Ingress Filtering, Site Multihoming, and Source Address Selection draft-draves-ipngwg-ingress-filtering-00 Richard Draves May 31, 2001 Redmond Interim IPv6 WG Meeting

The Problem Multi-homed site Site prefix from each ISP ISPs perform source-address-based ingress filtering Routing within site is based on destination address – egress is independent of source address. => No connectivity to some destinations.

Possible Solutions Tunneling between egress routers Simplify – sites with one link Prefix policy configuration New ICMP error

Tunneling between Egress Routers Site egress routers inspect the source address Tunnel packets to other egress router Pro – No changes in hosts Con – inefficient routing Con – requires router configuration

Sites with One Link Suppose site has one link with multiple ISP routers, Each ISP router advertises only its own prefix, Then router choice could influence source address selection if hosts remember which router advertised the prefix used to generate each address.

Discussion Pro – fairly simple change to hosts Con – limited applicability Can be generalized to site networks where each internal router only forwards towards one egress.

Prefix Policy Configuration Use prefix policy table configuration to control choice of source address for different destination prefixes. Pro – uses existing mechanism. Con – need to understand how intrasite routing partitions destination space. This partition likely not constant across time or site topology. Con – need to distribute policies to hosts. In RAs?

New ICMP Error Destination-unreachable due to source filter, supplies the required prefix. Allow list of prefixes? Host can associate this prefix with a destination address and use it to influence source address selection. Analogous to PMTU discovery Except first router should be most restrictive.

Issue – TCP interaction This doesn’t help the first packet sent to a destination. Must modify TCP to recognize this error in response to a SYN and redo source address selection.

Issue – Routing the error ISP A dst D src B1 Site A1 B1 ISP B If ISP A sends the error to B1, then it will take a circuitous route back to the host.

Error Routing Solutions Force this particular ICMP error back out incoming interface? Send the ICMP error using a routing header with an intermediate destination, which is an anycast address equal to the site prefix? Assumptions: anycast address assigned to all routers in site using site prefix convex routing within the site.

New ICMP Error w/ Routing Header Pro – like PMTU discovery, good robustness Con – like PMTU discovery, first packet is dropped Con – additional mechanism