RE: Changing RS Reply Timing for Mobile IPv6

2002-10-30 Thread Hesham Soliman (EAB)
> I think what I've been hearing from Jim Bound and others > that they would rather > not have these specialized features that FMIPv6 is > specifying as general purpose > for any IPv6 router, because they want to move forward with > their IPv6 > (including base MIPv6 which works w

RE: Forwarding packets with site-local source [Re: Choices to goforward with SL]

2002-10-30 Thread Pekka Savola
On Tue, 29 Oct 2002, Richard Draves wrote: > > The latter is how I read it must be implemented -- and > > reading Microsoft's implementation and the reason they're > > using SL *strongly* suggests they > > also have read it that way. There are very probably many others. > > No, I think you're

RE: Limiting the Use of Site-Local

2002-10-30 Thread Hesham Soliman (EAB)
Pekka, I'm trying to understand this comment. > > >.. thus making the argument about the ease of use pretty > much irrelevant > > >IMO .. > > > > Exactly. > > > > It makes any argument that site-local filters are more "secure" > > than global filters pretty much irrelevant, to

RE: Limiting the Use of Site-Local

2002-10-30 Thread Pekka Savola
On Wed, 30 Oct 2002, Hesham Soliman (EAB) wrote: > > > >.. thus making the argument about the ease of use pretty > > much irrelevant > > > >IMO .. > > > > > > Exactly. > > > > > > It makes any argument that site-local filters are more "secure" > > > than global filters pretty muc

IPv6 MIB team - new RFC2011 draft

2002-10-30 Thread Kristine Adamson
Regarding the ipv6InterfaceTable in the new RFC2011 draft, it looks like there is a typo in the names of the Reachable and Retransmit time MIB object names. Shoud the names be ipv6Interface...Time or ipv6Inteface...Time? Thanks, Kristine Adamson IBM Communications Server for MVS: TCP/IP Devel

Re: Changing RS Reply Timing for Mobile IPv6

2002-10-30 Thread James Kempf
Hesham, I wasn't proposing that they be coupled. I see the two as complimentary. jak - Original Message - From: "Hesham Soliman (EAB)" <[EMAIL PROTECTED]> To: "'James Kempf'" <[EMAIL PROTECTED]>; "Bound, Jim" <[EMAIL PROTECTED]>; "Thomas Narten" <[EMAIL PROTECTED]> Cc: <[EMAI

Default site-local behavior for routers

2002-10-30 Thread Brian Haberman
So, one of the items that Margaret suggested was some text in the node requirements doc or the scoped addr arch that states that nodes default to being in one site. However, there has been some mention that people would prefer different behavior in routers. That is, the stated desire was that, by

Re: Default site-local behavior for routers

2002-10-30 Thread Roy Brabson
> This suggestion leads to the model where hosts with multiple > interfaces will assume that all its interfaces are in the > same site (e.g. have the same site-local zone id) unless > explicitly configured to have multiple sites. While routers > will default to having a unique site-local zone id f

RE: Limiting the Use of Site-Local

2002-10-30 Thread Michel Py
> Margaret Wasserman wrote: > If you can compromise the edge router and change its > configuration, you can get either intra-site global > or site-local traffic to be forwarded outside of the > site. Oh really? Maybe you can explain us how you would do that? Let's see, by announcing FE80::/10 or

Re: Limiting the Use of Site-Local

2002-10-30 Thread Bill Sommerfeld
> ... How do you reconfigure a router to forward > site-local traffic to the outside? create a tunnel. - Bill IETF IPng Working Group Mailing List IPng Home Page: http

RE: Limiting the Use of Site-Local

2002-10-30 Thread Ralph Droms
Would you please check your sarcasm at the door? Presumably, if this is a router that can be used either internally or at the edge of a network, it can be configured so that all of its interfaces are part of the same site (so that it forwards site-locals) or that some of its interfaces are not

RE: Limiting the Use of Site-Local

2002-10-30 Thread Hesham Soliman (EAB)
> > ... How do you reconfigure a router to forward > > site-local traffic to the outside? > > create a tunnel. => I guess you would give the same answer for link-locals and many other cases. So, if you have a tunnel, secure it. We've had the exacrt same problems with MIPv6. These are no

Re: Limiting the Use of Site-Local

2002-10-30 Thread Bill Sommerfeld
> > create a tunnel. > > => I guess you would give the same answer > for link-locals and many other cases. link-locals are there for autoconfiguration, not security. > So, if you have a tunnel, secure it. answer is non-responsive. we were discussing unauthorized router modifications. site

RE: Limiting the Use of Site-Local

2002-10-30 Thread Tony Hain
Thank you! > -Original Message- > From: [EMAIL PROTECTED] > [mailto:owner-ipng@;sunroof.eng.sun.com] On Behalf Of Tim Hartrick > Sent: Tuesday, October 29, 2002 4:41 PM > To: [EMAIL PROTECTED]; [EMAIL PROTECTED] > Subject: RE: Limiting the Use of Site-Local > > > > > All, > > I gener

RE: Default site-local behavior for routers

2002-10-30 Thread Tony Hain
The whole discussion about lack of definition of site boundary is bogus, and causing a large waste of energy. We don't tell people how to bound areas in OSPF, yet we are expected to spell out the universal definition of a site. To a first order, the concepts are exactly the same, how much informati

RE: Limiting the Use of Site-Local

2002-10-30 Thread Margaret Wasserman
At 03:23 PM 10/30/02, Michel Py wrote: > Margaret Wasserman wrote: > If you can compromise the edge router and change its > configuration, you can get either intra-site global > or site-local traffic to be forwarded outside of the > site. Oh really? Maybe you can explain us how you would do that?

RE: Limiting the Use of Site-Local

2002-10-30 Thread Hesham Soliman (EAB)
> > => I guess you would give the same answer > > for link-locals and many other cases. > > link-locals are there for autoconfiguration, not security. => You said that if you want forward site-locals beyond a site then create a tunnel and I said: I guess you would give the same a

RE: Limiting the Use of Site-Local

2002-10-30 Thread Michel Py
>> ... How do you reconfigure a router to forward >> site-local traffic to the outside? > Bill Sommerfeld wrote: > create a tunnel. Good idea. Trouble is, the tunneling protocol is blocked by the firewall. What's your next move? (You don't expect to find a router that is connected to a secure ne

RE: Default site-local behavior for routers

2002-10-30 Thread Margaret Wasserman
An organization should probably start with the assumption that a site boundary is exactly congruent with an OSPF area, but they may choose to restrict it further, or expand it when it makes sense for their network. In any case, the site boundary should never be larger than the IGP scope, so if w

RE: Limiting the Use of Site-Local

2002-10-30 Thread Margaret Wasserman
I didn't say anything about site-locals and security and I didn't ask what link-locals are for. I said that you can create a tunnel to take link-locals beyond a link, so the problem is not specific to site-locals. Actually, I think that there are some important differences between link-locals

RE: Limiting the Use of Site-Local

2002-10-30 Thread Michel Py
> If the answer is "protocol X", I just need to find a > way to tunnel IP datagrams inside protocol X. I've > seen worked examples using DNS, http, ssh, smtp, Back to my original post: do you have the IOS image that can create http tunnels on a Cisco 12000? Michel.

RE: Limiting the Use of Site-Local

2002-10-30 Thread Hesham Soliman (EAB)
Margaret, > >I didn't say anything about site-locals and security > >and I didn't ask what link-locals are for. I said > >that you can create a tunnel to take link-locals > >beyond a link, so the problem is not specific to > >site-locals. > > Actually, I think that there are some i

RE: Forwarding packets with site-local source [Re: Choices to go forward with SL]

2002-10-30 Thread Richard Draves
> My take is that the two possible router configs for site locals is > > 1. All interfaces are in the same site > 2. All interfaces are in unique sites > > Margaret's proposal that the default behavior is a node's > interfaces are in 1 site results in case 1. For a router, a > sa

Re: Limiting the Use of Site-Local

2002-10-30 Thread Bill Sommerfeld
> Good idea. Trouble is, the tunneling protocol is blocked by the > firewall. What's your next move? what *does* the firewall allow through? if the answer is "nothing", we've reduced this to the "no external connectivity case" and you can save a bunch of money by simply removing the firewall and

RE: Limiting the Use of Site-Local

2002-10-30 Thread Margaret Wasserman
Hi Hesham, => I hereby declare to the ML that I completely agree that link-locals and site-locals are different :) :-) Sorry if my note seemed condescending or something... I didn't mean it that way. The point was: using tunnelling to evade scope boundaries. This can be done in a zillion w

RE: Forwarding packets with site-local source [Re: Choices to go forward with SL]

2002-10-30 Thread Margaret Wasserman
At 04:33 PM 10/30/02, Richard Draves wrote: > My take is that the two possible router configs for site locals is > > 1. All interfaces are in the same site > 2. All interfaces are in unique sites > > Margaret's proposal that the default behavior is a node's > interfaces are in 1 site

RE: Limiting the Use of Site-Local

2002-10-30 Thread Hesham Soliman (EAB)
> :-) > > Sorry if my note seemed condescending or something... I > didn't mean it that way. => oh no I didn't interpret it that way, I just wanted to make sure that we talk about the same thing. > >The point was: using tunnelling to evade scope boundaries. > >This can be done in a

RE: Limiting the Use of Site-Local

2002-10-30 Thread Richard Draves
> A router might (and probably should) be hard-coded not to > forward link-local packets, as there is no reason to ever > forward them. > > However, a router that might ever need have multiple > interfaces in a single site can't be hard-coded not to > forward site-locals. Whether or not they w

Re: Limiting the Use of Site-Local

2002-10-30 Thread Bill Sommerfeld
> Back to my original post: do you have the IOS image that can create http > tunnels on a Cisco 12000? Why should I believe that a sufficiently determined adversary couldn't somehow obtain a bootleg copy of IOS source? - Bill ---

RE: Forwarding packets with site-local source [Re: Choices to go forward with SL]

2002-10-30 Thread Hesham Soliman (EAB)
> I like the idea the hosts default to all interfaces in one site, => I think this will be a problem for mobile hosts. Using ND alone you can't know if both interfaces are in the same site. Hesham IETF IPng Working Group

RE: Limiting the Use of Site-Local

2002-10-30 Thread Margaret Wasserman
Actually, a router can forward link-locals between interfaces on the same link. In particular, a router can forward a packet with link-local dest and/or source back out the interface from which it arrived (and presumably generate a Redirect too). Good point. If you are implementing link-loca

RE: Limiting the Use of Site-Local

2002-10-30 Thread Michel Py
> Why should I believe that a sufficiently determined > adversary couldn't somehow obtain a bootleg copy of > IOS source? So tell me which of the following setups is the most secure: a) The one that requires, in order to be hacked, to get a bootleg copy of the IOS source, all the tools needed to

RE: Limiting the Use of Site-Local

2002-10-30 Thread Dan Lanciani
"sasson, shuki" <[EMAIL PROTECTED]> wrote: |Hi all, indeed scoping is a pain... specifically since it is not carried as |a part of the address. |In any case we should give an escape path out of this ambiguity to a "known" |world. |Meaning if a node is configured with a global addresses the global

Re: Limiting the Use of Site-Local

2002-10-30 Thread Mark . Andrews
> Some of these complexities don't apply to link-local addresses, because > no one expects to put them in the DNS, This is tunnel vision. The only reason that no one expects them in the DNS is that we havn't added support for them in the DNS. I think LL (and SL)

RE: Default site-local behavior for routers

2002-10-30 Thread Tony Hain
Margaret Wasserman wrote: > ... > I've had an action item for a while to summarize the thread > that led to this conclusion to the IPv6 list, but I haven't > gotten to it yet. I'll do so soon. I appreciate that work loads make a summary effort challenging, but in this particular case it would se

RE: Limiting the Use of Site-Local

2002-10-30 Thread Tony Hain
Dan Lanciani wrote: > ... > The thing that bothers me about this discussion is that it is > starting to sound as if site-local addressing (and all the > endless debate about scope and address selection rules) was > just another sham like transparent renumbering. Until a few > days ago site-loca

Re: Default site-local behavior for routers

2002-10-30 Thread Ole Troan
> So, one of the items that Margaret suggested was some text in > the node requirements doc or the scoped addr arch that states > that nodes default to being in one site. > > However, there has been some mention that people would prefer > different behavior in routers. That is, the stated desire >

RE: Limiting the Use of Site-Local

2002-10-30 Thread Tony Hain
Margaret Wasserman wrote: > I think it depends what you mean by "filtering a prefix"... > > If you use a global prefix to number a private site, you > wouldn't necessarily advertise that prefix in global routing > tables. Yes you would, because that private site is most likely part of a larger

Re: Limiting the Use of Site-Local

2002-10-30 Thread Rob Austein
I've heard this argument that site-local addresses somehow make the site border router filtering problem easier, and I don't get it. As far as I can tell, they don't help at all, and in fact just make the problem a little worse. I have to filter all the kinds of addresess that shouldn't be crossi

RE: Limiting the Use of Site-Local

2002-10-30 Thread Bound, Jim
Tony and Tim, I agree with Tim about the flow. But I strongly support Margarets idea to limit them today to not be part of domain where global addresses exist as Margaret has clearly articulated. Support for that is not a minority and not rehash but putting some controls on an architectural part

Re: Changing RS Reply Timing for Mobile IPv6

2002-10-30 Thread Nick 'Sharkey' Moore
On Tue, Oct 29, 2002 at 07:08:55PM +0100, Hesham Soliman (EAB) wrote: > > Optimistic DAD needs to be analysed carefully to make sure > that the failure cases are rare and do not justify killing > optimistic DAD. I think this analysus is ongoing. Yep. it's ongoing! No-one seems to have come up w

RE: Limiting the Use of Site-Local

2002-10-30 Thread Bound, Jim
I would also ask all those who want to kill SLs turn your support to Margaret to put the controls on. My input to you is you cannot win this battle. But if we support Margarets idea with consenus then at least for now we can control them. And I don't like the idea for IPv6 deployment reasons mes

RE: Limiting the Use of Site-Local

2002-10-30 Thread Michel Py
Margaret, > Margaret Wasserman wrote: > Let me turn the question around... You have posited > that the use of site-local address is somehow more > "secure" than using a private global address range > that is filtered in the router. Why? What attacks > would work in the latter case that wouldn't

Re: Limiting the Use of Site-Local

2002-10-30 Thread Mark . Andrews
> This is tunnel vision. The only reason that no one expects > them in the DNS is that we havn't added support for them > in the DNS. > > well, that and the minor consideration that current DNS architecture > assumes that names are global and that queries return consiste

Re: Limiting the Use of Site-Local

2002-10-30 Thread Rob Austein
At Thu, 31 Oct 2002 09:20:54 +1100, Mark Andrews wrote: > > This is tunnel vision. The only reason that no one expects > them in the DNS is that we havn't added support for them > in the DNS. > > I think LL (and SL) should be in the DNS. Doing this actually > simpl

RE: Limiting the Use of Site-Local

2002-10-30 Thread Tony Hain
Jim, The fundamental difference is the assumption about what is a reasonable network topology. It is absolutely wrong to turn off SL just because a global exists, because neighboring nodes on a single wire may have local policy to be globally visible or not. Insisting that SL gets turned off becau

RE: Limiting the Use of Site-Local

2002-10-30 Thread Tony Hain
Mark.Andrews wrote in response to Keith: > ... Your responses to this and previous > mail make me think that you are not actually paying attention > to what is being sent. Rather you are locked in a crusade > to kill SL and are ignoring anything which will actually > addres

Re: Limiting the Use of Site-Local

2002-10-30 Thread Mark . Andrews
> At Thu, 31 Oct 2002 09:20:54 +1100, Mark Andrews wrote: > > > > This is tunnel vision. The only reason that no one expects > > them in the DNS is that we havn't added support for them > > in the DNS. > > > > I think LL (and SL) should be in the DNS. Doing this actually > >

FastRA RS Congestion

2002-10-30 Thread James Kempf
A point was brought up on the list that in order to make FastRA defined in draft-mkahlil-fastra-01.txt work, the MAX_RTR_SOLICITATION_DELAY on the host must be set to zero and this would cause RS congestion if an access point failed or a group of mobile nodes moved at once. While this could be tru

Re: Limiting the Use of Site-Local

2002-10-30 Thread Rob Austein
At Thu, 31 Oct 2002 10:59:45 +1100, Mark Andrews wrote: > > I'm talking about 1 name with multiple addresses being > returned in multiple scopes. I'm taking about having > getaddrinfo() then filter out the inappropriate addresses > using local knowledge and setting sin6_sc

RE: Limiting the Use of Site-Local

2002-10-30 Thread Hesham Soliman (EAB)
> > => Are you saying that site-local traffic would start > > leaking outside the site and routed globally? > > As in transient ISPs will just forward it? > > Of course the ISP's will forward them -- they (probably) > haven't been > configured to be part of any sites => Forwar

RE: Limiting the Use of Site-Local

2002-10-30 Thread Michel Py
>> Mark.Andrews wrote in response to Keith: >> ... Your responses to this and previous >> mail make me think that you are not actually paying >> attention to what is being sent. Rather you are >> locked in a crusade to kill SL and are ignoring >> anything which will actually address the problems >

RE: Limiting the Use of Site-Local

2002-10-30 Thread Margaret Wasserman
I don't understand this. In your proposal, every site will be filtering a different global prefix. Routers in the internet backbone will not be filtering any global prefix. Where is the comparable defense in the depth? I think it depends what you mean by "filtering a prefix"... If you use a g

Re: Limiting the Use of Site-Local

2002-10-30 Thread Keith Moore
> > when a site renumbers the routers are going to have to be updated > > anyway. of course we need a solution for this problem. but > > having site locals won't change the need to reconfigure > > routers when renumbering. > > You haven't contested my point that the security based on site-locals

Re: Limiting the Use of Site-Local

2002-10-30 Thread Mark . Andrews
> At Thu, 31 Oct 2002 10:59:45 +1100, Mark Andrews wrote: > > > > I'm talking about 1 name with multiple addresses being > > returned in multiple scopes. I'm taking about having > > getaddrinfo() then filter out the inappropriate addresses > > using local knowledge and setting si

Re: Default site-local behavior for routers

2002-10-30 Thread Rob Austein
What Ole said. IETF IPng Working Group Mailing List IPng Home Page: http://playground.sun.com/ipng FTP archive: ftp://playground.sun.com/pub/ipng Direct all administrative requests to [EMA

RE: Limiting the Use of Site-Local

2002-10-30 Thread Michel Py
Dan, >> Michel Py wrote: >> Now, explain me how you design that network (the plane) >> with deprecating site-locals when global addresses are >> present. Modern plane designs are multiple redundant >> networks that carry data for almost all of the plane's >> devices. > Dan Lanciani wrote: > Presu

Re: Default site-local behavior for routers

2002-10-30 Thread Brian Haberman
For the record, my opinion follows Ole's comments. Brian Rob Austein wrote: What Ole said. IETF IPng Working Group Mailing List IPng Home Page: http://playground.sun.com/ipng FTP archive:

RE: Limiting the Use of Site-Local

2002-10-30 Thread Margaret Wasserman
I wonder what Steeve Deering would have said about this? Sounds like a Monica strike to me. What is a Monica strike? I am pretty sure that Steve would have told us, again, that relative addressing is an important part of any addressing scheme and that we need to have some sort of relative add

RE: Limiting the Use of Site-Local

2002-10-30 Thread Michel Py
> What is a Monica strike? A Monica strike is what Bill Clinton did a while ago: Make a lot of noise launching a bunch of cruise missiles at Saddam to try to get the people's attention away from the fact that he had a young lady under his desk. Michel. --

Re: Default site-local behavior for routers

2002-10-30 Thread Brian Haberman
Tony, That is a reasonable approach and one that I could live with. It allows SLs to exist and control is based on tools that are in wide use today. Brian Tony Hain wrote: The whole discussion about lack of definition of site boundary is bogus, and causing a large waste of energy. We don't

RE: Limiting the Use of Site-Local

2002-10-30 Thread Margaret Wasserman
Okay, so I am confused how it applies here. I'd be very surprised to learn that I have a young lady under my desk... Margaret At 09:32 PM 10/30/02, Michel Py wrote: > What is a Monica strike? A Monica strike is what Bill Clinton did a while ago: Make a lot of noise launching a bunch of cruis

Re: Default site-local behavior for routers

2002-10-30 Thread Margaret Wasserman
In any case, the site boundary should never be larger than the IGP scope, so if we are going to talk about defaults, rather than assuming every interface is in a different site, why not assume every EGP/IGP boundary identifies a different site? If we can get past that, maybe we can start talking

Re: Default site-local behavior for routers

2002-10-30 Thread Mark Smith
Would "provider independent local addressing" be a better name for site local addressing if Tony's model is the most commonly followed ? I would find that a more descriptive name, as it doesn't suggest that I have to artificially place a boundary on the addressing due to physical geography. Mark.

RE: Default site-local behavior for routers

2002-10-30 Thread Brian Zill
> Margaret Wasserman writes: > >>>In any case, the site boundary should never be larger >>>than the IGP scope, so if we are going to talk about >>>defaults, rather than assuming every interface is in a >>>different site, why not assume every EGP/IGP boundary >>>identifies a different site? If we c

RE: Limiting the Use of Site-Local

2002-10-30 Thread Michel Py
>> Michel Py wrote: >> A Monica strike is what Bill Clinton did a while ago: >> Make a lot of noise launching a bunch of cruise >> missiles at Saddam to try to get the people's >> attention away from the fact that he had a young >> lady under his desk. > Margaret Wasserman > Okay, so I am confused

Re: Limiting the Use of Site-Local

2002-10-30 Thread Rob Austein
At Wed, 30 Oct 2002 19:46:22 -0800, Michel Py wrote: > > There's been a lot of noise here lately, without real reasons, and it > has not produced much results either. You can call a concrete proposal to eliminate a chunk of unnecessary router complexity "noise" if you like, but I'll have to disag

RE: Limiting the Use of Site-Local

2002-10-30 Thread Michel Py
Margaret, > Margaret Wasserman wrote: > You have made a statement that the use of IPv6 > site-local addresses (as opposed to globally > unique addresses) will increase the security > of a private network. And, I still don't > understand the basis for that claim. Semantics: I would have said "glo

RE: Limiting the Use of Site-Local

2002-10-30 Thread Bound, Jim
Tony, What I want is a simple draft that says site-locals will not be forwarded out of the site? Brian Haberman et als work had that wordage but the other parts are far from consensus. What we could do is have Brian reduce to one draft working with Ole a statement that this will not happen. We ne

RE: Limiting the Use of Site-Local

2002-10-30 Thread Bound, Jim
Mark, > > Please think about this for a minute. It's bad enough for > > applications that are driven by a human who can type or click or > > whatever from a list of possible scopes, but what do you do for > > programs like MTAs? If you're longing for a return to the days of > > fee!fie%foe@f

RE: Limiting the Use of Site-Local

2002-10-30 Thread Bound, Jim
002 10:59:45 +1100, Mark Andrews wrote: > > > > I'm talking about 1 name with multiple addresses being > > returned in multiple scopes. I'm taking about having > > getaddrinfo() then filter out the inappropriate addresses > > using local knowledge and setting sin6_scope_id. > > V

RE: Limiting the Use of Site-Local

2002-10-30 Thread Bound, Jim
Silly me too. I thought valuing differences was part of our jaundra in the IETF and I am on the right side of things too. Oh well I learn everyday. /jim [Have you ever seen the rain coming down on a sunny day] > -Original Message- > From: Margaret Wasserman [mailto:mrw@;windriver.com]

RE: Limiting the Use of Site-Local

2002-10-30 Thread Bound, Jim
Michel, > > What is a Monica strike? > > A Monica strike is what Bill Clinton did a while ago: Make a > lot of noise launching a bunch of cruise missiles at Saddam > to try to get the people's attention away from the fact that > he had a young lady under his desk. If your at this upcoming IET

SL and renumbering [Re: Limiting the Use of Site-Local]

2002-10-30 Thread Pekka Savola
On Tue, 29 Oct 2002, Keith Moore wrote: > > Counter to what one might believe from reading my comments above, I don't > > like the architectural mess that has occured as a consequence of the use > > private addresses in IPv4. The difference between me and the anti-site- > > local camp is that I do

RE: Limiting the Use of Site-Local

2002-10-30 Thread Pekka Savola
On Tue, 29 Oct 2002, Margaret Wasserman wrote: > At 04:57 PM 10/29/02, Hesham Soliman (EAB) wrote: > > > > or to put it another way, why do you have so much faith in > > > filters of SL addresses and so little faith in filters of prefixes? > > > > > > >=> Because they're not configured, they

RE: Limiting the Use of Site-Local

2002-10-30 Thread Margaret Wasserman
> You can't hardcode site-local address filtering in every router, > or you won't be able to communicate inside a site. > > So the router will need to be configured, somehow, to block > site-local addresses from being forwarded from one interface > to another. And that configuration isn't any mo

RE: Limiting the Use of Site-Local

2002-10-30 Thread Pekka Savola
On Wed, 30 Oct 2002, Margaret Wasserman wrote: > > > You can't hardcode site-local address filtering in every router, > > > or you won't be able to communicate inside a site. > > > > > > So the router will need to be configured, somehow, to block > > > site-local addresses from being forwarded from

Re: Default site-local behavior for routers

2002-10-30 Thread Keith Moore
> What are others' opinions on this issue? I'm actually thinking that the most desirable default behavior for routers is one that discourages use of SLs unless they're explicitly configured. So I am inclined to believe that a router (or a multi-interface host when acting as a router) should by

RE: Limiting the Use of Site-Local

2002-10-30 Thread Richard Draves
> or to put it another way, why do you have so much faith in > filters of SL addresses and so little faith in filters of prefixes? Your "so much faith" and "so little faith" are exaggerating my position. But I do think that site-local addresses will offer better security in practice than filterin

Re: Limiting the Use of Site-Local

2002-10-30 Thread Keith Moore
> Your "so much faith" and "so little faith" are exaggerating my position. > But I do think that site-local addresses will offer better security in > practice than filtering a global prefix. Why is that? > > First, the security of the site-local addresses rests on proper > configuration of the sit

Re: Limiting the Use of Site-Local

2002-10-30 Thread Jun-ichiro itojun Hagino
>> A router might (and probably should) be hard-coded not to >> forward link-local packets, as there is no reason to ever >> forward them. >> >> However, a router that might ever need have multiple >> interfaces in a single site can't be hard-coded not to >> forward site-locals. Whether or not

Re: Limiting the Use of Site-Local

2002-10-30 Thread Keith Moore
> > > ... How do you reconfigure a router to forward > > > site-local traffic to the outside? > > > > create a tunnel. > > => I guess you would give the same answer > for link-locals and many other cases. > So, if you have a tunnel, secure it. > We've had the exacrt same problems with > MI

RE: Limiting the Use of Site-Local

2002-10-30 Thread Richard Draves
> when a site renumbers the routers are going to have to be updated > anyway. of course we need a solution for this problem. but > having site locals won't change the need to reconfigure > routers when renumbering. You haven't contested my point that the security based on site-locals will not

RE: Limiting the Use of Site-Local

2002-10-30 Thread Mark Smith
On Thu, 2002-10-31 at 09:20, Margaret Wasserman wrote: > > > > >I don't understand this. In your proposal, every site will be filtering > >a different global prefix. Routers in the internet backbone will not be > >filtering any global prefix. Where is the comparable defense in the > >depth? > > I

Re: Limiting the Use of Site-Local

2002-10-30 Thread Keith Moore
This is tunnel vision. The only reason that no one expects them in the DNS is that we havn't added support for them in the DNS. well, that and the minor consideration that current DNS architecture assumes that names are global and that queries return consistent results e

RE: Limiting the Use of Site-Local

2002-10-30 Thread Michel Py
> you don't have to have the source to IOS in order to > figure out a way to get a router to tunnel the traffic > to a compromised, programmable host of your choosing. > just build the attack into a mail virus. then all you > need is one client inside the firewall running outlook > express... You'

Re: Limiting the Use of Site-Local

2002-10-30 Thread Keith Moore
> > Why should I believe that a sufficiently determined > > adversary couldn't somehow obtain a bootleg copy of > > IOS source? > > So tell me which of the following setups is the most secure: > > a) The one that requires, in order to be hacked, to get a bootleg copy > of the IOS source, all the

Re: Limiting the Use of Site-Local

2002-10-30 Thread Keith Moore
> > you don't have to have the source to IOS in order to > > figure out a way to get a router to tunnel the traffic > > to a compromised, programmable host of your choosing. > > just build the attack into a mail virus. then all you > > need is one client inside the firewall running outlook > > expr

RE: Limiting the Use of Site-Local

2002-10-30 Thread Tony Hain
Mark Smith wrote: > ... > On a related topic, if I was to stuff up my site local > filters at the edge of my site, would my network then become > part of my ISPs site local network ? You would both have to make an error to get the two IGPs tied together. > In the proposed > site-local models

Re: Limiting the Use of Site-Local

2002-10-30 Thread Keith Moore
> Please don't interpret the ranting of a few as representing anything > close to consensus of a very large WG. yes, please don't. it's very clear that we don't have consensus to use SLs except on an isolated network. attempts by a few individuals to legitimize SLs in the face of considerable

RE: Limiting the Use of Site-Local

2002-10-30 Thread Margaret Wasserman
On a related topic, if I was to stuff up my site local filters at the edge of my site, would my network then become part of my ISPs site local network ? In the proposed site-local models, are sites adjacent, or are they separated by segments that only have a global address assignments (eg the BG

RE: Limiting the Use of Site-Local

2002-10-30 Thread Margaret Wasserman
Michel, You have made a statement that the use of IPv6 site-local addresses (as opposed to globally-unique addresses) will increase the security of a private network. And, I still don't understand the basis for that claim. Could you please answer the following question that I posted earlier?

Re: Limiting the Use of Site-Local

2002-10-30 Thread Ole Troan
>>> A router might (and probably should) be hard-coded not to >>> forward link-local packets, as there is no reason to ever >>> forward them. >>> >>> However, a router that might ever need have multiple >>> interfaces in a single site can't be hard-coded not to >>> forward site-locals. Whether

RE: Limiting the Use of Site-Local

2002-10-30 Thread Mark Smith
Thanks Tony, Margaret. On Thu, 2002-10-31 at 10:19, Margaret Wasserman wrote: > > > > >On a related topic, if I was to stuff up my site local filters at the > >edge of my site, would my network then become part of my ISPs site local > >network ? In the proposed site-local models, are sites adjace

Re: Limiting the Use of Site-Local

2002-10-30 Thread Keith Moore
> > This is tunnel vision. The only reason that no one expects > > them in the DNS is that we havn't added support for them > > in the DNS. > > > > well, that and the minor consideration that current DNS architecture > > assumes that names are global and that queries return

Re: Limiting the Use of Site-Local

2002-10-30 Thread Keith Moore
> I would also ask all those who want to kill SLs turn your support to > Margaret to put the controls on. Yes, this is the position I support. Even I do not expect to kill SLs in the sense that we would reallocate those addresses for other purposes, forbid using them under all conditions, expect

Re: Limiting the Use of Site-Local

2002-10-30 Thread Keith Moore
> That summarizes it well. and it appears to me that you are trying to attack me personally rather than actually make credible arguments in favor of using SL. IETF IPng Working Group Mailing List IPng Home Page:

Re: Limiting the Use of Site-Local

2002-10-30 Thread Keith Moore
I'm talking about 1 name with multiple addresses being returned in multiple scopes. I'm taking about having getaddrinfo() then filter out the inappropriate addresses using local knowledge and setting sin6_scope_id. This deals with 99.9% of address lookup. N

Re: Limiting the Use of Site-Local

2002-10-30 Thread Keith Moore
> The fundamental difference is the assumption about what is a reasonable > network topology. It is absolutely wrong to turn off SL just because a > global exists, because neighboring nodes on a single wire may have local > policy to be globally visible or not. it is absolutely wrong to expect ap

Re: Limiting the Use of Site-Local

2002-10-30 Thread Brian Haberman
Jun-ichiro itojun Hagino wrote: could you comment on routing code? (RIPng, OSPFv3) i still think it's way too tough to support multi-sited node. Not that the chairs have finalized the agenda, but I am planning on presenting what it took me to get a site-border router coded and running. If

  1   2   >