[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: But are we talking IPv6 only? That's how I read the draft. (Re: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03)

On Aug 27, 2008, at 17:12, Dan Wing wrote:

[I wrote:]

On Aug 27, 2008, at 03:17, Mark Smith wrote:

* Native IPv6 CPE security, plus IPv4 security/functionality
requirements to support IPv6 transition via IPv4 tunnelling


It was my understanding that this is the proper scope, not the
alternatives you mentioned.


If the scope includes IPv6-over-IPv4 tunnels, then there are two
network topologies:

 1.  CPE gets a single IPv4 address and is an IPv4 NAPT, or
 2.  the residential user gets one IPv4 address for each
     device in their home that wants to do a IPv6-over-IPv4
     tunnel.

If (1), I don't see how unsolicited incoming packets can be
directed to the correct host behind the IPv4 NAPT.
If (2), we are outside the realm of simple residential networks -- they only have one IPv4 address. We can't plan for more to become common as we approach 
IPv4 exhaustion.

Is there another network topology that I am missing?
Ah. I see the confusion. In the scope of the whole draft, we are talking about CPE that can include dual-stack transition mechanisms. In the specific scope of R23, the words "upper layer protocol" are intended to imply only IPv6 as the outer layer (which may itself be tunneled in an IPv4 transition mechanism, but the filtering recommendations in this draft are intended for use in applying filters inside the tunnel, not to the outside).
We are not trying to make recommendations about IPv4 simple security in this draft. This could be made more clear. 


--
james woodyatt <jhw@apple.com>
member of technical staff, communications engineering