Subject: Re: An idea: GxSE

From: [email-masked] (Sean Doran)
Date: Wed, 27 Jun 2001 00:46:25 +0200 (CEST)

Jon (Taz) Mischo <[email-masked]> writes:

| This is similar to the idea I had expressed.

Let me see if I understand where you're headed.

1. split v6 address into two components:
	"SK" - unique and end-to-end
	"GR" - shared and local

2. The unique and end-to-end component corresponds to "who", as in
   "who is it that originated this packet" (satisfying Vixie) or as
   in "who is at the receiving end of this packet" (satisfying demulti-
   plexing)

3. The other component corresponds to "where", as in "where in the
   (local) topology can I find a hop much closer to my desired destination".
   IOW, "where" is a forwarding instruction for LOCAL routers that help
   them get towards the unique "who".

4. The forwarding instruction may cause _routers_ to do any number of things:
	discard packet (with or without signalling an error)
	forward a packet out a particular interface
	swap "labels" - forward out a particular interface but with a 
            new forwarding instruction	
        
5. Should _hosts_ which are not also routers EVER look at GR?  Why?
   What should the host expect of a non-unique locally-scoped address
   component?

6. Should _routers_ ever touch the SK ("who") component?
   By "touch" I mean (a) mutate or (b) examine.
   The simple case for (b) is when the host examines SK to determine if
      the packet is addressed to the router itself.

5&6 go to the heart of the end-to-end against NAT argument,
and I would be curious to see if any kind of consensus can be
formed among the people with very strong (and opposite) views
who are here on this list.

I would also be interested in the input of host and router vendors
who have some experience in implementing a variety of protocols.

	Sean.

---

From: "Jon (Taz) Mischo" <[email-masked]>
Date: Tue, 26 Jun 2001 23:50:06 -0500 (CDT)

> 	"SK" - unique and end-to-end

Correct.

>    in "who is at the receiving end of this packet" (satisfying demulti-

Indeed.

>    them get towards the unique "who".

Slight clarification.  Local isn't the right word here.  The SK portion
would be local i.e. behind the remapping.  GR would be used in front of
the GR remapping.  GR is used to tell the rest of the world how to get to
the SK address via announcements.  There may be more than one valid GR/SK
pair announced.  To the non-GxSE site, these look like multiple addresses
for the same host, to the GxSE site, they look like multiple paths to the
same host.  As such, it is similar to landmark routing in that it tells
any router along the way how to get closer to the SK address.  Except for
where rewriting occurs, however, this is fairly fixed (standard routing
behavior).  This is only variable when inside an administrative domain
that maintains GR/SK pair mappings and has the authority to remap said
address.  In that case, the GR can be re-written to control the behavior
between the host and the rewriting router, but only within the same
domain.  In other words, you can't redirect someone else's traffic.  If
you announce a set of viable GR/SK pairs to the world, someone else can't
announce different GR's for your SK's globally.  They could, however,
remap within their own administrative domain, allowing them to control
your path via rules instead of via metrics, for instance.

>             new forwarding instruction	

Yes and no.  You're treading on thin ice there.  You're almost discussing
MPLS.  This is, however, different than MPLS.  There is no label stacking,
and thus you are limited in your remapping, unless you distribute your
mappings within your own AD.  You cannot announce your mappings unless you
have authority over the SK.

>    What should the host expect of a non-unique locally-scoped address

The GR would be unimportant to the host.  However, this can be done in a
manner to hide the GR mappings from the host.  A non-unique locally scoped
address should not be affected, as we are interested in unique addresses
only.  

>       the packet is addressed to the router itself.

(a) No, NEVER.  If the SK is compromised, you have lost all the value of
using GxSE.
(b) Sometimes.  If a router examines the GR and sees that it is
autoritative for that GR, it would examine the SK to determine where to
route the packet within the AD.

> who are here on this list.

GxSE and NAT are mutually exclusive technologies.  GxSE as I envision it
takes the good things from NAT and mates them with end-to-end and routing
concepts.  NAT is much abused today.  It was originally designed to deal
with ISPs that didn't have the address space to allocate enough IP
addresses, or had policies against doing so.  It was a way for people to
get around these problems.

GxSE is the next logical step in evolution from NAT.  It provides a way to
deal with globally scoped unique addresses that allows for multihoming.  
IPv6 takes away some of the constraints that created NAT, though many
people seem to think it is important for security.  And it is, if you
don't know how to write network policies.  Of course, it is hardly "safe."

Naturally, people will want to NAT GxSE.  This is evil.  It should be
avoided.

> who have some experience in implementing a variety of protocols.

-Jon

-- 
        "Be liberal in what you accept,
      and conservative in what you send."
--Jon Postel (1943-1998) RFC 1122, October 1989

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 27 Jun 2001 11:52:22 -0500

"Jon (Taz) Mischo" wrote:

...
> GxSE and NAT are mutually exclusive technologies.

I once characterised 8+8 as "architected NAT", and both GSE and GxSE 
fall into that category - essentially by clearly separating the mutable
(locator) part from the immutable (identifier) part. I suspect that
this separation will turn out to be a required property of the multi6
solution, and there are a number of ways to achieve it.

   Brian

---

From: "Jon (Taz) Mischo" <[email-masked]>
Date: Wed, 27 Jun 2001 13:55:15 -0500 (CDT)

> solution, and there are a number of ways to achieve it.

Agreed, I was saying that just to prove how opinionated I am on the
subject.  If you read on, though, I THINK I wrote that GxSE basically
takes lessons learned from NAT and applies them and multihoming practices
to v6.  This may, however, be what I forgot what I was writing the above.

I'm really just trying to say that GxSE is being discussed as a way to
avoid having to use true NAT (where the entire address is translated, as
is the definiteion of NAT) by making a similar mechanism part of the
addressing scheme natively.

-Taz

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 27 Jun 2001 15:20:52 -0500

> addressing scheme natively.

Agreed. I'm not sure the GxSE is the best way to achieve this - once we have
the requirements agreed, we need to inspect all the possible solutions
carefully (including ones we haven't even talked about yet).

   Brian