Re: New (-02) version of IPv6 CPE Router draft is available for review

[David Miles <davidm@thetiger.com>]

Hemant and Wes,

Some comments on draft-02:
- The un-numbered  model doesn't require a loopback interface
- ULA addresses generation per RFC4193 may not be appropriate for CPE  
as it requires time of day and is a one-time algorithm. I think we may  
need to suggest a new random algorithm that is consistent with the one  
in RFC 4193 and does not require time of day. We should also point out  
that a ULA prefix should be consistent across reloads and there must  
be some method by which the user can regenerate or otherwise specify  
their desired ULA prefix. Finally ULA is a 48-bit prefix.
- I think we should add a line that says traffic with a ULA source  
address should not be forwarded out the WAN interface, rather than  
noting you could use user-configured ACL.
- Seeing you mention DAD on the WAN interface, you may also want to  
add joining the solicited-node MC group via MLD per RFC 4861/2.
- Suggest you use RIPng terminology rather than RIPv6
- The IPv6 over PPP and softwire sections makes no mention of WAN  
interface address assignment other than IPv6CP (interface-ID). Should  
we support both numbered and unnumbered models on PPP links?
- Section 7: IPv6 Data forwarding should reference the Default Routers  
List and the creation of the default route based on this. As you've  
covered off cascading routers we also need to consider how to route  
traffic to them (assuming they will in turn populate their default  
router list with the root CPE). This suggests the DHCPv6 server in the  
CPE must be able to trigger route updates based on active leases.

I think we need a new section that describes CPE behaviour on reload/ 
WAN up, thoughts below:
-----
5.4 Prefix Delegation Rebinding
Whenever the CPE WAN link changes state, addresses passed through  
DHCPv6 must be revalidated. Conditions that should trigger a Rebind  
include:
- When the CPE reboots
- When the CPE WAN interface transitions to an up state

Prior to completing a Rebind, the CPE should continue to use addresses  
and lifetimes previously assigned to its LAN interface(s) that are  
derived from IA_PD Prefix options. These may be subsequently  
invalidated through the Rebind process.

On reload, a routing CPE may not be able to validate any IA_PD Prefix  
option lifetimes. Certain parameters must be stored in persistent  
memory to avoid a situation where hosts in the LAN segments consider  
previously advertised prefixes valid that the CPE does not know of or  
that may not be permitted by the upstream ISP.
These persistent parameters are:
- DHCPv6 PD
	- IAID
	- Prefix Options
- A register of subnets assigned to each interface with associated  
IAID, IA_PD Prefix option and AdvPrefixList.
- Interface address assignments and lifetimes

The CPE MUST NOT advertise any RA PIO for prefixes derived from IA_PD  
Prefix Options until the prefixes have been validated through a DHCP  
Rebind message exchange.

Once the WAN interface initialises, the reloading CPE SHOULD issue a  
DHCPv6-PD Rebind message, including the stored IAID and Prefix Options  
in the message. The DHCP Reply message will indicate whether the  
prefixes are valid (the valid lifetime is > 0) or invalid (the valid  
lifetime is 0). If there is no reply within CNF_MAX_RD [RFC 3315] the  
CPE MUST initiate DHCPv6 Address Acquisition. It should continue to  
use addresses and lifetimes previously assigned to its LAN interface(s).

For each invalid prefix, the CPE MUST transmit unsolicited RA to LAN  
segments that contain PIO with the invalid prefix and the lifetime set  
to zero to immediately invalidate these addresses from hosts on the  
LAN. The CPE MUST then initialise DHCPv6 Address Acquisition.
For each valid prefix, the CPE MUST transmit unsolicited RA to LAN  
segments that contain PIO with the valid prefix and lifetimes set to  
the values is the DHCP Reply IA_PD Prefix option.

-----
- I'd suggest text in the DHCPv6 Address Acquisition section that  
clarifies IA_PD prefix options received by the CPE are an explicit  
list of valid prefixes. All prefixes in the CPE AdvPrefixList that  
originated from previous IA_PD and that are not contained in the DHCP- 
PD Reply MUST be immediately expired. This ensures a host will not try  
an communicate through the ISP with a invalid source address. I'm not  
sure what we should do in the scenario where DHCPv6 Address  
Acquisitions fails (ie, we get a response but no IA_PD Options) but I  
would lean to doing nothing (ie, dont expire prefixes but do not send  
any PIO, let the lifetime age away)  as we are not going to forward  
anyway.


- Some comments on the Unnumbered model with suggested text:

From:
5.3.2. Unnumbered Model
When the CPE router is configured for Unnumbered model, after the WAN  
and Loopback interfaces have acquired a link-local address, the  
Loopback interface initiates SLAAC or stateful DHCPv6 to obtain IA_PD  
option and other configuration information. On receiving the DHCPv6  
REPLY with IA_PD option, the CPE Router sub-delegates one global IPv6  
address from the IA_PD option to the Loopback interface.
At any instance in time of the CPE Router operation, the router does  
not forward any traffic between its WAN and LAN interface(s) if the  
router has not completed IPv6 provisioning process that involves the  
acquisition of a global IPv6 address by the WAN or loopback interface  
and the acquisition of a global or Unique Local Address (ULA) by the  
LAN interface(s).
---
To:
5.3.2. Unnumbered Model
In the unnumbered model the WAN interface will not acquire an  
interface address through SLAAC or DHCPv6. When the CPE router is  
configured for Unnumbered model and after interface initialisation,  
the WAN interface initiates DHCPv6 to obtain IA_PD option and other  
configuration information.

5.3.3. Both Models
 On receiving the DHCPv6 REPLY with a IA_PD option, the CPE Router  
assigns a /64 prefix from within the bounds of the IA_PD Prefix Option  
to all interfaces except the WAN interface. The interface addresses  
are constructed using the /64 prefix and using EUI-64 on each  
interface for the Interface-ID portion of the address.
At any instance in time of the CPE Router operation, the router does  
not forward any traffic between its WAN and LAN interface(s) if the  
router has not completed IPv6 provisioning process that involves the  
acquisition or rebinding of addresses via DHCPv6-PD.


Cheers,

-David