Subject: RE: IPv6 Home Use to stimulate deployment over IPv4-NAT

From: "Bound, Jim" <[email-masked]>
Date: Thu, 13 Feb 2003 11:41:16 -0500

Tony,

I will build different solution other than Teredo.  Teredo is to complex
and breaks a 2 rules for me I use as network engineer/architect for
v6ops solutions. 1) We should NEVER use or access port numbers to get
things done but only use the IP header whereever possible.
2)Client/Server protocol soulutions should only be developed for v6ops
solutions, where the client and server are in the same network domain.
Teredo breaks both of these principles for me.

ISATAP is to robust for home use and I do not see it being used there at
this time. I do see it in other environments for sure (e.g. Military,
Manufacturing, Robotics, and a few others I know interested in ISATAP).

The home user scenario is clear and well understood. 

The solution I will proprose will cause NO changes to the client code
and will exist in the NAT and POP.  The idea is to view it as NAT+IPV6
not working around NAT.  This has been an error in our thinking model
(mine included).  The solution will drive as the underlying end
mechanisms to either be Native IPv6 or 6to4 which are cohesive also with
v6ops direction and current work.  Note Teredo and ISATAP are not at
this time.  I will suggest it and bring it as idea and solution IETF can
reject it if it is not good, whether it is used is another matter. I
only say that because this is a real deployment problem for home use.  

I am now going to propose to a few providers to get feedback (my own
included in NH) and a few home router vendors that we are building
connections to via the IPv6 Forum. This will take me some time.

P.S. If anyone here on the list is interested in working on this let me
know and there are others not on this list.  thanks

Regards,
/jim

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 13 Feb 2003 14:55:33 -0800

Bound, Jim wrote:
> ...
> I will build different solution other than Teredo.  Teredo is 
> to complex and breaks a 2 rules for me I use as network 
> engineer/architect for v6ops solutions. 1) We should NEVER 
> use or access port numbers to get things done but only use 
> the IP header whereever possible. 

Well it is arguable that teredo violates this rule, since the origin
application port is not referenced. The fact that it uses the available
port id bits in the IPv4-UDP encapsulation header to construct the IPv6
address is really a function of the application in the encapsulating
endpoint. 

> 2)Client/Server protocol 
> soulutions should only be developed for v6ops solutions, 
> where the client and server are in the same network domain. 

While this may be a reasonable restriction for a corporate marketing
decision, it makes no sense for a standards effort. The whole point for
people to move to IPv6 is so that there are no topological restrictions
placed on nodes, particularly servers. If one required all servers to
live in the same domain as their clients, all web access would require a
proxy. v6ops needs to be about building the infrastructure tools and
configurations so that IPv6 applications are unaware of the activities
going on at the packet handling level. 

> ISATAP is to robust for home use and I do not see it being 
> used there at this time. I do see it in other environments 
> for sure (e.g. Military, Manufacturing, Robotics, and a few 
> others I know interested in ISATAP).
> 
> The solution I will proprose will cause NO changes to the 
> client code and will exist in the NAT and POP.  The idea is 
> to view it as NAT+IPV6 not working around NAT.  This has been 
> an error in our thinking model (mine included). 

Well, it is exactly the model of 6to4. You are adding the wrinkle of the
home edge being behind a nat, which tunnel broker deals with.

>  The solution 
> will drive as the underlying end mechanisms to either be 
> Native IPv6 or 6to4 which are cohesive also with v6ops 
> direction and current work.  Note Teredo and ISATAP are not 
> at this time.  I will suggest it and bring it as idea and 
> solution IETF can reject it if it is not good, whether it is 
> used is another matter. I only say that because this is a 
> real deployment problem for home use.  

Yes and no. Yes the case exists where a home edge nat/router is behind a
nat, and we need a solution, but no we can't assume that even the home
edge nat is upgradable, as in docsis cable modems. The fact that v6ops
is too highly focused on router upgrade solutions is due to the lack of
appreciation for the breadth of the problem space. The whole point of
the scenario design teams was to provide descriptive documents to help
educate about this breadth, but several vocal participants have chosen
to dismiss them as out of line with a directive that all deployments
must fit a single mold. 

> 
> I am now going to propose to a few providers to get feedback 
> (my own included in NH) and a few home router vendors that we 
> are building connections to via the IPv6 Forum. This will 
> take me some time.

I am not going to discourage new concepts, but take a hard look at the
identity/allocation issues that are solved in tunnel broker, and make
sure any new approach works at least that well.

Tony

> 
> P.S. If anyone here on the list is interested in working on 
> this let me know and there are others not on this list.  thanks
> 
> Regards,
> /jim
>

---

From: Alain Durand <[email-masked]>
Date: Fri, 14 Feb 2003 16:47:59 -0800

Jim,

I like your idea. A lot.
the issue I have with solution like teredo is that they are
initiated by the end nodes. The implications are:
1- all end node needs to understand this protocol
2- it becomes difficult for the acess router/firewall
   to enfore any kind of policy on what traffic is acceptable
   A knob that says 'enable IPv6' is just not enough.
   We need solutions that enable the user to express easily the same
   security policy in v4 and v6.

Those are the reasons why I think that 'IPv6 connectivity' is
a functionality that has to be provided by an access router
and not by the end hosts.
.
The nice thing about this is that it would work
the same way in case of simple NAT (the exit router
is given a public IPv4 address) and double NAT
(the exit router is given a private address)
but tunneling over UDP.

                    v4 Internet
                        |
                        |
                        |
 
                       CPE           <--- v4 external address can be either
                 v4 acces router          global or private (double NAT)
                     v4 NAT
                 v6 access router
              (Tunnel Broker client)
                        |
                        |
          ------------------------------------------   Home lan
                               |           |
                             Host1       Host2
               
Even better, this could be implemented on a different
box than the actual v4 exit router!
The connection scenario would then be the following:

                    v4 Internet
                        |
                        |
                        |

                       CPE
                 v4 acces router
                     v4 NAT
                        |
                        |
          ------------------------------------------   Home lan
              |                |           |
           v6 access         Host1       Host2
             router
      (Tunnel Broker client)

That way folks who do not want to (or can not)replace their CPE
just have to add another box in the home network to provide
v6 connectivity to the entire home lan.

Now, as it has been pointed out, this is a typical case
where the access router is a client to a tunnel broker.
The question is what can we do to simplify the tunnel
set-up from the router to the tunnel broker.
If we decide to go that route, a tunnel set up protocol
like the one Marc Blanchet was suggesting now become
a interesting solution

The configuration of the v6 access router would require:
- providing the IPv4 address (or name) of the IPS Tunnel Broker
- providing the credentials negatiated out of band with the ISP (e.g. 
username/passwd)
- specifying the encapsulation mode: IPv6/IPv4 or IPv6/UDP/IPv4 or 
IPv6/PPP/IPv4
- specifying the IPv6 security policy

Yes, there is manual configuration involved, but I think it is minimal
and not too different to what home users do today to configure their
DSL router.

    - Alain.

---

From: "Antonio F. Gómez Skarmeta" <[email-masked]>
Date: Sat, 15 Feb 2003 17:53:13 +0100

>   security policy in v4 and v6. 

  I will also like this idea.

> like the one Marc Blanchet was suggesting now become

  This was something we have been looking within projects like Euro6IX 
and the idea of a set up protocol and an easy to manage tunnel-broker 
solution will be really valuable and I think we will be interested in 
collaborate

-- 
------------------------------------------------------------
Antonio F. Gómez Skarmeta
Dept. Ingeniería de la Información y las Comunicaciones
Facultad de Informática
Universidad de Murcia
Apartado 4021
30001 Murcia
Telf: +34-968-364607
fax: +34-968-364151

---

From: "Jeroen Massar" <[email-masked]>
Date: Sun, 16 Feb 2003 15:18:28 +0100

Alain Durand wrote:

<SNIP>

> v6 connectivity to the entire home lan.

Which one can do now by simply installing eg the freenet6 client
onto one of the existing windows/*nix boxes which will advertise
the IPv6 prefix onto the local subnet. The only trick here is
to have the CPE forward proto-41 to your v6-gate or using Teredo.
Btw 'just have to add' is sometimes expensive for some people.

> and not too different to what home users do today to configure their

Which would usually result in a clickety-click Windows interface to
configure one of the machines to be the gateway.
Which should be doable for most users as long as there is some nice
document available with per-dialog screenshots. Then again... ;)
One thing that must be done in these clients is to check wether
there is native connectivity already because if there is one should
not be using a tunnel (6in4,6to4,isatap,teredo,...).

Greets,
 Jeroen

---

From: Tim Chown <[email-masked]>
Date: Sun, 16 Feb 2003 17:58:37 +0000

> Btw 'just have to add' is sometimes expensive for some people.

This is what our IPv6 students tend to do in their homes.  It works nicely, 
but still requires a tweak in the DSL router.

Tim

---

From: "JORDI PALET MARTINEZ" <[email-masked]>
Date: Sun, 16 Feb 2003 19:54:55 +0100

I've observed, that in most of the cases, a NAT box forwards proto-41 as any other UPD or TCP traffic, so I can use my IPv6
elsewhere ... In my home, hotels, conferences, ...

In my case never requires changing my DSL router configuration, but I agree that if the hotel is filtering proto-41, I will not be
able to change it either ;-)

Regards,
Jordi

----- Original Message -----
From: "Tim Chown" <[email-masked]>
To: "Jeroen Massar" <[email-masked]>
Cc: "'Alain Durand'" <[email-masked]>; "'Bound, Jim'" <[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Sunday, February 16, 2003 6:58 PM
Subject: Re: IPv6 Home Use to stimulate deployment over IPv4-NAT

> but still requires a tweak in the DSL router.

*********************************
Madrid 2003 Global IPv6 Summit
12-14 May 2003 - Pre-register at:
http://www.ipv6-es.com
Interested in participating or sponsoring ?
Contact us at [email-masked]

---

From: "Jeroen Massar" <[email-masked]>
Date: Sun, 16 Feb 2003 20:15:37 +0100

JORDI PALET MARTINEZ [mailto:[email-masked]] wrote:

> I've observed, that in most of the cases, a NAT box forwards 
> proto-41 as any other UPD or TCP traffic, so I can use my IPv6

I wonder to which box (IPv4) behind the NAT it is forwarding
the proto-41 packets then. Unless you configured a default/unmatched
target ofcourse. But then you already configured it correctly ;)

> In my case never requires changing my DSL router 
> configuration, but I agree that if the hotel is filtering 
> proto-41, I will not be able to change it either ;-)

If you are in a hotel you won't have any access to the CPE either.
And the CPE won't know what to do with the proto-41 packets when
it reaches it then. But that's why we've got Teredo. Though one
can always ask himself if it where a policy decision for not
having IPv6 in their network but let's not go there...

Greets,
 Jeroen

> Cc: "'Alain Durand'" <[email-masked]>; "'Bound, Jim'" 
> <[email-masked]>; <[email-masked]>; <[email-masked]>

---

From: "JORDI PALET MARTINEZ" <[email-masked]>
Date: Sun, 16 Feb 2003 20:35:11 +0100

No ... any host behind the NAT works fine.

You can create several tunnels, each one to a different host, and it works, but what I unusually do is:

1) 1 host acts as the IPv6 router, including RA (usually my own PC, if in a conference, or my web/email server in my home).
2) All the local-link IPv6 traffic goes to the host in 1)
3) The host in 1) send it to the DSL/NAT box, as payload of IPv4 packets
4) The NAT box forwards the traffic to the correct host (1), because he only see IPv4 ...

The point is that the NAT box isn't configured in any special way, just needs to keep forwarding proto-41, not just UPD/TCP/ICMP.

You only need to configure the tunnel and RA in one host (1) behind the NAT box.

I found some (I will not mention here), that only forward UDP/TCP/ICMP, so then, it doesn't works.

Regards,
Jordi

----- Original Message ----- 
From: "Jeroen Massar" <[email-masked]>
To: "'JORDI PALET MARTINEZ'" <[email-masked]>; <[email-masked]>
Cc: "'Alain Durand'" <[email-masked]>; "'Bound, Jim'" <[email-masked]>; <[email-masked]>
Sent: Sunday, February 16, 2003 8:15 PM
Subject: RE: IPv6 Home Use to stimulate deployment over IPv4-NAT

Greets,
 Jeroen

---

From: Carlos Friacas <[email-masked]>
Date: Tue, 18 Feb 2003 17:44:51 +0000 (WET)

Hello.

Last week you showed at a conference a v6 tunnel over v4, when you had
native v6.

The roundtrip times you showed on a traceroute left some people in the
audience yellow-faced...

One thing to have in mind in the future *for you*: check if you have
native v6 available.

One thing to have in mind *for me* in the future: filter port 41 on a dual
stack interface, to avoid the kind of "stunts" people sometimes do... :-)

Regards,

./Carlos
                                                          "Networking is fun!"
--------------         [http://www.ip6.fccn.pt]            http://www.fccn.pt
<[email-masked]>, CMF8-RIPE, CF596-ARIN, Wide Area Network Workgroup
F.C.C.N. - Fundacao para a Computacao Cientifica Nacional  fax: +351 218472167

---

From: "JORDI PALET MARTINEZ" <[email-masked]>
Date: Tue, 18 Feb 2003 19:03:23 +0100

Hi Carlos,

As you can imagine, I did a tunnel only because the native IPv6 was not working for me. I learn, as a first lesson, to see if there
is a RA in the network before I do my own one !

I even asked, and they told me that ONLY v4 was available in that network.

In fact I show to some people from the organization that curiously, v4 was not working also. I got an address assigned by DHCP, but
no way to use web or pop3/smtp. Some other people experienced the same problem, so I guess it wasn't my own computer.

So I tried my own tunnel, and it worked. If you filter port 41, that's still fine for me (unless you mean proto-41).

Obviously the round-trip was not good, but it was due to the network configuration itself, as I was doing a ping to my tunnel end.
If I ping with v4, the round trip must be almost the same !

Anyway, I tried to show that even when IPv4 is not working, I can use IPv6, and that's was a real situation ... I prefer to have a
slower connectivity that _nothing_.

Clearly we must improve this, but this is what we are working now, here in this group.

I prefer to show the people the true, not just telling them everything is wonderful and we have nothing to do. I'm sure other people
is in the same side.

Regards,
Jordi

---

From: Carlos Friacas <[email-masked]>
Date: Tue, 18 Feb 2003 18:39:47 +0000 (WET)

Hello.

> is a RA in the network before I do my own one !

Perhaps your problem was there were several on the link. :-)
Miguel from University of Evora noticed that while he was trying to bring
the Isabel connection up.

> I even asked, and they told me that ONLY v4 was available in that network.

Sorry. :-(
Probably you were misinformed. There was a note on the reg.desk

> no way to use web or pop3/smtp. Some other people experienced the same problem, so I guess it wasn't my own computer.

This was tested ok by our local network folks, that installed the AP, and
nobody else complained. Strange at least.

> So I tried my own tunnel, and it worked. If you filter port 41, that's still fine for me (unless you mean proto-41).

typo... s/port/proto :-)

> If I ping with v4, the round trip must be almost the same !

If you were not able to do simple web browsing over v4, you were very
lucky to be able to do v6 over v4. So this proofs v4 was working, no?
That LAN is becoming a "case-study"... :-)

> slower connectivity that _nothing_.

If v4 was not working you couldnt have found your other tunnel end
magically... :-)

> I prefer to show the people the true, not just telling them everything
> is wonderful and we have nothing to do. I'm sure other people
> is in the same side.

The truth about that particular meeting is that nobody showed up with
*any* traffic graphic, even a graphic populated with data generated by
test-traffic not users. That was really a deception for me.

Another deception was not seing the ISABEL aplication working. I had
spent some hours in the previous days troubleshooting ipv6 bgp4+ with
people from PTInovacao in order to setup the connectivity to euro6ix, and
at the end it was not possible to bring the application up due to a
congestion in Madrid. It was a real frustration and it stopped us to show
something really running on top of v6. :-(

Regards.

./Carlos
                                                          "Networking is fun!"

---

From: "JORDI PALET MARTINEZ" <[email-masked]>
Date: Tue, 18 Feb 2003 20:02:24 +0100

Carlos,

As I explained there, I can use v4 with some protocols and destinations, may be it was a combination of firewall/filter+routing
problem, not sure, but for sure I was able to bring up the tunnel and then I started to work almost normally (but with v6), I even
gained access to our streaming server, under test.

It was also pity for me not being able to show the Isabel application, but as you know the people that setup it, had only a couple
of days to try to sort out all the problems, and it was impossible to setup it w/o disturbing the running sessions, connecting 25
sites across the world (they worked perfectly). Next time !

Regards,
Jordi

---

From: Carlos Friacas <[email-masked]>
Date: Wed, 19 Feb 2003 12:36:21 +0000 (WET)

Hello.

> gained access to our streaming server, under test.

No firewall there, the routing (v4 and v6) was ok.
As i said, this network is transforming itself on a "case-study". :-)
It was very unfortunate that you were not able to show anything from your
streaming server.
Perhaps the 2Mbps between FCCN and Euro6IX PoP in Lisbon was not enough.
:-(

> It was also pity for me not being able to show the Isabel application,
> but as you know the people that setup it, had only a couple
> of days to try to sort out all the problems, and it was impossible to
> setup it w/o disturbing the running sessions, connecting 25

Circuit dimensioning problem (bugs in planning). I was told that Isabel is
really a bandwidth hog. Sometimes just having a good intention and
throwing it around is not enough *sigh* :-(

I have some questions about Euro6IX too. Do you have the time to answer
them Jordi?

Regards.

./Carlos
                                                          "Networking is fun!"

---

From: "JORDI PALET MARTINEZ" <[email-masked]>
Date: Wed, 19 Feb 2003 13:51:15 +0100

Ok. Let's conclude here or somebody will complain about being "off-topic".

I can reply you about Euro6IX, of course, but better in private ?

Regards,
Jordi

----- Original Message -----
From: "Carlos Friacas" <[email-masked]>
To: "JORDI PALET MARTINEZ" <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, February 19, 2003 1:36 PM
Subject: Re: IPv6 Home Use to stimulate deployment over IPv4-NAT

> > > > As you can imagine, I did a tunnel only because the native IPv6 was not working for me. I learn, as a first lesson, to see
if
> > there
> > > > In fact I show to some people from the organization that curiously, v4 was not working also. I got an address assigned by
DHCP,
> > but
> > > > Obviously the round-trip was not good, but it was due to the network configuration itself, as I was doing a ping to my
tunnel
> > end.
> > > > Anyway, I tried to show that even when IPv4 is not working, I can use IPv6, and that's was a real situation ... I prefer to
have
> > a