Subject: RE: WG next steps

From: "Christian Huitema" <[email-masked]>
Date: Fri, 15 Nov 2002 09:00:10 -0800

> > It is undesirable for a large enterprise to use a multi-address/host
> based
> > solution without a mechanism to interact with the network topology
to
> > perform path selection.  Network operators know more about the
viability
> > of paths (whether by technology or manual policy) than the hosts do.
> > Left-side longest-match is hardly a sufficient routing protocol
and/or
> > policy control for a multi-provider topology like the Internet.  The
> > network *MUST* be a part of the solution -- enterprises want policy
> > control, and policy control should be centralized.
> 
> Succinctly put.  However I don't think size matters as much as does
the
> existence of policy.  Only the hardware/software/wetware at the edge
of
> the
> enterprise is likely have the necessary information to enable rational
> path
> (and, therefore, source and destination address) selection.

I would not be so sure about "rational". There is some documented
evidence that the path selected by the routing fabric is often not the
shortest route between two points; this is easy to understand because
BGP is about policy, not metrics; the interference between PBG policies
and multi-homing can be interesting, to say the least. The routers have
some information, and will probably detect unreachability faster than
the host; on the other hand, the host is likely to get better
information about available capacity and round trip time. Regardless,
the real question there is how to affect source and destination address
selection in a rational way. 

There is an existing mechanism to convey information from router to
host, the router advertisements; it can be used, at a minimum, to prefer
the source prefixes that correspond to functional providers over those
for which connectivity has been lost; it is easy to use this mechanism
in a single link network; using it in a more complex network requires
exchange of information between the site routers. If that mechanism is
not sufficient, nothing prevents us from designing a better one,
possibly some variation of ICMP Redirect between site exit routers and
host on the site.

-- Christian Huitema

---

From: Masataka Ohta <[email-masked]>
Date: Sun, 17 Nov 2002 02:04:38 +0859 ()

> and multi-homing can be interesting, to say the least.

OK. It's BGP.

> host, the router advertisements; it can be used,

It can't be, because plain non-BGP routers has nothing to do with
the policy.

> If that mechanism is
> not sufficient,

Router advertisement is totally useless, because its basic idea
voilates the end to end principle to let intermediate routers
access more information than end hosts.

> nothing prevents us from designing a better one,

No. The mechanism is already there and called routing protocols.

						Masataka Ohta

---

From: "Michael H. Lambert" <[email-masked]>
Date: Sat, 16 Nov 2002 12:58:47 -0500

> No. The mechanism is already there and called routing protocols.

Why does this not imply that each host in a multi-homed site would have to 
participate in the site's IGP?  I see no fundamental difference between a 
host's selection of which address to use on a given interface vs which 
interface to use (if homed to different physical subnets).

Michael

+-----------------------------------------------------------------------+
| Michael H. Lambert, Network Engineer           Phone: +1 412 268-4960 |
| Pittsburgh Supercomputing Center               FAX:   +1 412 268-8200 |
| 4400 Fifth Avenue, Pittsburgh, PA  15213       [email-masked]        |
+-----------------------------------------------------------------------+

---

From: Masataka Ohta <[email-masked]>
Date: Sun, 17 Nov 2002 03:36:23 +0859 ()

Michael;

> participate in the site's IGP?

The end to end principle implies that each host should have
all the information and should receive IGP.

Routers are still allowed to convert format of IGPs for hosts
not to be able to understand new ones.

							Masataka Ohta

---

From: Eliot Lear <[email-masked]>
Date: Sat, 16 Nov 2002 11:17:02 -0800

Ohta-san,

One could argue this from an academic point of view, and I could also 
argue that it holds true in certain high end configurations, but forcing 
end hosts to participate in the IGP is in general a bad idea for certain 
practical reason:

OSPF requires that nodes not filter the database.  It does this so that 
no matter how a node receives the database it will be consistent, the 
goal being quick convergence.  Realistically an enterprise administrator 
cannot allow the potential for meddling that an end host can cause, say, 
by declaring itself an ABR to a new area 0.

OSPF itself (nor any other routing protocol I know today) provides no 
object level security, and so all updates must be taken at face value 
from authenticated sources.  The impact on distance vector protocols is 
less because you can filter, but there are other problems withn DV (or 
for that matter PV).

In addition, any requirement to change the paramaters of the routing 
system would require that those changes be propagated not just to the 
routers but all the way to every end host systems, causing a system 
administration nightmare in large systems.  In particular, any change of 
timing parameters or area assignment would prove difficult.  One of the 
  commonly preferred IGPs doesn't even use IP, requiring all sorts of 
additional configuration.

The general case, therefore, is that end systems will NOT participate in 
a routing system.  Now, perhaps they would use some sort of request 
response protocol to retrieve routing direction, but that should be the 
extent of it, and it's still not clear that's a good idea.

A reasonable question to ask is whether the IGP/EGP split is the correct 
one these days, as lots of policy is lost in the conversion.

Eliot

---

From: Masataka Ohta <[email-masked]>
Date: Sun, 17 Nov 2002 04:28:11 +0859 ()

Eliot;

> end hosts to participate in the IGP is in general a bad idea for certain 

I didn't say "participate".

							Masataka Ohta