Subject: [v6ops] about LLAs pros/cons static routing - auto/self-configuration of addresses, draft-matthews-v6ops-design-guidelines

From: Alexandru Petrescu <[email-masked]>
Date: Thu, 02 Aug 2012 10:31:38 -0700

About LLAs pros/cons static routing,

On slide 4 of
http://tools.ietf.org/agenda/84/slides/slides-84-v6ops-6.pdf
about draft-matthews-v6ops-design-guidelines

There was an aspect that I dont think I heard during the discussion.

When considering the next hop of a static route to be a LLA or a
global/ula, one also wonders whether that address is self-configured
(fe80, MAC) or autoconfigured with help from outside like SLAAC/DHCP.
And knowing that a router would typically not SLAAC for its address then...

A preference would be to avoid autoconfigured addresses and use LLAs as
nexthop of static permanent routes.

Just some thoughts.

Alex

---

From: Philip Matthews <[email-masked]>
Date: Thu, 2 Aug 2012 13:58:16 -0700

I agree on your point about manually-configured vs auto-configured addresses for interface addresses on routers. I will add a discussion of this to the document.

However, I don't see how this plays into the choice of LLA vs GUA/ULA for the next-hop of a static route.

- Philip

On 2012-08-02, at 10:31 , Alexandru Petrescu wrote:

> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops
>

---

From: Alexandru Petrescu <[email-masked]>
Date: Thu, 02 Aug 2012 14:05:10 -0700

Sorry, one preference goes like this: _always_ use ll addresses as next
hop of each static route.

Whereas this has the risk of needing to change when an interface is
replaced it may have more chances to stay stable than when the prefix of
that link changes (router renumbering) or when the sysadmin configures
another global or ULA on that interface, or when the DHCP server gives
it another address.

Some people may prefer to maintain a dhcpd.conf in a single server which
may  happen to be the place from where the routes are distributed as
well (the ospf conf files).

I think overall the preference of using or not using LL address as next
hop of static routes depends a lot on how the addresses are
(auto)configured on these interfaces.

Alex

Le 02/08/2012 13:58, Philip Matthews a écrit :
> I agree on your point about manually-configured vs auto-configured
> addresses for interface addresses on routers. I will add a
> discussion of this to the document.
>
> However, I don't see how this plays into the choice of LLA vs
> GUA/ULA for the next-hop of a static route.
>
> - Philip
>
>> http://tools.ietf.org/agenda/84/slides/slides-84-v6ops-6.pdf about
>> draft-matthews-v6ops-design-guidelines
>>
>> global/ula, one also wonders whether that address is
>> self-configured (fe80, MAC) or autoconfigured with help from
>> outside like SLAAC/DHCP. And knowing that a router would typically
>> not SLAAC for its address then...
>>
>> A preference would be to avoid autoconfigured addresses and use
>> LLAs as nexthop of static permanent routes.
>>
>> Just some thoughts.
>>
>> Alex _______________________________________________ v6ops mailing
>> list [email-masked] https://www.ietf.org/mailman/listinfo/v6ops
>>
>

---

From: Gert Doering <[email-masked]>
Date: Fri, 3 Aug 2012 15:52:43 +0200

Hi,

> hop of each static route.

Well, that is *one* preference.

Our preference is "always use GUA addresses as next-hop".  

People differ, and so do preferences.

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

---

From: Cameron Byrne <[email-masked]>
Date: Fri, 3 Aug 2012 07:05:01 -0700

> People differ, and so do preferences.
+1

We use ULA or GUA as  next hop and never LLA

CB

---

From: Philip Matthews <[email-masked]>
Date: Sat, 4 Aug 2012 23:40:36 -0400

Gert, Cameron, Alexandru:

My main goal with the draft is to document the various pros and cons behind the options. This allows someone to read the draft and make his/her own decision on these questions, but make them in an informed way. 

Alexandru has given me some comments in favor of using LLAs for static routes. Alexandru: If you could express this in a more definitive manner that would be helpful.

Gert and Cameron:  In your networks, what made you decide to use GUAs/ULAs as next hops?  Was there some factor that I have not yet captured? Did you give serious consideration to using LLAs?  Using GUAs/ULAs as the next-hop means that v6 redirects do not work -- are redirects simply unimportant to you?

- Philip

---

From: Cameron Byrne <[email-masked]>
Date: Mon, 6 Aug 2012 08:37:51 -0700

On Sat, Aug 4, 2012 at 8:40 PM, Philip Matthews
<[email-masked]> wrote:
> My main goal with the draft is to document the various pros and cons behind
> the options. This allows someone to read the draft and make his/her own
> decision on these questions, but make them in an informed way.
>
> Alexandru has given me some comments in favor of using LLAs for static
> routes. Alexandru: If you could express this in a more definitive manner
> that would be helpful.
>
> Gert and Cameron:  In your networks, what made you decide to use GUAs/ULAs
> as next hops?  Was there some factor that I have not yet captured? Did you
> give serious consideration to using LLAs?  Using GUAs/ULAs as the next-hop
> means that v6 redirects do not work -- are redirects simply unimportant to
> you?
>
> - Philip
>
>

We have an addressing scheme that is based on the physical locations,
ULA allows us to express the physical location in the address, this
may also be possible in LLA ... but not meaningful in troubleshooting
since the packets cannot get off the link.

We like to troubleshoot routing based on 1 or 2 hops away, (i can ping
the local interface, but i can ping 1 router aways... somebody start
looking at L3 issues ...)

There is also the simplicity of using specifically assigned addresses,
if i am on blah:blah::1 i may know the other side of the link, by my
own convention, is blah:blah::2 without looking at a network map.

In short, the above 3 help us have a common operational practice with
IPv4.  Common practices are good (i know ipv4 != ipv6).

Here is something that is different between IPv4 and IPv4:

LLA is always present by default and auto configured.  Global scope
addresses, like ULA show deliberate intention and configuration.
Meaning, when there is a global scope address like ULA / GUA, then you
know this link is supposed to be in service and somebody has decided
we are going to send packets over it.  LLA just means the card is on
line.

ICMP redirects make my router CPU go high, i generally turn them off.

CB

---

From: [email-masked]
Date: Mon, 06 Aug 2012 18:06:52 +0200 (CEST)

> Gert and Cameron:  In your networks, what made you decide to use GUAs/ULAs as next hops?  Was there some factor that I have not yet captured? Did you give serious consideration to using LLAs?  Usin…

Not answering for anybody except myself - however, I agree with many
of the points made by Cameron Byrne in his message of a few minutes ago,
<[email-masked]>.

We use GUAs (and in a few cases ULAs) for all manually configured next
hops. We have considered LLAs a few times, and each time concluded that
even if LLAs have some advantages, they are simply not worth the trouble.

LLA next hops are fine when they are maintained by the router itself (e.g.
IS-IS etc). However, we also like our IGP links to have GUAs, for ease of
troubleshooting, predictability, similarity to IPv4 etc.

IPv6 redirects are indeed unimportant.

Steinar Haug, AS 2116

---

From: Gert Doering <[email-masked]>
Date: Mon, 6 Aug 2012 21:15:34 +0200

Hi,

On Sat, Aug 04, 2012 at 11:40:36PM -0400, Philip Matthews wrote:
> Gert and Cameron:  In your networks, what made you decide to use
> GUAs/ULAs as next hops?  Was there some factor that I have not yet
> captured? Did you give serious consideration to using LLAs?  Using
> GUAs/ULAs as the next-hop means that v6 redirects do not work --
> are redirects simply unimportant to you?

I see no advantage to using LLAs.  

Besides having no advantage, they only complicate things due to 
aspects like not having a reverse DNS entry (so I can't easily find 
out "so which router should that route pointing to?" if things are 
not working).

We never point static routes to other routers *in* a network that
has end systems - so redirects just do no thappen (if the packet gets
send elsewhere, that's happening in backbone segments outside of the
end system LAN).  

End systems see a HSRP/VRRP default route, and send their packets there, 
end of story (and redirects complicate trouble shooting at the end 
systems, as you can never be sure where  packets are going, depending 
on the current expiry state of redirects, host implementation, etc).

Gert Doering
        -- NetMaster

---

From: Mark ZZZ Smith <[email-masked]>
Date: Mon, 6 Aug 2012 14:32:51 -0700 (PDT)

Hi,

It seems to me that this discussion is mostly and fundamentally about increasing network robustness by reducing or eliminating external dependencies.

Using LLs as next hops eliminates a dependency on ULA or GUA addressing, allowing the ULA or GUA addressing to be changed without disrupting forwarding for prefixes that don't fall within the changing ULA/GUAs. I believe this is why the designers of IPv6 chose LLs for next hops as the default. IPv6 has tried to make renumbering less onerous than IPv4. Using link local next hops avoids them having to be changed when the greater scope than link local prefixes change.

Using (static) ULAs or GUAs as next hops eliminates an external dependency on MAC addresses, which can change if interfaces are changed, when they're, by default, used as part of the LL address.

These are both very valid considerations. As the draft in question mentions, static LL addressing would eliminate both of those external dependencies.

I think this draft is going to encounter a few issues such as this, where there is unlikely to be or will never be consensus on one particular solution or option. I think it those cases it would be acceptable for the draft to try to fully expand both the pros and cons of each option.

OSPF vs IS-IS is going to be another one.

----- Original Message -----
From: Gert Doering <[email-masked]>
To: Philip Matthews <[email-masked]>
Cc: "[email-masked] list" <[email-masked]>
Sent: Tuesday, 7 August 2012 5:15 AM
Subject: Re: [v6ops] about LLAs pros/cons static routing - auto/self-configuration of addresses, draft-matthews-v6ops-design-guidelines

Hi,

Gert Doering
        -- NetMaster

---

From: Philip Matthews <[email-masked]>
Date: Wed, 8 Aug 2012 16:57:22 -0400

> ICMP redirects make my router CPU go high, i generally turn them off.

Cameron:

Thanks for the input.  It helps confirm for me that most operators prefer GUA/ULA
over just LLAs.  Just a few comments on your reply.

The inability to troubleshooting from 1 or 2 hops away is indeed a limitation of LLAs.
I am pretty sure this has already been captured in the I-D.

Having explicitly assigned interface IDs is something one can do with LLAs as well
on our products -- I work for Alcatel-Lucent -- and I am pretty sure C and J support it too.
So I don't really see this as something I can put as a con for LLAs.

At least on our products, and I am pretty sure on J as well, LLAs are not assigned
until one explicitly enables IPv6 on the interface. So I don't really see the argument
that a GUA/ULA means the link is "ready to go". 

- Philip

---

From: Philip Matthews <[email-masked]>
Date: Wed, 8 Aug 2012 17:26:15 -0400

Gert and Stiener:

Thanks for your comments.
Your messages, along with Cameron's, help re-confirm the assertion made in the document
that most operators prefer GUA/ULA addressing over pure LLA.

I also appreciate the comments about redirects. I will strengthen the language in the document around this.

Thanks Gert for your comment about DNS. That is a new comment that I had not previously captured.

- Philip

---

From: Mark ZZZ Smith <[email-masked]>
Date: Thu, 9 Aug 2012 03:10:04 -0700 (PDT)

Hi,

----- Original Message -----
> From: Philip Matthews <[email-masked]>
> To: Gert Doering <[email-masked]>; [email-masked]
> Sent: Thursday, 9 August 2012 7:26 AM
>G ert and Stiener:

Depending on how visible you want your traceroute information to be one, one thing you could do would be use static link local addresses that are unique across the whole of your local network, and then put them in your local 0.8.e.f.ip6.arpa. subdomain.

For example, 

-----[fe80::1]<rtr1>[fe80::2]----[fe80::3]<rtr2>[fe80::4]-----[fe80::5]<rtr3][fe80::6]----

1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa. PTR e0.rtr1

2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa. PTR e1.rtr1

3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa. PTR e0.rtr2

4.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa. PTR e3.rtr2

5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa. PTR e2.rtr3

6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa. PTR e0.rtr3

With so many interface IDs available in fe80::/64, there'd be no need to even put any effort into recycling them should you decommission a router or link. Just keep using the next fe80::X address as you add router interfaces.

Traceroute would work for you, however outside of your network, other people would be querying their own version of 0.8.e.f.ip6.arpa., hiding your interface and router names. This idea might be useful to assist with troubleshooting for a "Using Only Link-Local Addressing Inside an IPv6 Network" http://tools.ietf.org/html/draft-behringer-lla-only-01 scenario.

Regards,
Mark.

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 09 Aug 2012 11:47:47 +0100

On 09/08/2012 11:10, Mark ZZZ Smith wrote:
> Traceroute would work for you, 

It shouldn't, because intermediate routers should discard ICMPv6 packets with
LL source addresses, according to RFC 4291 section 2.5.6.

The fact that they don't is an implementation error, and we shouldn't
rely on that. ICMPv6 should never be sourced from a LL address.

    Brian

however outside of your network, other people would be querying their own version of 0.8.e.f.ip6.arpa., hiding your interface
and router names. This idea might be useful to assist with troubleshooting for a "Using Only Link-Local Addressing Inside an
IPv6 Network" http://tools.ietf.org/html/draft-behringer-lla-only-01 scenario.

---

From: "Michael Behringer (mbehring)" <[email-masked]>
Date: Thu, 9 Aug 2012 11:08:10 +0000

> It shouldn't, because intermediate routers should discard ICMPv6 packets
> with LL source addresses, according to RFC 4291 section 2.5.6.
> 
> The fact that they don't is an implementation error, and we shouldn't rely
> on that. ICMPv6 should never be sourced from a LL address.

I can confirm that at least one implementation (ours) responds using a global address (from a loopback), not the link local. 

> 
>     Brian
> 
> however outside of your network, other people would be querying their
> own version of 0.8.e.f.ip6.arpa., hiding your interface and router names.
> This idea might be useful to assist with troubleshooting for a "Using Only
> Link-Local Addressing Inside an

The concern is that for ICMP echo reply, traceroute, etc the router will respond with a global address, which is a loopback address (in the absence of global addresses on the interface). You can therefore see the router, but not the interface (unless RFC5837 is implemented, which is generally not the case today). 

So I can't see how this helps troubleshooting? (I must be misunderstanding something here)

Michael

---

From: Mark ZZZ Smith <[email-masked]>
Date: Thu, 9 Aug 2012 14:07:00 -0700 (PDT)

Hi Brian,

----- Original Message -----
> From: Brian E Carpenter <[email-masked]>
> To: Mark ZZZ Smith <[email-masked]>
> Cc: Philip Matthews <[email-masked]>; Gert Doering <[email-masked]>; "[email-masked]" <[email-masked]>; "[email-masked]" <[email-masked]>; "[email-masked]" <[email-masked]>; "[email-masked] list" <[email-masked]>
> Sent: Thursday, 9 August 2012 8:47 PM
>>>  Subject: Re: [v6ops] about LLAs pros/cons static routing - 
> auto/self-configuration of addresses, draft-matthews-v6ops-design-guidelines
>>> 
>>>  G ert and Stiener:
>>> 
>>> 

<snip> 

>>  With so many interface IDs available in fe80::/64, there'd be no need 
> to even put any effort into recycling them should you decommission a router or 
> link. Just keep using the next fe80::X address as you add router interfaces.
>> 
> with

Hmm, you're right.

So this idea would provide accurate reverse DNS names for your static link local addresses because they're now unique within your network, however the collection of that information can't rely on link local addressing as it would in traceroute, if the collection process needs to traverse more than a single link.

Regards,
Mark.

> however outside of your network, other people would be querying their own 
> version of 0.8.e.f.ip6.arpa., hiding your interface
> and router names. This idea might be useful to assist with troubleshooting for a 
> "Using Only Link-Local Addressing Inside an

---

From: Mark ZZZ Smith <[email-masked]>
Date: Thu, 9 Aug 2012 14:39:14 -0700 (PDT)

Hi Michael,

----- Original Message -----
> From: Michael Behringer (mbehring) <[email-masked]>
> To: Brian E Carpenter <[email-masked]>; Mark ZZZ Smith <[email-masked]>
> Cc: Philip Matthews <[email-masked]>; Gert Doering <[email-masked]>; "[email-masked]" <[email-masked]>; Eric Vyncke (evyncke) <[email-masked]>; "[email-masked] list" <[email-masked]>
> Sent: Thursday, 9 August 2012 9:08 PM
> Subject: RE: [v6ops] about LLAs pros/cons static routing - auto/self-configuration of addresses, draft-matthews-v6ops-design-guidelines
> 
> I can confirm that at least one implementation (ours) responds using a global 
> address (from a loopback), not the link local. 
> 
>> 
>>      Brian
>> 
> The concern is that for ICMP echo reply, traceroute, etc the router will respond 
> with a global address, which is a loopback address (in the absence of global 
> addresses on the interface). You can therefore see the router, but not the 
> interface (unless RFC5837 is implemented, which is generally not the case 
> today). 
> 

As Brian said, traceroute won't reliably work due to the LL source address issue, however having unique static LL addresses across your network's router interfaces, and then having a record of the static LL address assignments in 0.8.e.f.ip6.arpa via PTRs (and perhaps TXTs for supplementary information) might still be a useful troubleshooting tool. For example, if you're on the CLI of one router, and want to find out the interface name corresponding to an adjacent router's static LL address, a ping command with a reverse resolve of the address far router's interface address would return the result of the PTR and therefore the name of the remote interface and router.

Regards,
Mark.

---

From: Philip Matthews <[email-masked]>
Date: Thu, 9 Aug 2012 17:58:15 -0400

> As Brian said, traceroute won't reliably work due to the LL source address issue, however having unique static LL addresses across your network's router interfaces, and then having a record of the…

I believe traceroute will work.  As Michael said, at least some routers, if there is no GUA/ULA configured on the interface, then the router sends the ICMP reply using the IP address of the loopback or system address as the source address. Michael confirmed that Cisco routers work this way, and I can confirm that Alcatel-Lucent routers work this way. 

If anyone knows of a router which behaves differently, I would be interested in hearing of it. This would be a useful comment to put in my I-D.

- Philip

---

From: Victor Kuarsingh <[email-masked]>
Date: Thu, 9 Aug 2012 19:58:27 -0400

Sent from my iPad

> If anyone knows of a router which behaves differently, I would be interested in hearing of it. This would be a useful comment to put in my I-D.

If you do put that point in, should it be noted that it is a "de facto" behavior of [some] routers?  ( I don't recall a rule suggesting this is the official behavior). 

I guess it's possible to not configure a loopback on a router (although it would seem strange not to have one).  I guess it's also possible that the LB may also not be in the same routing instance.

Also, some operators limit the reachability of the LB from outside their administrative perimeter for security reasons since it's used for management and routing functions (which does not always apply to the interface IP addresses).

Regards,

Victor K

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 10 Aug 2012 08:17:05 +0100

> On 2012-08-09, at 17:39 , Mark ZZZ Smith wrote:

...
> If anyone knows of a router which behaves differently, I would be interested in hearing of it. This would be a useful comment to put in my I-D.

See http://www.ietf.org/mail-archive/web/v6ops/current/msg11277.html

   Brian

---

From: "Rajiv Asati (rajiva)" <[email-masked]>
Date: Mon, 13 Aug 2012 12:42:25 +0000

> there is no GUA/ULA configured on the interface, then the router sends the
> ICMP reply using the IP address of the loopback or system address as the
> source address. 

Stating the obvious assumption - Loopback interface is configured with GUA/ULA.

Cheers,
Rajiv

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Philip Matthews
> Sent: Thursday, August 09, 2012 5:58 PM
> To: Mark ZZZ Smith
> Cc: [email-masked] list; Michael Behringer (mbehring)
> Subject: Re: [v6ops] about LLAs pros/cons static routing - auto/self-
> configuration of addresses, draft-matthews-v6ops-design-guidelines
> 
> 
> >> Cc: Philip Matthews <[email-masked]>; Gert Doering
> >> <[email-masked]>; "[email-masked]" <[email-masked]>; Eric
> >> Vyncke (evyncke) <[email-masked]>; "[email-masked] list"
> >> <[email-masked]>
> >> Subject: RE: [v6ops] about LLAs pros/cons static routing -
> >> I can confirm that at least one implementation (ours) responds using
> >> a global address (from a loopback), not the link local.
> >>
> >>>
> >>>      Brian
> >>>
> >>> however outside of your network, other people would be querying
> >>> their own version of 0.8.e.f.ip6.arpa., hiding your interface and router
> names.
> >>> This idea might be useful to assist with troubleshooting for a
> >>> "Using
> >> Only
> >> The concern is that for ICMP echo reply, traceroute, etc the router
> >> will respond with a global address, which is a loopback address (in
> >> the absence of global addresses on the interface). You can therefore
> >> see the router, but not the interface (unless RFC5837 is implemented,
> >> which is generally not the case today).
> >>
> > As Brian said, traceroute won't reliably work due to the LL source address
> issue, however having unique static LL addresses across your network's
> router interfaces, and then having a record of the static LL address
> assignments in 0.8.e.f.ip6.arpa via PTRs (and perhaps TXTs for
> supplementary information) might still be a useful troubleshooting tool. For
> example, if you're on the CLI of one router, and want to find out the
> interface name corresponding to an adjacent router's static LL address, a
> ping command with a reverse resolve of the address far router's interface
> address would return the result of the PTR and therefore the name of the
> remote interface and router.
> 
> I believe traceroute will work.  As Michael said, at least some routers, if
> there is no GUA/ULA configured on the interface, then the router sends the
> ICMP reply using the IP address of the loopback or system address as the
> source address. Michael confirmed that Cisco routers work this way, and I
> can confirm that Alcatel-Lucent routers work this way.
> 
> If anyone knows of a router which behaves differently, I would be
> interested in hearing of it. This would be a useful comment to put in my I-D.
> 
> - Philip
>