanmichel.combes@gmail.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Apr 2014 11:01:19 -0000

Dear folks,

Thank you very much for all the comments. Because the topic forks into =
multiple threads, I made a summary for the discussions, including our =
revision decisions.=20

We are grateful to any advanced comments.  Thank you again.

Best regards,
Guang Yao

1. LQ problem

The original post from Eric:
"1) There seem to be a requirement in several places of the document =
(see below) to send LEASEQUERY to the DHCP server.  That is certainly =
useful to do so, but switches are sometimes pure layer-2 switches, and =
don't implement a DHCP stack not they have a layer-3 address to source =
traffic from.
Even when the switches have a layer-3 leg,  setting then to reach out =
the DHCP server is not a trivial operation, and not one which is =
typically done on layer-2 access switches.
Whenever the LEASEQUERY is mandated,  I'd rather have it as a SHOULD, =
with some alternate behavior (delete the entry for instance).
"

The discussions:

Pascal: least there should be enough options to implement some user =
policies. maybe we should be documenting the value / risk involved in =
using LQ or not?

Eric: I am not sure how to read this ("MUST" followed but "if it =
can't").  Isn't it contradictory? I thought "SHOULD" was exactly the way =
to say that.=20

Eric: In the data snooping process...If no conflict was detected, it =
does the LQ I'll tend to argue that if LQ is required, the DETECTION =
state is not necessary and should be removed. If LQ is optional, and =
DETECTION failed to detect a conflict, then the entry should not move =
back right away to NO_BIND?

Ted: BTW, I agree with Eric that the MUST there should be a SHOULD...

Pascal: I'm not sure that this particular FSM is the only way to =
implement the function and get all the necessary interoperation.

Ted: I think the added flexibility you are talking about might in theory =
be a good thing, but might in practice actually be a bad outcome.   In =
any case, it's certainly true that implementors can do this differently =
if they like, as long as their implementation behaves in a way that =
interoperate with implementations that follow the documented FSM.  =20

[final decision]
 (a) for the data snooping process, LQ is necessary, or else there is no =
need to perform the data snooping process (there is no other way to sync =
state with the DHCP server). Considering the whole data snooping process =
is a conditional MUST, the LQ is actually a conditional MUST.

		For the detection problem from Eric, the conflict detection is used to =
reduce times of LQ under attacks against local addresses. "If LQ is =
optional, and DETECTION failed to detect a conflict, then the entry =
should not move back right away to NO_BIND." Then if LQ is not =
implemented, the entry will always move back to NO_BIND. There is no =
need to perform data snooping process at last...

       (b) for the DHCP snooping process, LQ is used to get the lease =
when the binding is triggered by CONFIRM. We propose:
       		"the SAVI device SHOULD send a LEASEQUERY. In case the SAVI =
device is not capable of performing the DHCP leasequery process, the =
entry should be set a lifetime of DHCP_DEFAULT_LEASE."

       		Add a term (but not a constant)
       		"DHCP_DEFAULT_LEASE: default lifetime for DHCPv6 address when =
the binding the triggered by CONFIRM but LQ cannot be performed by the =
SAVI device to fetch the lease."

2. MLD problem

The original post from Eric:

"I don't think a layer-2 switch can and need to join the Solicited Node  =
Multicast group of the source address. It does not have a layer-3 stack =
on top of every link it is bridging/switching. It has to snoop ND =
traffic, like it snoops DHCP traffic. "

The discussions:

Guang: the similar text is found in RFC6620.
	"   The FCFS SAVI device MUST join the solicited node multicast group =
for
	   all the addresses with a state other than NO_BIND.  This is needed =
to
	   make sure that the FCFS SAVI device will receive the DAD_NS for =
those
	   addresses. =20
	"

Ted: Do we really think there are modern layer 2 devices that will =
implement SAVI-DHCP that will not have IPv6 addresses? ... I think this =
is a non-problem.

Eric: An access switch can deal with hundreds, sometimes thousands of =
links (vlans) and while it will always have a layer-3 uplink for =
management purpose, mandating one layer-3 downlink per vlan is often not =
operationally acceptable.

Ted: IOW the switch can't have a link-local address per subnet? Again, =
if it's a managed switch, it doesn't make sense that you wouldn't want =
it to have a routable L3 address.  =20

Eric: I  find the below section very confusing.  SAVI devices are =
switches, hence they have other means to punt any traffic they  want to =
inspect to cpu level. They would not "join multicast groups". A wild =
guess on the intention is to get around the case where some MLD snooping =
device is at stake in the network. Works for addresses that you know but =
can't possibly work for addresses that you don't know yet and that are =
being DAD'ed.  MLD snooping is just incompatible with SAVI, and if we =
accept that fact, joining MLD solicited group is not needed.=20
And it has the same issue I raised: access switches cannot reasonably =
have a layer-3 interface on every subnet (link/vlan) they operate on, =
which could be thousands.

Pascal: Anyway; whether they are private or not, there can be a great =
many vlans and it can become a real hassle to configure one SVI per =
vlan.=20

Ted: Thanks for the detailed explanations=E2=80=94it's very helpful, =
since I'm a bit out of my depth when it comes to big switches.

Leaf: I also wonder a further explanation on the following statement.=20

[final decision]
We found the problems for SAVI-DHCP and SAVI-FCFS are different. =
SAVI-DHCP does not expect a DAD NS in any state. The NA will always be =
received by the SAVI device. Thus it is proper to not join the MLD =
group. We will remove the corresponding sentence.=20


3. DAD detection problem=20

The original post from Eric:

"I wonder what would be the end-result if the switch send a DAD or and =
ARP and the legitimate owner interpret it as "someone already has the =
address" (always possible depending on its current state). That would =
seriously break DAD or ACD (rfc5227). I think we need a way to =
distinguish  between the packets issued by the switch and normal DAD or =
ACD packets.  (some field in the header? But that would be a protocol =
change=E2=80=A6)."

The discussions:

Guang: the similar text is found in RFC6620.

	"Upon the reception through a Validating Port (VP) of a DATA packet
	      containing IPAddr as the source address, the SAVI device SHOULD
	      execute the process of sending Neighbor Solicitation messages of
	      the Duplicate Address Detection process as described in Section
	      5.4.2 of [RFC4862]
	"

Leaf: If you could agreed on the above in RFC6620, I guess you would =
have no doubt here for the IPv6 address.=20

Eric:
	DETECTION in general is problematic. The state in the SAVI device and =
on the end-node which has the conflicting address are independent. When =
he SAVI switch sends a DAD, while the end-node is right in TENTATIVE =
(bad luck), this DAD would shutdown the end-node interface. Maybe that =
is a problem we have to deal with, but these probe packets are causing =
exactly this type of issues, seen in real life. I thought I should =
mention it.

	In your response, you said it could also send a regular NS, which I =
assume is an NS lookup. I could not find a reference in the text about =
sending NS lookup instead of DAD. This is certainly a good practice (we =
have implemented it that way) provided that you have an address to =
source it from. However (my usual objection) the access switches often =
don't have a
	l3 address per link/vlan, not even a link-local address. So NS-lookup =
should be an option. Which leaves only DAD or LQ.

Leaf: This sounds also the same argue to the FSM (including the states =
of 'No
Bind') described in Fig.2 of RFC6620, which needs the SAVI device (or
switch) to send out DAD_NS. If we believe it sounds a wrong message, =
would you like submit a Errata for it? =EF=81=8A

[final decision]:
	(a) we will use a non-DAD NS with specified source (sorry for we do not =
find the definition for NS lookup).
	(b) Considering the l3 address problem, I propose use a "SHOULD" on the =
NS detection.=20
		As I mention above, DAD is not an alternative of LQ. It is used to =
reduce the times of LQ under attacks against local addresses.




From nobody Mon Apr 28 06:17:46 2014
Return-Path: <pthubert@cisco.com>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 11BE01A09FD for <savi@ietfa.amsl.com>; Mon, 28 Apr 2014 06:17:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -15.152
X-Spam-Level: 
X-Spam-Status: No, score=-15.152 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.651, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eICBuAefbhE4 for <savi@ietfa.amsl.com>; Mon, 28 Apr 2014 06:17:40 -0700 (PDT)
Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by ietfa.amsl.com (Postfix) with ESMTP id 696861A047C for <savi@ietf.org>; Mon, 28 Apr 2014 06:17:40 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4702; q=dns/txt; s=iport; t=1398691060; x=1399900660; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=ZOLFE2H36U1DB7EmlU1lK0QKWVmitcq1EEkLaYowwWQ=; b=YblfK3PoVUXLsoOsCkxMX3Qr9Irx+my2KJxLfGxqj9ItRoaw6LFfKIl4 7cKMWjBJPESqISJOeolnIgsIjOP6TgleULyqTvcg4inK8rZg7twZEII78 X/xUiGPUFtPmifTm9pV6W+KNeo9fDp+MYH05wfgvjtRNglGcP3u4C8h8U k=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AhQFACNUXlOtJA2K/2dsb2JhbABZDoJ4gSaCZcICGXwWdIIlAQEBBCMROgsMBAIBCBEEAQEDAgYdAwICAjAUAQgIAgQBDQUIiDmmGqNiF4EpiA6EcTEHBoJpNYEVBKtqgnFAgWskHA
X-IronPort-AV: E=Sophos;i="4.97,944,1389744000"; d="scan'208";a="320885732"
Received: from alln-core-5.cisco.com ([173.36.13.138]) by rcdn-iport-5.cisco.com with ESMTP; 28 Apr 2014 13:17:39 +0000
Received: from xhc-aln-x02.cisco.com (xhc-aln-x02.cisco.com [173.36.12.76]) by alln-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id s3SDHdpx027491 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Mon, 28 Apr 2014 13:17:39 GMT
Received: from xmb-rcd-x01.cisco.com ([169.254.1.229]) by xhc-aln-x02.cisco.com ([173.36.12.76]) with mapi id 14.03.0123.003; Mon, 28 Apr 2014 08:17:39 -0500
From: "Pascal Thubert (pthubert)" <pthubert@cisco.com>
To: Guang Yao <yaoguang@cernet.edu.cn>, "'Ted Lemon'" <mellon@fugue.com>
Thread-Topic: [savi] WGLC: draft-ietf-savi-dhcp-22
Thread-Index: AQHPXgwtN38N06KZ3k+UXesy9jYewpsd110AgAEwLCCAAJ6aAIAHk9eA///PuzA=
Date: Mon, 28 Apr 2014 13:17:38 +0000
Deferred-Delivery: Mon, 28 Apr 2014 13:17:00 +0000
Message-ID: <E045AECD98228444A58C61C200AE1BD8426240F1@xmb-rcd-x01.cisco.com>
References: <CF7BFCD2.38EA7%elevyabe@cisco.com> <52D2BDC7-9E55-43BC-8248-23C43DCDEF96@fugue.com> <E045AECD98228444A58C61C200AE1BD842614572@xmb-rcd-x01.cisco.com> <E12CF964-53BC-4D05-8B03-3D5543BDC60A@fugue.com> <000c01cf62d1$21c68920$65539b60$@cernet.edu.cn>
In-Reply-To: <000c01cf62d1$21c68920$65539b60$@cernet.edu.cn>
Accept-Language: fr-FR, en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-originating-ip: [10.49.80.48]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/4Ii6YH_wxOdrc-RBuOOZrhI5fOY
Cc: "draft-ietf-savi-dhcp@tools.ietf.org" <draft-ietf-savi-dhcp@tools.ietf.org>, 'SAVI Mailing List' <savi@ietf.org>, 'Jean-Michel Combes' <jeanmichel.combes@gmail.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Apr 2014 13:17:42 -0000

DQoNCkNoZWVycywNCg0KUGFzY2FsDQoNCj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4g
RnJvbTogR3VhbmcgWWFvIFttYWlsdG86eWFvZ3VhbmdAY2VybmV0LmVkdS5jbl0NCj4gU2VudDog
bHVuZGkgMjggYXZyaWwgMjAxNCAxMzowMQ0KPiBUbzogJ1RlZCBMZW1vbic7IFBhc2NhbCBUaHVi
ZXJ0IChwdGh1YmVydCkNCj4gQ2M6IGRyYWZ0LWlldGYtc2F2aS1kaGNwQHRvb2xzLmlldGYub3Jn
OyAnU0FWSSBNYWlsaW5nIExpc3QnOyAnSmVhbi1NaWNoZWwNCj4gQ29tYmVzJw0KPiBTdWJqZWN0
OiBSRTogW3NhdmldIFdHTEM6IGRyYWZ0LWlldGYtc2F2aS1kaGNwLTIyDQo+IA0KPiBEZWFyIGZv
bGtzLA0KPiANCj4gVGhhbmsgeW91IHZlcnkgbXVjaCBmb3IgYWxsIHRoZSBjb21tZW50cy4gQmVj
YXVzZSB0aGUgdG9waWMgZm9ya3MgaW50bw0KPiBtdWx0aXBsZSB0aHJlYWRzLCBJIG1hZGUgYSBz
dW1tYXJ5IGZvciB0aGUgZGlzY3Vzc2lvbnMsIGluY2x1ZGluZyBvdXINCj4gcmV2aXNpb24gZGVj
aXNpb25zLg0KPiANCj4gV2UgYXJlIGdyYXRlZnVsIHRvIGFueSBhZHZhbmNlZCBjb21tZW50cy4g
IFRoYW5rIHlvdSBhZ2Fpbi4NCj4gDQo+IEJlc3QgcmVnYXJkcywNCj4gR3VhbmcgWWFvDQo+IA0K
PiAxLiBMUSBwcm9ibGVtDQo+IA0KPiBUaGUgb3JpZ2luYWwgcG9zdCBmcm9tIEVyaWM6DQo+ICIx
KSBUaGVyZSBzZWVtIHRvIGJlIGEgcmVxdWlyZW1lbnQgaW4gc2V2ZXJhbCBwbGFjZXMgb2YgdGhl
IGRvY3VtZW50IChzZWUNCj4gYmVsb3cpIHRvIHNlbmQgTEVBU0VRVUVSWSB0byB0aGUgREhDUCBz
ZXJ2ZXIuICBUaGF0IGlzIGNlcnRhaW5seSB1c2VmdWwgdG8NCj4gZG8gc28sIGJ1dCBzd2l0Y2hl
cyBhcmUgc29tZXRpbWVzIHB1cmUgbGF5ZXItMiBzd2l0Y2hlcywgYW5kIGRvbid0DQo+IGltcGxl
bWVudCBhIERIQ1Agc3RhY2sgbm90IHRoZXkgaGF2ZSBhIGxheWVyLTMgYWRkcmVzcyB0byBzb3Vy
Y2UgdHJhZmZpYw0KPiBmcm9tLg0KPiBFdmVuIHdoZW4gdGhlIHN3aXRjaGVzIGhhdmUgYSBsYXll
ci0zIGxlZywgIHNldHRpbmcgdGhlbiB0byByZWFjaCBvdXQgdGhlDQo+IERIQ1Agc2VydmVyIGlz
IG5vdCBhIHRyaXZpYWwgb3BlcmF0aW9uLCBhbmQgbm90IG9uZSB3aGljaCBpcyB0eXBpY2FsbHkg
ZG9uZSBvbg0KPiBsYXllci0yIGFjY2VzcyBzd2l0Y2hlcy4NCj4gV2hlbmV2ZXIgdGhlIExFQVNF
UVVFUlkgaXMgbWFuZGF0ZWQsICBJJ2QgcmF0aGVyIGhhdmUgaXQgYXMgYSBTSE9VTEQsDQo+IHdp
dGggc29tZSBhbHRlcm5hdGUgYmVoYXZpb3IgKGRlbGV0ZSB0aGUgZW50cnkgZm9yIGluc3RhbmNl
KS4NCj4gIg0KPiANCj4gVGhlIGRpc2N1c3Npb25zOg0KPiANCj4gUGFzY2FsOiBsZWFzdCB0aGVy
ZSBzaG91bGQgYmUgZW5vdWdoIG9wdGlvbnMgdG8gaW1wbGVtZW50IHNvbWUgdXNlcg0KPiBwb2xp
Y2llcy4gbWF5YmUgd2Ugc2hvdWxkIGJlIGRvY3VtZW50aW5nIHRoZSB2YWx1ZSAvIHJpc2sgaW52
b2x2ZWQgaW4gdXNpbmcNCj4gTFEgb3Igbm90Pw0KPiANCj4gRXJpYzogSSBhbSBub3Qgc3VyZSBo
b3cgdG8gcmVhZCB0aGlzICgiTVVTVCIgZm9sbG93ZWQgYnV0ICJpZiBpdCBjYW4ndCIpLiAgSXNu
J3QNCj4gaXQgY29udHJhZGljdG9yeT8gSSB0aG91Z2h0ICJTSE9VTEQiIHdhcyBleGFjdGx5IHRo
ZSB3YXkgdG8gc2F5IHRoYXQuDQo+IA0KPiBFcmljOiBJbiB0aGUgZGF0YSBzbm9vcGluZyBwcm9j
ZXNzLi4uSWYgbm8gY29uZmxpY3Qgd2FzIGRldGVjdGVkLCBpdCBkb2VzIHRoZSBMUQ0KPiBJJ2xs
IHRlbmQgdG8gYXJndWUgdGhhdCBpZiBMUSBpcyByZXF1aXJlZCwgdGhlIERFVEVDVElPTiBzdGF0
ZSBpcyBub3QgbmVjZXNzYXJ5DQo+IGFuZCBzaG91bGQgYmUgcmVtb3ZlZC4gSWYgTFEgaXMgb3B0
aW9uYWwsIGFuZCBERVRFQ1RJT04gZmFpbGVkIHRvIGRldGVjdCBhDQo+IGNvbmZsaWN0LCB0aGVu
IHRoZSBlbnRyeSBzaG91bGQgbm90IG1vdmUgYmFjayByaWdodCBhd2F5IHRvIE5PX0JJTkQ/DQo+
IA0KPiBUZWQ6IEJUVywgSSBhZ3JlZSB3aXRoIEVyaWMgdGhhdCB0aGUgTVVTVCB0aGVyZSBzaG91
bGQgYmUgYSBTSE9VTEQuLi4NCj4gDQo+IFBhc2NhbDogSSdtIG5vdCBzdXJlIHRoYXQgdGhpcyBw
YXJ0aWN1bGFyIEZTTSBpcyB0aGUgb25seSB3YXkgdG8gaW1wbGVtZW50IHRoZQ0KPiBmdW5jdGlv
biBhbmQgZ2V0IGFsbCB0aGUgbmVjZXNzYXJ5IGludGVyb3BlcmF0aW9uLg0KPiANCj4gVGVkOiBJ
IHRoaW5rIHRoZSBhZGRlZCBmbGV4aWJpbGl0eSB5b3UgYXJlIHRhbGtpbmcgYWJvdXQgbWlnaHQg
aW4gdGhlb3J5IGJlIGENCj4gZ29vZCB0aGluZywgYnV0IG1pZ2h0IGluIHByYWN0aWNlIGFjdHVh
bGx5IGJlIGEgYmFkIG91dGNvbWUuICAgSW4gYW55IGNhc2UsDQo+IGl0J3MgY2VydGFpbmx5IHRy
dWUgdGhhdCBpbXBsZW1lbnRvcnMgY2FuIGRvIHRoaXMgZGlmZmVyZW50bHkgaWYgdGhleSBsaWtl
LCBhcw0KPiBsb25nIGFzIHRoZWlyIGltcGxlbWVudGF0aW9uIGJlaGF2ZXMgaW4gYSB3YXkgdGhh
dCBpbnRlcm9wZXJhdGUgd2l0aA0KPiBpbXBsZW1lbnRhdGlvbnMgdGhhdCBmb2xsb3cgdGhlIGRv
Y3VtZW50ZWQgRlNNLg0KPiANCj4gW2ZpbmFsIGRlY2lzaW9uXQ0KPiAgKGEpIGZvciB0aGUgZGF0
YSBzbm9vcGluZyBwcm9jZXNzLCBMUSBpcyBuZWNlc3NhcnksIG9yIGVsc2UgdGhlcmUgaXMgbm8g
bmVlZA0KPiB0byBwZXJmb3JtIHRoZSBkYXRhIHNub29waW5nIHByb2Nlc3MgKHRoZXJlIGlzIG5v
IG90aGVyIHdheSB0byBzeW5jIHN0YXRlDQo+IHdpdGggdGhlIERIQ1Agc2VydmVyKS4gQ29uc2lk
ZXJpbmcgdGhlIHdob2xlIGRhdGEgc25vb3BpbmcgcHJvY2VzcyBpcyBhDQo+IGNvbmRpdGlvbmFs
IE1VU1QsIHRoZSBMUSBpcyBhY3R1YWxseSBhIGNvbmRpdGlvbmFsIE1VU1QuDQoNCltQVF0gQW4g
b2JzZXJ2YXRpb24gdGhhdCAic3luYyBzdGF0ZSIgaXMgbm90IHRoZSBwZXJmZWN0IHdvcmRpbmcg
c2luY2UgdGhlIGJlc3Qgd2UgY2FuIGRvIGlzIHJlLXZhbGlkYXRlIHdoZXRoZXIgdGhlIHNlcnZl
ciBrbm93cyB0aGUgYWRkcmVzcyBidXQgbm90IHB1c2ggYSBzdGF0ZS4NCkkgYWdyZWUgdGhhdCBp
biB0aGUgY29udGV4dCBvZiBESENQIG9ubHksIHNub29waW5nIG1ha2VzIGEgbG90IG1vcmUgc2Vu
c2Ugd2l0aCBMUTsgaW4gYSBnZW5lcmFsIG5ldHdvcmssIHRob3VnaCwgZGF0YSBzbm9vcGluZyBp
cyB2YWx1YWJsZSB0byAtIGF0IGxlYXN0LSBkaXNjb3ZlciB0aGF0IHRoZXJlIGlzIGVpdGhlciBh
IG1pc3Npbmcgc3RhdGUgb3IgYW4gdXN1cnBhdGlvbi4gQW5kIGZyb20gdGhlcmUgdGFrZSBhY3Rp
b24gd2hpY2ggY2FuIGJlIG9uZSBvZiBRdWVyeSBESENQIHNlcnZlciwgcXVlcnkgb3RoZXIgc3dp
dGNoZXMsIGNyZWF0ZSBlbnRyeSB3aXRoIGEgbG93IHRydXN0IGxldmVsLi4uDQoNCkNoZWVycywN
Cg0KUGFzY2FsDQoNCg==


From nobody Mon Apr 28 07:18:13 2014
Return-Path: <yaoguang@cernet.edu.cn>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66B281A6EE1 for <savi@ietfa.amsl.com>; Mon, 28 Apr 2014 07:18:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.551
X-Spam-Level: 
X-Spam-Status: No, score=-2.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.651] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O6cHGlKQxlqD for <savi@ietfa.amsl.com>; Mon, 28 Apr 2014 07:18:04 -0700 (PDT)
Received: from cernet.edu.cn (mail.cernet.edu.cn [202.112.39.2]) by ietfa.amsl.com (Postfix) with ESMTP id D42B51A6EFE for <savi@ietf.org>; Mon, 28 Apr 2014 07:18:03 -0700 (PDT)
Received: from AndrewYaoPC (unknown [59.66.252.55]) by centos (Coremail) with SMTP id AQAAf3BbRwcNY15TbkkFAA--.210S2; Mon, 28 Apr 2014 22:17:49 +0800 (CST)
From: "Guang Yao" <yaoguang@cernet.edu.cn>
To: "'Pascal Thubert \(pthubert\)'" <pthubert@cisco.com>, "'Ted Lemon'" <mellon@fugue.com>
References: <CF7BFCD2.38EA7%elevyabe@cisco.com> <52D2BDC7-9E55-43BC-8248-23C43DCDEF96@fugue.com> <E045AECD98228444A58C61C200AE1BD842614572@xmb-rcd-x01.cisco.com> <E12CF964-53BC-4D05-8B03-3D5543BDC60A@fugue.com> <000c01cf62d1$21c68920$65539b60$@cernet.edu.cn> <E045AECD98228444A58C61C200AE1BD8426240F1@xmb-rcd-x01.cisco.com>
In-Reply-To: <E045AECD98228444A58C61C200AE1BD8426240F1@xmb-rcd-x01.cisco.com>
Date: Mon, 28 Apr 2014 22:17:50 +0800
Message-ID: <000001cf62ec$a3215bb0$e9641310$@cernet.edu.cn>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AQHz29Xah5gSK3gNlrPJIuMg2SittAGPDjalAZVDszYCKNAaUQK+oXfeAcU+i2maj5SpEA==
Content-Language: zh-cn
X-CM-TRANSID: AQAAf3BbRwcNY15TbkkFAA--.210S2
X-Coremail-Antispam: 1UD129KBjvJXoWxZw4xuryUtr13Zr43Zr1kXwb_yoWrKr1Upa yaqw1UCw1DGwn7J3yxXw4xWr4ruw4kGay3Cr95G3yUZwn8Xry0qr4xK345ZFWUWa93X3ya qFsF9r98Za90vaDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUy0b7Iv0xC_Kw4lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2z4x0Y4vE2Ix0cI8IcVAFwI0_Jr0_JF4l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Jr0_ Gr1l84ACjcxK6I8E87Iv67AKxVW8JVWxJwA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gr0_Gr 1UM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj6I8E 87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41lF7xvr2 IYc2Ij64vIr40E4x8a64kEw24lc2xSY4AK67AK6ry5MxAIw28IcxkI7VAKI48JMxCIbckI 1I0E14v26r1Y6r17MI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_Jr Wlx4CE17CEb7AF67AKxVWUAVWUtwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j 6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVWUJVW8JwCI42IY6xAIw20EY4v20xvaj40_WF yUJVCq3wCI42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r1j6r4U YxBIdaVFxhVjvjDU0xZFpf9x07boOJOUUUUU=
X-CM-SenderInfo: 51drw3xdqjquphuqv3oohg3hdfq/
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/1UlIxK_7XcdLRYFXKK2AXbz9RH4
Cc: draft-ietf-savi-dhcp@tools.ietf.org, 'SAVI Mailing List' <savi@ietf.org>, 'Jean-Michel Combes' <jeanmichel.combes@gmail.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Apr 2014 14:18:07 -0000

Hi, Pascal

Thank you very much for these comments!

"[PT] An observation that "sync state" is not the perfect wording since =
the best we can do is re-validate whether the server knows the address =
but not push a state.
I agree that in the context of DHCP only, snooping makes a lot more =
sense with LQ; in a general network, though, data snooping is valuable =
to - at least- discover that there is either a missing state or an =
usurpation. "

Guang:
I agree. But there should be some meaningful ways to recover the =
bindings. Or else, it is meaningless only discovering the trouble.=20

"And from there take action which can be one of Query DHCP server, query =
other switches, create entry with a low trust level..."

Guang:
I can understand you are suggesting possible alternatives, but I'm not =
sure how "query other switches" works.
"create entry with a low trust level " is not in the scope of this WG.

As you noted, LQ is the most effective and direct way to recover the =
binding. If LQ is too heavy, maybe a lightweight LQ should be designed. =
Introducing other mechanisms will make this solution further =
complicated.

Best regards,
Guang

-----Original Message-----
From: Pascal Thubert (pthubert) [mailto:pthubert@cisco.com]=20
Sent: Monday, April 28, 2014 9:18 PM
To: Guang Yao; 'Ted Lemon'
Cc: draft-ietf-savi-dhcp@tools.ietf.org; 'SAVI Mailing List'; =
'Jean-Michel Combes'
Subject: RE: [savi] WGLC: draft-ietf-savi-dhcp-22



Cheers,

Pascal

> -----Original Message-----
> From: Guang Yao [mailto:yaoguang@cernet.edu.cn]
> Sent: lundi 28 avril 2014 13:01
> To: 'Ted Lemon'; Pascal Thubert (pthubert)
> Cc: draft-ietf-savi-dhcp@tools.ietf.org; 'SAVI Mailing List';=20
> 'Jean-Michel Combes'
> Subject: RE: [savi] WGLC: draft-ietf-savi-dhcp-22
>=20
> Dear folks,
>=20
> Thank you very much for all the comments. Because the topic forks into =

> multiple threads, I made a summary for the discussions, including our=20
> revision decisions.
>=20
> We are grateful to any advanced comments.  Thank you again.
>=20
> Best regards,
> Guang Yao
>=20
> 1. LQ problem
>=20
> The original post from Eric:
> "1) There seem to be a requirement in several places of the document=20
> (see
> below) to send LEASEQUERY to the DHCP server.  That is certainly=20
> useful to do so, but switches are sometimes pure layer-2 switches, and =

> don't implement a DHCP stack not they have a layer-3 address to source =

> traffic from.
> Even when the switches have a layer-3 leg,  setting then to reach out=20
> the DHCP server is not a trivial operation, and not one which is=20
> typically done on
> layer-2 access switches.
> Whenever the LEASEQUERY is mandated,  I'd rather have it as a SHOULD,=20
> with some alternate behavior (delete the entry for instance).
> "
>=20
> The discussions:
>=20
> Pascal: least there should be enough options to implement some user=20
> policies. maybe we should be documenting the value / risk involved in=20
> using LQ or not?
>=20
> Eric: I am not sure how to read this ("MUST" followed but "if it=20
> can't").  Isn't it contradictory? I thought "SHOULD" was exactly the =
way to say that.
>=20
> Eric: In the data snooping process...If no conflict was detected, it=20
> does the LQ I'll tend to argue that if LQ is required, the DETECTION=20
> state is not necessary and should be removed. If LQ is optional, and=20
> DETECTION failed to detect a conflict, then the entry should not move =
back right away to NO_BIND?
>=20
> Ted: BTW, I agree with Eric that the MUST there should be a SHOULD...
>=20
> Pascal: I'm not sure that this particular FSM is the only way to=20
> implement the function and get all the necessary interoperation.
>=20
> Ted: I think the added flexibility you are talking about might in =
theory be a
> good thing, but might in practice actually be a bad outcome.   In any =
case,
> it's certainly true that implementors can do this differently if they=20
> like, as long as their implementation behaves in a way that=20
> interoperate with implementations that follow the documented FSM.
>=20
> [final decision]
>  (a) for the data snooping process, LQ is necessary, or else there is=20
> no need to perform the data snooping process (there is no other way to =

> sync state with the DHCP server). Considering the whole data snooping=20
> process is a conditional MUST, the LQ is actually a conditional MUST.

[PT] An observation that "sync state" is not the perfect wording since =
the best we can do is re-validate whether the server knows the address =
but not push a state.
I agree that in the context of DHCP only, snooping makes a lot more =
sense with LQ; in a general network, though, data snooping is valuable =
to - at least- discover that there is either a missing state or an =
usurpation. And from there take action which can be one of Query DHCP =
server, query other switches, create entry with a low trust level...

Cheers,

Pascal




From nobody Mon Apr 28 07:19:23 2014
Return-Path: <junbi@cernet.edu.cn>
X-Original-To: savi@ietfa.amsl.com
Delivered-To: savi@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 544561A6EFE for <savi@ietfa.amsl.com>; Mon, 28 Apr 2014 07:19:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.551
X-Spam-Level: 
X-Spam-Status: No, score=-2.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.651] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id izQuBSbyJyHz for <savi@ietfa.amsl.com>; Mon, 28 Apr 2014 07:19:19 -0700 (PDT)
Received: from cernet.edu.cn (mail.cernet.edu.cn [202.112.39.2]) by ietfa.amsl.com (Postfix) with ESMTP id 47F8D1A6EE1 for <savi@ietf.org>; Mon, 28 Apr 2014 07:19:18 -0700 (PDT)
Received: from junbithinkpadx1 (unknown [207.236.147.202]) by centos (Coremail) with SMTP id AQAAf3DbNgNYY15TfUkFAA--.241S2; Mon, 28 Apr 2014 22:19:07 +0800 (CST)
From: "Jun Bi" <junbi@cernet.edu.cn>
To: "'Guang Yao'" <yaoguang@cernet.edu.cn>, "'Ted Lemon'" <mellon@fugue.com>,  "'Pascal Thubert \(pthubert\)'" <pthubert@cisco.com>
References: <CF7BFCD2.38EA7%elevyabe@cisco.com> <52D2BDC7-9E55-43BC-8248-23C43DCDEF96@fugue.com> <E045AECD98228444A58C61C200AE1BD842614572@xmb-rcd-x01.cisco.com> <E12CF964-53BC-4D05-8B03-3D5543BDC60A@fugue.com> <000c01cf62d1$21c68920$65539b60$@cernet.edu.cn>
In-Reply-To: <000c01cf62d1$21c68920$65539b60$@cernet.edu.cn>
Date: Mon, 28 Apr 2014 10:19:04 -0400
Message-ID: <003f01cf62ec$d1ac07f0$750417d0$@cernet.edu.cn>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook 15.0
Thread-Index: AQHz29Xah5gSK3gNlrPJIuMg2SittAGPDjalAZVDszYCKNAaUQK+oXfemp3DksA=
Content-Language: zh-cn
X-CM-TRANSID: AQAAf3DbNgNYY15TfUkFAA--.241S2
X-Coremail-Antispam: 1UD129KBjvJXoW3Gr1DCrWDWr4rWF47XFWxtFb_yoWfXrykpa yDKa15Gr1DGw18Xws7Zw1xZryfurWkCay3GF15GrWjv3s8uryftryS93y5ZFyxCrn3Ca1Y vF1Y9rWDAas8ZaDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUkv14x267AKxVWUJVW8JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84ACjcxK6xIIjxv20xvE14 v26r1j6r1xM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4j6F4UM28EF7xvwVC2z280aVAF wI0_Gr0_Cr1l84ACjcxK6I8E87Iv6xkF7I0E14v26r4j6r4UJwAS0I0E0xvYzxvE52x082 IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2IY67AKxVWUJVWUGwAv 7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48IcxkI7VAKI48JM4 x0Y48IcxkI7VAKI48G6xCjnVAKz4kxM4x0x7Aq67IIx4CEVc8vx2IErcIFxwCY02Avz4vE 174l42xK82IYc2Ij64vIr41l4IxYO2xFxVAFwI0_JF0_Jw1lx2IqxVAqx4xG67AKxVWUJV WUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r126r1DMIIYrxkI7VAK I48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I0E14v26r1j6r 4UMIIF0xvE42xK8VAvwI8IcIk0rVWrJr0_WFyUJwCI42IY6I8E87Iv67AKxVWUJVW8JwCI 42IY6I8E87Iv6xkF7I0E14v26r1j6r4UYxBIdaVFxhVjvjDU0xZFpf9x0pR33kZUUUUU=
X-CM-SenderInfo: xmxquxg6fh20lhwovvfxof0/
Archived-At: http://mailarchive.ietf.org/arch/msg/savi/RJ7UaxdGLU_FfAVJ3obxzR0GwwY
Cc: draft-ietf-savi-dhcp@tools.ietf.org, 'SAVI Mailing List' <savi@ietf.org>, 'Jean-Michel Combes' <jeanmichel.combes@gmail.com>
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22
X-BeenThere: savi@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Mailing list for the SAVI working group at IETF <savi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/savi>, <mailto:savi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/savi/>
List-Post: <mailto:savi@ietf.org>
List-Help: <mailto:savi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/savi>, <mailto:savi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 28 Apr 2014 14:19:21 -0000

Dear folks,

Many thanks for your valuable review comments.
We plan to submit a new version ASAP.

Best Regards,
Jun Bi

-----Original Message-----
From: savi [mailto:savi-bounces@ietf.org] On Behalf Of Guang Yao
Sent: Monday, April 28, 2014 7:01 AM
To: 'Ted Lemon'; 'Pascal Thubert (pthubert)'
Cc: draft-ietf-savi-dhcp@tools.ietf.org; 'SAVI Mailing List'; =
'Jean-Michel Combes'
Subject: Re: [savi] WGLC: draft-ietf-savi-dhcp-22

Dear folks,

Thank you very much for all the comments. Because the topic forks into =
multiple threads, I made a summary for the discussions, including our =
revision decisions.=20

We are grateful to any advanced comments.  Thank you again.

Best regards,
Guang Yao

1. LQ problem

The original post from Eric:
"1) There seem to be a requirement in several places of the document =
(see below) to send LEASEQUERY to the DHCP server.  That is certainly =
useful to do so, but switches are sometimes pure layer-2 switches, and =
don't implement a DHCP stack not they have a layer-3 address to source =
traffic from.
Even when the switches have a layer-3 leg,  setting then to reach out =
the DHCP server is not a trivial operation, and not one which is =
typically done on layer-2 access switches.
Whenever the LEASEQUERY is mandated,  I'd rather have it as a SHOULD, =
with some alternate behavior (delete the entry for instance).
"

The discussions:

Pascal: least there should be enough options to implement some user =
policies. maybe we should be documenting the value / risk involved in =
using LQ or not?

Eric: I am not sure how to read this ("MUST" followed but "if it =
can't").  Isn't it contradictory? I thought "SHOULD" was exactly the way =
to say that.=20

Eric: In the data snooping process...If no conflict was detected, it =
does the LQ I'll tend to argue that if LQ is required, the DETECTION =
state is not necessary and should be removed. If LQ is optional, and =
DETECTION failed to detect a conflict, then the entry should not move =
back right away to NO_BIND?

Ted: BTW, I agree with Eric that the MUST there should be a SHOULD...

Pascal: I'm not sure that this particular FSM is the only way to =
implement the function and get all the necessary interoperation.

Ted: I think the added flexibility you are talking about might in theory =
be a good thing, but might in practice actually be a bad outcome.   In =
any case, it's certainly true that implementors can do this differently =
if they like, as long as their implementation behaves in a way that =
interoperate with implementations that follow the documented FSM.  =20

[final decision]
 (a) for the data snooping process, LQ is necessary, or else there is no =
need to perform the data snooping process (there is no other way to sync =
state with the DHCP server). Considering the whole data snooping process =
is a conditional MUST, the LQ is actually a conditional MUST.

		For the detection problem from Eric, the conflict detection is used to =
reduce times of LQ under attacks against local addresses. "If LQ is =
optional, and DETECTION failed to detect a conflict, then the entry =
should not move back right away to NO_BIND." Then if LQ is not =
implemented, the entry will always move back to NO_BIND. There is no =
need to perform data snooping process at last...

       (b) for the DHCP snooping process, LQ is used to get the lease =
when the binding is triggered by CONFIRM. We propose:
       		"the SAVI device SHOULD send a LEASEQUERY. In case the SAVI =
device is not capable of performing the DHCP leasequery process, the =
entry should be set a lifetime of DHCP_DEFAULT_LEASE."

       		Add a term (but not a constant)
       		"DHCP_DEFAULT_LEASE: default lifetime for DHCPv6 address when =
the binding the triggered by CONFIRM but LQ cannot be performed by the =
SAVI device to fetch the lease."

2. MLD problem

The original post from Eric:

"I don't think a layer-2 switch can and need to join the Solicited Node  =
Multicast group of the source address. It does not have a layer-3 stack =
on top of every link it is bridging/switching. It has to snoop ND =
traffic, like it snoops DHCP traffic. "

The discussions:

Guang: the similar text is found in RFC6620.
	"   The FCFS SAVI device MUST join the solicited node multicast group =
for
	   all the addresses with a state other than NO_BIND.  This is needed =
to
	   make sure that the FCFS SAVI device will receive the DAD_NS for =
those
	   addresses. =20
	"

Ted: Do we really think there are modern layer 2 devices that will =
implement SAVI-DHCP that will not have IPv6 addresses? ... I think this =
is a non-problem.

Eric: An access switch can deal with hundreds, sometimes thousands of =
links (vlans) and while it will always have a layer-3 uplink for =
management purpose, mandating one layer-3 downlink per vlan is often not =
operationally acceptable.

Ted: IOW the switch can't have a link-local address per subnet? Again, =
if it's a managed switch, it doesn't make sense that you wouldn't want =
it to have a routable L3 address.  =20

Eric: I  find the below section very confusing.  SAVI devices are =
switches, hence they have other means to punt any traffic they  want to =
inspect to cpu level. They would not "join multicast groups". A wild =
guess on the intention is to get around the case where some MLD snooping =
device is at stake in the network. Works for addresses that you know but =
can't possibly work for addresses that you don't know yet and that are =
being DAD'ed.  MLD snooping is just incompatible with SAVI, and if we =
accept that fact, joining MLD solicited group is not needed.=20
And it has the same issue I raised: access switches cannot reasonably =
have a layer-3 interface on every subnet (link/vlan) they operate on, =
which could be thousands.

Pascal: Anyway; whether they are private or not, there can be a great =
many vlans and it can become a real hassle to configure one SVI per =
vlan.=20

Ted: Thanks for the detailed explanations=E2=80=94it's very helpful, =
since I'm a bit out of my depth when it comes to big switches.

Leaf: I also wonder a further explanation on the following statement.=20

[final decision]
We found the problems for SAVI-DHCP and SAVI-FCFS are different. =
SAVI-DHCP does not expect a DAD NS in any state. The NA will always be =
received by the SAVI device. Thus it is proper to not join the MLD =
group. We will remove the corresponding sentence.=20


3. DAD detection problem=20

The original post from Eric:

"I wonder what would be the end-result if the switch send a DAD or and =
ARP and the legitimate owner interpret it as "someone already has the =
address" (always possible depending on its current state). That would =
seriously break DAD or ACD (rfc5227). I think we need a way to =
distinguish  between the packets issued by the switch and normal DAD or =
ACD packets.  (some field in the header? But that would be a protocol =
change=E2=80=A6)."

The discussions:

Guang: the similar text is found in RFC6620.

	"Upon the reception through a Validating Port (VP) of a DATA packet
	      containing IPAddr as the source address, the SAVI device SHOULD
	      execute the process of sending Neighbor Solicitation messages of
	      the Duplicate Address Detection process as described in Section
	      5.4.2 of [RFC4862]
	"

Leaf: If you could agreed on the above in RFC6620, I guess you would =
have no doubt here for the IPv6 address.=20

Eric:
	DETECTION in general is problematic. The state in the SAVI device and =
on the end-node which has the conflicting address are independent. When =
he SAVI switch sends a DAD, while the end-node is right in TENTATIVE =
(bad luck), this DAD would shutdown the end-node interface. Maybe that =
is a problem we have to deal with, but these probe packets are causing =
exactly this type of issues, seen in real life. I thought I should =
mention it.

	In your response, you said it could also send a regular NS, which I =
assume is an NS lookup. I could not find a reference in the text about =
sending NS lookup instead of DAD. This is certainly a good practice (we =
have implemented it that way) provided that you have an address to =
source it from. However (my usual objection) the access switches often =
don't have a
	l3 address per link/vlan, not even a link-local address. So NS-lookup =
should be an option. Which leaves only DAD or LQ.

Leaf: This sounds also the same argue to the FSM (including the states =
of 'No
Bind') described in Fig.2 of RFC6620, which needs the SAVI device (or
switch) to send out DAD_NS. If we believe it sounds a wrong message, =
would you like submit a Errata for it? =EF=81=8A

[final decision]:
	(a) we will use a non-DAD NS with specified source (sorry for we do not =
find the definition for NS lookup).
	(b) Considering the l3 address problem, I propose use a "SHOULD" on the =
NS detection.=20
		As I mention above, DAD is not an alternative of LQ. It is used to =
reduce the times of LQ under attacks against local addresses.



_______________________________________________
savi mailing list
savi@ietf.org
https://www.ietf.org/mailman/listinfo/savi


