Subject: Issue 21: RA source is Link Local

From: "James Kempf" <[email-masked]>
Date: Mon, 25 Aug 2003 10:03:09 -0700

RFC 2461 requires that RAs be sent with a Link Local address. Issue 21 is
whether the same restriction should be put on DCA.

Proposed solution: yes.

Comments?

            JAK

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: Greg Daley <[email-masked]>
Date: Tue, 26 Aug 2003 16:02:05 +1000

Hi James,

> whether the same restriction should be put on DCA.

I've got some odd ideas for wanting to do DCA
from off-network, but understand that in general
on-link only is best.

Is there any effective difference between requiring
link-local and requiring ttl of 255 (with LL or global)?

Greg

---

From: "James Kempf" <[email-masked]>
Date: Tue, 26 Aug 2003 08:56:34 -0700

> link-local and requiring ttl of 255 (with LL or global)?

TTL of 255 and dropping any received packet with a TTL less than that will
effectively limit to on link. Link local addresses are an additional
mechanism for that, and having DCA use them is consistent with RFC 2461,
which is why it is being recommended.

In general, I'm not sure it is advisable to do DCA from off-link. There is
an issue with fragmentation. Certs tend to be large, and if they are sent
using UDP multihop, they can get fragmented and dropped by routers that
don't handle fragmentation properly, which typically isn't a problem with a
single link. This problem occurs frequently with IKE, for example, and the
IPsec WG has yet to face up to how to handle it. The design team discussed
whether to put in mechanism to handle fragmentation or certificate
compression, but it would make DCA much more complicated, and it is not
clear at this point whether the extra complication is necessary, if the off
link uses result from only 10% of the cases. If they are more like 50%, we
can put in fragmentation support later.

            jak

---

From: Greg Daley <[email-masked]>
Date: Mon, 01 Sep 2003 10:44:54 +1000

Hi James,

James Kempf wrote:
>>>RFC 2461 requires that RAs be sent with a Link Local address. Issue 21
>>
> is
> 

I think consistency is valid, considering that
we're aiming at interworking with existing ND
solutions (although this is a new message).

I'd prefer that there's really only one mechanism
required to ensure link-only reach of the DCA, though,
if it is sufficient.

Guaranteeing this with hop count 255 may be so.

Whether the address is link-local seems to be
less relevant for that purpose.

> can put in fragmentation support later.

Thanks, It's nice to know some additional issues
here.

I must admit that I haven't looked at the draft recently
though, and were unaware that we were talking about using
UDP (although the same is likely to apply to other Datagram
oriented communications).

Certainly, we don't want to overcomplicate DCA or SEND.
I'm not going to propose any odd ideas like this
until the RFC comes out, and I still think the odd ideas
would work.

Greg