Subject: Re: [v6ops] default LAN routing protocol for IPv6 CE router

From: Lorenzo Colitti <[email-masked]>
Date: Mon, 1 Aug 2011 12:20:30 -0400

On Sun, Jul 31, 2011 at 10:38, Brzozowski, John <
[email-masked]> wrote:

> The outer most router supports DHCPv6 PD (LAN side).  It would have to be
> seeded with adequate address space to serve up IA_PD (and possibly IA_NA)
> for downstream routers.  Based on conversations to date I assume there
> would be interest in downstream routers also support and being able to
> delegate prefixes?
>

There are two issues I see with DHCPv6 PD to distribute prefixes inside the
home:

1. Prefix delegation only really works in a tree topology, so when the user
plugs things in wrong (e.g., plugs a LAN port into another LAN port, or
creates a loop) it won't work. Having a routing protocol will allow things
to work regardless of how the user plugs things in.
2. We already use PD between the home network and the ISP. If we use it
inside the home as well, then a home router getting a prefix via DHCPv6 PD
will not know whether it is connected to the ISP or not, and thus if it
should turn on the firewall or not.

Both of these issues can be solved by using an IGP.

Cheers,
Lorenzo

---

From: Philip Homburg <[email-masked]>
Date: Mon, 01 Aug 2011 18:44:05 +0200

>to work regardless of how the user plugs things in.

I guess that can be solved by having a router only relay DHCP requests 
upstream according to its routing protocol's definition of upstream.

I.e. a router first requests prefixes for its networks, but doesn't relay
anything yet. Then when it can figure out where the DHCP server is,
it relays towards the DHCP server.

>should turn on the firewall or not.

If a home router only hands out /64s to other routers then routers can take
getting something bigger than a /64 as a hint that they should enable the
firewall and become a DHCP server themselves.

---

From: Lorenzo Colitti <[email-masked]>
Date: Mon, 1 Aug 2011 10:20:03 -0700

> firewall and become a DHCP server themselves.

What if the ISP only hands out a /64 (like mine does)? Disable the firewall?

---

From: Philip Homburg <[email-masked]>
Date: Mon, 01 Aug 2011 20:40:30 +0200

>What if the ISP only hands out a /64 (like mine does)? Disable the firewall?

In that case you would be out of luck. No way to do any kind of subnetting
within the standard and no firewall as well :-) 

But seriously. Inventing a firewall control option for DHCP is not that hard
from a protocol point of view. From a security point of view, automatic
firewall control from the WAN side is of course a very serious issue.

It doesn't matter how do it. If it is done using an IGP, then can you bet that
either some ISP happens to be using that IGP on WAN links, or that some script
kiddies will try to see what happens if you try to send those packets to
random CPEs.

---

From: Lorenzo Colitti <[email-masked]>
Date: Mon, 1 Aug 2011 14:47:46 -0400

> kiddies will try to see what happens if you try to send those packets to

IGPs support authentication. As part of setting up your home network, you
could associate CPEs with each other and use that to form a common auth key.

---

From: Shane Amante <[email-masked]>
Date: Mon, 1 Aug 2011 22:39:47 -0600

On Aug 1, 2011, at 12:47 PM, Lorenzo Colitti wrote:

> On Mon, Aug 1, 2011 at 14:40, Philip Homburg <[email-masked]> wrote:
> IGPs support authentication. As part of setting up your home network, you could associate CPEs with each other and use that to form a common auth key.

And, likewise, any ISP worth their salt should be:
a) using authentication *within* their access and Backbone network; and,
b) using ACL's to protect their routing & signaling protocols
... so there's absolutely no legitimate reason that a customer's network should ever "accidentally" be joined to the SP's IGP ...

-shane

---

From: Michael Newbery <[email-masked]>
Date: Tue, 2 Aug 2011 17:47:07 +1200

> ... so there's absolutely no legitimate reason that a customer's network should ever "accidentally" be joined to the SP's IGP ...

It's outside the CPE spec, but I can see that the document could state, as an assumption, that the ISP will filter routing advertisements from the CPE and will only pass those that it has determined (via some external mechanism, undefined in this document) belong to the CPE.

This document should state that the CPE should not advertise any invalid routes (default, link-local, etc.) but that in any case the ISP will drop any invalid routes. Is there/does there need to be a RFC that can be referenced here that says what the ISP can or may do with routing information from CPE?

I would assume that if you are injecting general routing information into your network then:
1. You are using BGP to do it
2. a CPE RFC is completely irrelevant

---

From: Philip Homburg <[email-masked]>
Date: Tue, 02 Aug 2011 10:15:18 +0200

In your letter dated Mon, 1 Aug 2011 22:39:47 -0600 you wrote:
>... so there's absolutely no legitimate reason that a customer's network =
>should ever "accidentally" be joined to the SP's IGP ...

A firewall is a security feature. So, it doesn't matter that much what a
responsible ISP does to protect its own networks. What matters is whether
any ISP will accidentally do something that would disable its customers'
firewalls. Or, whether any ISP will come up with a network configuration that
allows customers to disable each others firewalls.

---

From: "Brzozowski, John" <[email-masked]>
Date: Tue, 2 Aug 2011 21:41:41 +0000

On 8/1/11 12:20 PM, "Lorenzo Colitti" <[email-masked]> wrote:

>On Sun, Jul 31, 2011 at 10:38, Brzozowski, John
><[email-masked]> wrote:
>
>There are two issues I see with DHCPv6 PD to distribute prefixes inside
>the home:
>
>1. Prefix delegation only really works in a tree topology, so when the
>user plugs things in wrong (e.g., plugs a LAN port into another LAN port,
>or creates a loop) it won't work. Having a routing protocol will allow
>things to work regardless of how the user plugs things in.
[jjmb] so is the suggestion here to use DHCPv6 PD for the outer most
router and something else internally within the home?  What sort of
topology do you have in mind?  I am not seeing a reason why DHCPv6 could
not work.  Absent DHCPv6 there will be a need for some other protocol,
extension, or technique that does not yet exist, right?

>inside the home as well, then a home router getting a prefix via DHCPv6
>PD will not know whether it is connected to the ISP or not, and thus if
>it should turn on the firewall or not.
[jjmb] should the firewall be off automatically if the router is internal?
>Both of these issues can be solved by using an IGP.
[jjmb] including the sub-allocation of prefixes in the home?  And this
assume the home router is able to support the same.

---

From: "Brzozowski, John" <[email-masked]>
Date: Tue, 2 Aug 2011 21:46:14 +0000

By default I would say no, firewall should be on.

You should have the option to disable the firewall, if you wish.

IMO - the default rule set for the firewall should be allow all outbound,
block all inbound unless the same is a result of a LAN side request.

Maybe your router can only support a /64, remember the ISP is one part of
the equation. ;)

John

---

From: "Brzozowski, John" <[email-masked]>
Date: Tue, 2 Aug 2011 21:54:20 +0000

Agreed, however, it still not make it the best solution for the problem
space.

On 8/2/11 12:39 AM, "Shane Amante" <[email-masked]> wrote:

>... so there's absolutely no legitimate reason that a customer's network
>_______________________________________________
>v6ops mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/v6ops

---

From: "Brzozowski, John" <[email-masked]>
Date: Tue, 2 Aug 2011 21:57:10 +0000

This is something that should be today as part of broadband IPv6
deployments to prevent conflict at the service provider edge.  I cannot
think of a good reason why I would want to accept IPv6 router
advertisements, at this time from residential gateways.

John

On 8/2/11 1:47 AM, "Michael Newbery" <[email-masked]> wrote:

>It's outside the CPE spec, but I can see that the document could state,
>as an assumption, that the ISP will filter routing advertisements from
>the CPE and will only pass those that it has determined (via some
>external mechanism, undefined in this document) belong to the CPE.

---

From: "Brzozowski, John" <[email-masked]>
Date: Tue, 2 Aug 2011 21:57:33 +0000

John

---

From: "Brzozowski, John" <[email-masked]>
Date: Tue, 2 Aug 2011 23:08:53 +0000

Not sure either of the below could happen accidentally.  The latter would
be especially concerning.

On 8/2/11 4:15 AM, "Philip Homburg" <[email-masked]> wrote:

>What matters is whether