Subject: RE: Host-based may be the way to go, but network controls are neccessary

From: "Aldrin Isaac" <[email-masked]>
Date: Wed, 20 Nov 2002 16:33:05 -0500

% From: Erik Nordmark [mailto:[email-masked]]
%
% Hence my (so far) futile attempts to understand what policy
% control are needed or desired.

When I said that network controls are neccessary, I didn't mean some
complex policy server.  What I mean is that the network operator
should be able to decide which site-exits will service particular
parts of his network, and have the routing tools to forward packets to
those site exits in an optimal manner.  What I mean by optimal is (1)
no dead/stray packets (2) no timeouts (3) no IDS alarms going off
because a packet is sourced outside of what's configured in a firewall
rule,...... i.e. no guessing games on the part of the network
operator.

-- aldrin

---

From: "Aldrin Isaac" <[email-masked]>
Date: Wed, 20 Nov 2002 16:33:07 -0500

Erik,

% From: Erik Nordmark [mailto:[email-masked]]
%
% > I personally am not suggesting that a complex policy
% > function should exist for optimum address selection.
% > IMHO the network should be able to tell a host immediately
% > when it makes an unusable selection without the host
% > having to depend on time-outs.  This can be accomplished
% > simply by knowing whether a packet in transit has a valid
% > site-exit.
%
% ok
% Does the rest of the WG agree that this is sufficient?
% Or do folks want policy control for load balancing i.e.
% be able to control things even when no site exit has failed?

I think that the first steps to take are to fix certain elemental
stuff that ought to work, and then move on to much more complex stuff.
In my opinion source-based site-exit routing is elemental.  I think if
we can get past this, we will be able to see clearly enough to find a
solution to more complex needs.

%
% > Information about the lack of a valid site-exit for a
% > selected source-address should be communicated simply
% > as an ICMP unreachable message.
%
% Presumably it would be useful to understand the security
% threats beforeadvocating a particular solution. I don't
% claim to understand them - atleast not yet.

ICMP unreachables are nothing new.  When a route to a destination does
not exist it is considered unreachable.  If the network knows that a
source prefix cannot be routed to a specific destination via a
specific path, it should also be considered as unreachable.

-- aldrin

---

From: "J. Noel Chiappa" <[email-masked]>
Date: Thu, 21 Nov 2002 14:08:39 -0500

> From: Iljitsch van Beijnum <[email-masked]>

    > It's unbelievable how much work is still going on on IPv6 which by all
    > accounts should have been deployed by now. ...
    > But IPv6 is still just IPv4 with bigger addresses.

Those who have known me in the IETF over the last 10 years will no doubt be
already aware that my reaction to these comments is trying to decide whether
to emit a scream of rage, or a scream of pain! :-)

    > So what's the right thing?

Alas, there is no answer to this question in its most global sense.

I can, relatively easily, tell you how to come up with a good technical
design; e.g. take a look at:

  http://www.isi.edu/newarch/

for an effort that's doing something like this, albeit at a higher layer. The
routing stuff has been done too (although some low-level parts, such as the
packet format, would benefit greatly from being updated to the age of
photons).

What I have no idea how to do is i) get the IETF to sign onto it (been there,
done that), or, and perhaps even harder, ii) get it deployed. The vast
majority of people just seem to love incremental tweaks, and only rarely do
you get the chance to perpetrate a revolution.

    > The original TCP/IP architecture assumes that an interface on one host
    > communicates with an interface on another host, the network always
    > knows what connects where and nobody will try to disrupt all of this.
    > Today, most services run on several hosts (load balancers) or the other
    > way around (NAT). Most of the network has no idea if destinations are
    > even reachable, let alone what the shortest path is (CIDR). Every
    > aspect of the network is open to constant disruption (DDoS et al.).

Yup.

    > Routing and layer 4 and up don't do what we need them to do so an
    > architectural overhaul is certainly in order.

Agree completely. (I could be snotty and say "and the IPv6 effort should have
done this", but that wouldn't be of any use to anyone.)

Sigh, I wish I had an answer to the non-technical part of the problem for
you. But I don't. I think I'll go work on my Japanese prints for a while.

	Noel