Subject: RE: [Tsvwg] RE: multihoming issues via SCTP

From: Coene Lode <[email-masked]>
Date: Wed, 12 Sep 2001 16:35:11 +0200

<snip> <snip>
 alot of stuff deleted
<>snip<>

>
> 
> 	By the way Lode, wouldn't it be interesting including something
> about the use of IPsec in the draft and the problems with it regarding
> multiple addresses?

There is a mention of it in the applicability statement(that Ipsec is
looking into the matter). And it should normally be mentioned also in the
specific IPsec and SCTP draft in the IPsec WG(forgot the draft name) Oh got
it:
   draft-ietf-ipsec-sctp-01.txt
Oh boy, another one to read.     

> 	BR Iván Arias Rodríguez

But no problem, if you sent something I'll be more than happy to include it.

Yours sincerly,
Lode

---

From: "Christian Huitema" <[email-masked]>
Date: Wed, 12 Sep 2001 12:26:03 -0700

> > I would rather look for a solution to ingress filtering that only
> > involves the site exit routers and the hosts. An example may be a
> mesh
> > of tunnels established between the exit routers, so that packets can
> be
> > redirected to the right exit.
> 
> And what if this exit happens to be down?
> 
> Wouldn't it be easier to just allow all addresses in all filters at
> all
> exits? Source address filtering is a means to an end, not an end in
> itself.

Yes, that is also a very good option. But you have to understand the
ramification, e.g. if source address filtering was to be performed
further up in the network.

-- Christian Huitema

---

From: "Christian Huitema" <[email-masked]>
Date: Thu, 13 Sep 2001 08:43:33 -0700

> > Are you suggesting that we modify all IPv6 routers to implement
> source
> > based routing?
> 
> I should point out that the use of non-global scoped addresses will
> utilize a form of source-based routing already...
> 
> This is all documented in the scoped addressing architecture document
> draft-ietf-ipngwg-scoping-arch-02.txt.

Enforcing scope boundaries is not the same as source based routing; it
is source based access control. There is still only one routing table;
packets going to a given prefix follow a route that is independent of
the source address; they are just dropped somewhere in the middle of
that route if they are not authorized to cross a boundary.

-- Christian Huitema