Subject: [IPsec] I-D Action: draft-ietf-ipsecme-split-dns-04.txt

From: [email-masked]
Date: Mon, 22 Jan 2018 08:52:01 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the IP Security Maintenance and Extensions WG of the IETF.

        Title           : Split DNS Configuration for IKEv2
        Authors         : Tommy Pauly
                          Paul Wouters
	Filename        : draft-ietf-ipsecme-split-dns-04.txt
	Pages           : 11
	Date            : 2018-01-22

Abstract:
   This document defines two Configuration Payload Attribute Types for
   the IKEv2 protocol that add support for private DNS domains.  These
   domains should be resolved using DNS servers reachable through an
   IPsec connection, while leaving all other DNS resolution unchanged.
   This approach of resolving a subset of domains using non-public DNS
   servers is referred to as "Split DNS".

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-ipsecme-split-dns/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-ipsecme-split-dns-04
https://datatracker.ietf.org/doc/html/draft-ietf-ipsecme-split-dns-04

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-ipsecme-split-dns-04

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Paul Wouters <[email-masked]>
Date: Mon, 22 Jan 2018 13:49:15 -0500 (EST)

On Mon, 22 Jan 2018, [email-masked] wrote:

> Subject: [IPsec] I-D Action: draft-ietf-ipsecme-split-dns-04.txt

> https://www.ietf.org/rfcdiff?url2=draft-ietf-ipsecme-split-dns-04

This version addresses the two points raised by Paul Hoffman.

I believe this document is ready for IETF LC.

Paul

---

From: Linda Dunbar <[email-masked]>
Date: Tue, 23 Jan 2018 21:47:28 +0000

Paul,

Sorry for the late comments.

A question to your draft:

Introduction:

Is "Split DNS" less about "configuration for the secure tunnels", but more about having two zones, one to be used by the internal network, the other used by the external network?
Basically Split DNS directs internal hosts to an internal domain name server for name resolution and external hosts are directed to an external domain name server for name resolution.

Is it correct? If yes, the requests from internal network (the network within VPN) may not be via tunnel, isn't it?

Or your "split DNS" is about one DNS with some domain name resolution requests are from IPSec tunnels and others are not?

Linda

-----Original Message-----
From: IPsec [mailto:[email-masked]] On Behalf Of Paul Wouters
Sent: Monday, January 22, 2018 12:49 PM
To: [email-masked] WG <[email-masked]>
Subject: Re: [IPsec] I-D Action: draft-ietf-ipsecme-split-dns-04.txt

Paul

_______________________________________________
IPsec mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Wouters <[email-masked]>
Date: Tue, 23 Jan 2018 17:16:30 -0500 (EST)

On Tue, 23 Jan 2018, Linda Dunbar wrote:

Hi Linda,

> Introduction:
>  
> Is "Split DNS" less about "configuration for the secure tunnels", but more about having two zones, one to be used by the
> internal network, the other used by the external network?
> Basically Split DNS directs internal hosts to an internal domain name server for name resolution and external hosts are directed
> to an external domain name server for name resolution.
>  

That is correct. The initial draft did have that requirement, but Tero
pointed out correctly that you might be setting up multiple tunnels,
and in fact one might be _to_ the internal DNS server, which could
come up on demand. So we left out any restrictions of the DNS request
actually going over the initial tunnel. Image you have a configuration
for two remote subnets, 10.0.1.0/24 and 10.0.2.0/24. And your nameserver
is on 10.0.1.1. But your initial IKE_INIT/IKE_AUTH requests are
triggerd by a packer for 10.0.2.1. You would get the DNS information,
but the CHILD SA would not be covering that IP. But if you just
send a DNS packet to 10.0.1.1, the existing IKE SA would send a
CREATE_CHILD_SA to initiate a second IPsec SA for the other range.

> Or your "split DNS" is about one DNS with some domain name resolution requests are from IPSec tunnels and others are not?

The split-DNS refers to "internal only" DNS zones, that presumably are
only accessable over the remote access VPN, for which the VPN client
needs to be told about by the server which domains these are and
where to find nameservers for them and what DNSSEC key might sign
them.

Paul

---

From: Linda Dunbar <[email-masked]>
Date: Tue, 23 Jan 2018 22:55:52 +0000

Paul, 

Thank you very much for the explanation. 

I think the confusion comes from people like me who have been extensively working with MPLS VPN, with "internal network" communication not protected, whereas your draft assumes "internal network" as the one being interconnected by "IPsec" tunnel. Correct? 

Since the draft is to be read by general public once it becomes RFC, suggest you add a note to explain your "internal network". 

Linda

-----Original Message-----
From: Paul Wouters [mailto:[email-masked]] 
Sent: Tuesday, January 23, 2018 4:17 PM
To: Linda Dunbar <[email-masked]>
Cc: [email-masked] WG <[email-masked]>
Subject: Re: [IPsec] I-D Action: draft-ietf-ipsecme-split-dns-04.txt

Hi Linda,

> Introduction:
>  
> Is "Split DNS" less about "configuration for the secure tunnels", but 
> more about having two zones, one to be used by the internal network, the other used by the external network?
> Basically Split DNS directs internal hosts to an internal domain name 
> server for name resolution and external hosts are directed to an external domain name server for name resolution.
>  

That is correct. The initial draft did have that requirement, but Tero pointed out correctly that you might be setting up multiple tunnels, and in fact one might be _to_ the internal DNS server, which could come up on demand. So we left out any restrictions of the DNS request actually going over the initial tunnel. Image you have a configuration for two remote subnets, 10.0.1.0/24 and 10.0.2.0/24. And your nameserver is on 10.0.1.1. But your initial IKE_INIT/IKE_AUTH requests are triggerd by a packer for 10.0.2.1. You would get the DNS information, but the CHILD SA would not be covering that IP. But if you just send a DNS packet to 10.0.1.1, the existing IKE SA would send a CREATE_CHILD_SA to initiate a second IPsec SA for the other range.

> Or your "split DNS" is about one DNS with some domain name resolution requests are from IPSec tunnels and others are not?

The split-DNS refers to "internal only" DNS zones, that presumably are only accessable over the remote access VPN, for which the VPN client needs to be told about by the server which domains these are and where to find nameservers for them and what DNSSEC key might sign them.

Paul

---

From: Paul Wouters <[email-masked]>
Date: Thu, 25 Jan 2018 09:42:12 -0500 (EST)

> Since the draft is to be read by general public once it becomes RFC, suggest you add a note to explain your "internal network".

I will talk to Tommy and see about if we should clarify this some more
in the introduction of the document.

Thanks,

Paul

> [email-masked]