RE: But are we talking IPv6 only? That's how I read the draft. (Re: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03)

["Dan Wing" <dwing@cisco.com>]

> -----Original Message-----
> From: james woodyatt [mailto:jhw@apple.com] 
> Sent: Wednesday, August 27, 2008 5:54 PM
> To: IPv6 Operations
> Cc: Dan Wing
> Subject: Re: But are we talking IPv6 only? That's how I read 
> the draft. (Re: Some suggestions for 
> draft-ietf-v6ops-cpe-simple-security-03)
> 
> On Aug 27, 2008, at 17:12, Dan Wing wrote:
> > [I wrote:]
> >> On Aug 27, 2008, at 03:17, Mark Smith wrote:
> >>> * Native IPv6 CPE security, plus IPv4 security/functionality
> >>> requirements to support IPv6 transition via IPv4 tunnelling
> >>
> >> It was my understanding that this is the proper scope, not the
> >> alternatives you mentioned.
> >
> > If the scope includes IPv6-over-IPv4 tunnels, then there are two
> > network topologies:
> >
> >  1.  CPE gets a single IPv4 address and is an IPv4 NAPT, or
> >  2.  the residential user gets one IPv4 address for each
> >      device in their home that wants to do a IPv6-over-IPv4
> >      tunnel.
> >
> > If (1), I don't see how unsolicited incoming packets can be
> > directed to the correct host behind the IPv4 NAPT.
> >
> > If (2), we are outside the realm of simple residential networks --  
> > they only
> > have one IPv4 address.  We can't plan for more to become common as  
> > we approach
> > IPv4 exhaustion.
> >
> > Is there another network topology that I am missing?
> 
> Ah.   I see the confusion.  In the scope of the whole draft, we are  
> talking about CPE that can include dual-stack transition 
> mechanisms.   
> In the specific scope of R23, the words "upper layer protocol" are  
> intended to imply only IPv6 as the outer layer (which may itself be  
> tunneled in an IPv4 transition mechanism, but the filtering  
> recommendations in this draft are intended for use in 
> applying filters  
> inside the tunnel, not to the outside).
> 
> We are not trying to make recommendations about IPv4 simple security  
> in this draft.  This could be made more clear.

I was not expecting the draft to discuss IPv4 simple security.

My confusion -- which persists even after reading your email -- is
what this home network (with a dual-stack CPE) looks like:  which 
device(s) terminate IPv6-over-IPv4 tunnels (the CPE itself?  Or a 
host behind the CPE?), which devices get IPv4 addresses (only the 
CPE itself, or also devices behind the CPE?), and so on.

Network diagrams would go a long ways towards my understanding.
If you could whiteboard such a network diagram and send me a JPG
of the whiteboard, I would be happy to build some ASCII art.

-d