Re: Source address selection insufficient?

[Erik Nordmark <Erik.Nordmark@sun.com>]

> I think what you're assuming that ingress filtering is recursive: it's 
> done further down the IPv6 cloud from the both sides, rather than only 
> at the edge.

No, it's about the ingress filtering at site X and site Y.

The initiator at site X can explore using all 4 locator combinations
(e.g. for the TCP SYN) and 2 of those pairs will make it out pasts
the ingress filtering of X's ISPs.
There is no filtering between those ISPs and site Y thus the SYN makes
it to the peer.
But the peer responds (with the SYN ACK) and has no choice on the addresses -
it must respond using the addresses that was in the SYN.

When these (SYN ACK) packets hit the ingress filter in Y's ISPs they are
filtered out.

As a result none of the 4 locator pairs work.

  Erik