RE: draft-daniel-dhc-ipv6in4-opt-03.txt

[Pekka Savola <pekkas@netcore.fi>]

On Fri, 11 Jun 2004, Karen E. Nielsen (AH/TED) wrote:
> In this particular context I would assume that Juha was explicitly
> referring to 3GPP usage - Could you be so kind
> as to back you statement up with some hard facts that explains why
> Isatap deployment is so very problematic in 3GPP environments - ? 

I've tried to explain these multiple times without all that much
success.  I think the worst problem is that everyone in the 3GPP
operator's network would be considered "on-link" with yourself is the
biggest problem.  I.e., direct tunneling between the 3GPP nodes.

The analogy of this approach would be connecting all the 3GPP users in
the operator's network in a single Ethernet LAN segment, and expecting
them to behave themselves with regard to each other (in particular,
note that Neighbor Discovery and many, many other protocols consider
such an environment "semi-trusted", e.g., by the use of link-local
messages and verifying that Hop Limit stays at 255).  This approach
gives me creeps.  Hence, I'd strongly prefer approaches where there
would be sufficient "insulation" from everyone else, e.g., by the use
of configured, bidirectional tunnels.

> While draft-daniel-dhc-ipv6in4-opt-03.txt seems to be everything
> we're looking for in DHCP environments and *could* be used in the
> 3GPP environment also, it may not be the obvious choice there as
> addresses are allocated by means of PDP context activation
> mechanisms and not by means of DHCP.

Yes, I don't think draft-daniel-dhc-ipv6in4-opt-03.txt is optimal in
3GPP.  You could do the discovery using DNS or a number of other
means.  Configuring the tunnel endpoint at the server's end is a
challenge not addressed in dhc-ipv6in4-opt either.  There are number
of possibilities to do that, though -- one is a pseudo-interface like
ISATAP's, the other is creating tunnels dynamically based on the
packets you receive, the one another looking up auth/identification
data from (3GPP or other) databases.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings