Lightweight 4over6: An Extension to the Dual-Stack Lite Architecture
draft-ietf-softwire-lw4over6-13

[Ballot comment]
I don't have any specific objection to this document. I agree with others that there are too many options and potential solutions being published. While there is a good chance that the market will decide and winnow this down to just a very few practical solutions, I believe the IETF (and specifically the Softwire working group) is letting down the industry. Vendors will be unclear which solutions to implement and operators are unlikely to give early direction. This will result in multiple implementations that either do not interoperate or that increase the net cost of equipment. And in the end, who pays?

I wish more effort had gone into reducing the options.

[Ballot discuss]
Section 7 suggests a number of additional provisioning mechanisms:

  In addition to the DHCPv6 based mechanism described in section 5.1,
  several other IPv4 provisioning protocols have been suggested.  These
  protocols MAY be implemented.  These alternatives include:

  o  DHCPv4 over DHCPv6: [RFC7341] describes implementing DHCPv4
      messages over an IPv6 only service providers network.  This
      enables leasing of IPv4 addresses and makes DHCPv4 options
      available to the DHCPv4 over DHCPv6 client.

Cui, et al.              Expires April 17, 2015                [Page 12]
Internet-Draft            Lightweight 4over6              October 2014

  o  PCP[RFC6887]: an lwB4 MAY use [I-D.ietf-pcp-port-set] to retrieve
      a restricted IPv4 address and a set of ports.

  In a Lightweight 4over6 domain, the binding information MUST be
  aligned between the lwB4s, the lwAFTRs and the provisioning server.

How do we achieve interoperability if each implementation can choose different provisioning mechanisms?
Especially, given that synchronization is critical, and is dependent on the provisioning mechanism used?

[Ballot comment]
From the OPS-DIR review (David Black and David Harrington)

The lw4o6 specification results in significant operational change from the current DS-Lite, so that does raise the question of how to manage lw4o6.
From the document:

  This document focuses on architectural considerations and
  particularly on the expected behavior of the involved functional
  elements and their interfaces.  Deployment-specific issues are
  discussed in a companion document.  As such, discussions about
  redundancy and provisioning policy are out of scope.

  ...

  The consequence of this architecture is that the information
  maintained by the provisioning mechanism and the one maintained by
  the lwAFTR MUST be synchronized (See figure 2).  The details of this
  synchronization depend on the exact provisioning mechanism and will
  be discussed in a companion document.


David Black:

    The consequence of this architecture is that the information maintained by the provisioning mechanism and the one maintained by the lwAFTR MUST be synchronized (See figure 2). The details of this synchronization depend on the exact provisioning mechanism and protocols that are in use by the operator. If no automated process for this synchronisation is in use, then information in the provisioning systems and the lwAFTR MUST be synchronised manually, e.g. by copying aligned configuration files to each of the elements.

Ted's answer

    It might be better to simply say "the precise mechanism whereby this synchronization occurs is out of scope for this document."

Like David (who expressed: my primary concern was the reference to a "companion document" which lead to an obvious "where is that???" question), I really prefer Ted's proposal.
As OPS AD, I don't want to force for the OPS solution at the time of publishing the protocol spec. However, we have to set the right expectations for the (OPS) readers.

Additionally, as David wrote:

    2) I have a related concern: I don’t see discussion of how the implementation should be operated and monitored, remotely.
    Since this implementation is expected to reside in customer premises equipment, having a remote monitoring and management capability seems important.
    And since this is being developed in the IETF, where interoperability is important, it would seem an IETF standardized monitoring and management solution would be desirable.
    A MIB module would provide monitoring capability, but none is defined or suggested here. This is an extension to DS-LIte, and there is a DS-Lite MIB. There is no discussion of whetherr that DS-Lite MIB module would be applicable to lw4o6, or whether that MIB module would require changes to be applicable to lw4o6 monitoring.

Bottom line: the operational aspects for this new solution should be carefully looked at by the responsible AD and OPS ADs. Without an OPS-related specfication on how to manage this protocol, I'm afraid the solution is not complete.
Potentially a new entry in the charter, potentially involving the early OPS-DIR review.

[Ballot comment]
= Section 4 =
"The solution specified in this document allows the assignment of
  either a full or a shared IPv4 address requesting CPEs."
 
I think this sentence is missing a word -- maybe "to" requesting CPEs?

= Section 5.2 =
"The lwB4 is responsible for performing ALG functions (e.g., SIP,
  FTP), and other NAPT traversal mechanisms (e.g., UPnP, NAPT-PMP,
  manual binding configuration, PCP) for the internal hosts."

I would suggest adding "if necessary" at the end of this sentence. At least for SIP, we have IETF guidance (in BCP 127) recommending that SIP ALG functionality be disabled by default.

= Section 9 =
It seems like the mechanism specified in this draft basically trades off the user's security (in the case where contiguous ports are used) in favor of efficiency/cost savings for the service provider. It seems like that should be stated more clearly -- at best there is no benefit of this solution to the user, and at worst it increases the attack potential. Or is there a place in the softwire document suite where this is explained more generally for other mechanisms that also use contiguous ports in port sets?

[Ballot discuss]
The SecDir review brought up a few good points to see if additional text is needed on DoS attacks and secure provisioning in addition to some nits.  Could you please respond to that discussion and we'll figure out if text is needed (it looks like it may be).

http://www.ietf.org/mail-archive/web/secdir/current/msg05163.html

Thanks!

[Ballot comment]
I find it a dis-service to the community for the softwire WG to put forth multiple solutions that solve essentially the same problem (https://mailarchive.ietf.org/arch/msg/ietf/jcscmIHmAQSvXLAlLLvfhnC2P8A).  I believe the confusion caused by a myriad of solutions in this space, regardless of whether they are Standards Track or Experimental, will adversely impact vendors, operators, and end-users.  My only hope is that this confusion will speed up the transition to IPv6-only operations within the affected networks.

IESG/Authors/WG Chairs:

IANA has reviewed draft-ietf-softwire-lw4over6-10, which is currently in Last Call, and has the following comments:

We understand that, upon approval of this document, there are no IANA Actions that need completion.

While it is helpful for the IANA Considerations section of the document to remain in place upon publication, if the authors prefer to remove it, IANA doesn't object.

If this assessment is not accurate, please respond as soon as possible.

The following Last Call announcement was sent out:

From: The IESG
To: IETF-Announce
CC:
Reply-To: ietf@ietf.org
Sender:
Subject: Last Call:  (Lightweight 4over6: An Extension to the DS-Lite Architecture) to Proposed Standard


The IESG has received a request from the Softwires WG (softwire) to
consider the following document:
- 'Lightweight 4over6: An Extension to the DS-Lite Architecture'
  as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2014-10-10. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract


  Dual-Stack Lite (RFC 6333) describes an architecture for transporting
  IPv4 packets over an IPv6 network.  This document specifies an
  extension to DS-Lite called Lightweight 4over6 which moves the
  Network Address and Port Translation (NAPT) function from the
  centralized DS-Lite tunnel concentrator to the tunnel client located
  in the Customer Premises Equipment (CPE).  This removes the
  requirement for a Carrier Grade NAT function in the tunnel
  concentrator and reduces the amount of centralized state that must be
  held to a per-subscriber level.  In order to delegate the NAPT
  function and make IPv4 Address sharing possible, port-restricted IPv4
  addresses are allocated to the CPEs.




The file can be obtained via
http://datatracker.ietf.org/doc/draft-ietf-softwire-lw4over6/

IESG discussion can be tracked via
http://datatracker.ietf.org/doc/draft-ietf-softwire-lw4over6/ballot/


The following IPR Declarations may be related to this I-D:

  http://datatracker.ietf.org/ipr/2030/
  http://datatracker.ietf.org/ipr/2375/

(1) What type of RFC is being requested (BCP, Proposed Standard,
Internet Standard, Informational, Experimental, or Historic)? Why is
this the proper type of RFC? Is this type of RFC indicated in the title
page header?

Proposed Standard. This document documents a scheme used to provide
residual IPv4 service over IPv6 access networks.  Lightweight 4over6
is a solution designed specifically for complete independence between
the IPv6 subnet prefix and IPv4 address, either with or without IPv4
address sharing. This is accomplished by maintaining state for each
softwire (per-subscriber state) in the central lwAFTR along with a
hub-and-spoke forwarding architecture.

(2) The IESG approval announcement includes a Document Announcement
Write-Up. Please provide such a Document Announcement Write-Up. Recent
examples can be found in the "Action" announcements for approved
documents. The approval announcement contains the following sections:

Technical Summary:

DS-Lite [RFC 6333] describes an architecture for transporting IPv4
packets over an IPv6 network.  This document specifies an extension to
DS-Lite called Lightweight 4over6 which moves the Network Address and
Port Translation (NAPT) function from the centralized DS-Lite tunnel
concentrator to the tunnel client located in the Customer Premises
Equipment (CPE).  This removes the requirement for a Carrier Grade NAT
function in the tunnel concentrator and reduces the amount of
centralized state that must be held to a per-subscriber level.  A
companion document describes the DHCPv6 options necessary for
provisioning of Lightweight 4over6.

Working Group Summary:

The working group had active discussion on the draft and the current
text of the draft is representative of the consensus of the working
group. This document and the MAP-E document are closely related and it
led to a lot of friction in the working group.

Lightweight 4over6 is a solution designed specifically for complete
independence between IPv6 subnet prefix and IPv4 address with or
without IPv4 address sharing.  This is accomplished by maintaining
state for each softwire (per-subscriber state) in the central lwAFTR
and a hub-and-spoke forwarding architecture. 

MAP-E can also offer these capabilities or, alternatively, can provide
a reduction of the amount of centralized state using rules to express
IPv4/IPv6 address mappings.  This introduces an algorithmic
relationship between the IPv6 subnet and IPv4 address. This
relationship also allows the option of direct, meshed connectivity
between users.

Document Quality:

The document has received adequate review. The Document Shepherd has
no concerns about the depth or breadth of these reviews. There are
several interoperable implementations of the scheme and they have been
demonstrated and tested during the IETF meetings.

Personnel:

Who is the Document Shepherd? Who is the Responsible Area Director?

Suresh Krishnan is the document shepherd. Ted Lemon is the responsible
AD.

(3) Briefly describe the review of this document that was performed by
the Document Shepherd. If this version of the document is not ready for
publication, please explain why the document is being forwarded to the IESG.

The document shepherd has reviewed the draft and finds that it is ready
to advance to the IESG. All issues that were raised in the working group
last calls have been addressed.

(4) Does the document Shepherd have any concerns about the depth or
breadth of the reviews that have been performed?

No. The document shepherd has no such concerns.

(5) Do portions of the document need review from a particular or from
broader perspective, e.g., security, operational complexity, AAA, DNS,
DHCP, XML, or internationalization? If so, describe the review that took
place.

No.

(6) Describe any specific concerns or issues that the Document Shepherd
has with this document that the Responsible Area Director and/or the
IESG should be aware of? For example, perhaps he or she is uncomfortable
with certain parts of the document, or has concerns whether there really
is a need for it. In any event, if the WG has discussed those issues and
has indicated that it still wishes to advance the document, detail those
concerns here.

There is significant overlap between the stateless softwire
solutions. The WG has discussed this overlap and the current document
set (along with the document dracks) are the result of working group
consensus to do so.

(7) Has each author confirmed that any and all appropriate IPR
disclosures required for full conformance with the provisions of BCP
78 and BCP 79 have already been filed. If not, explain why?

Yes.

(8) Has an IPR disclosure been filed that references this document? If
so, summarize any WG discussion and conclusion regarding the IPR
disclosures.

Not directly. There has been an IPR diclosure on a predecessor
document that this document replaced.

https://datatracker.ietf.org/ipr/2030/

(9) How solid is the WG consensus behind this document? Does it
represent the strong concurrence of a few individuals, with others being
silent, or does the WG as a whole understand and agree with it?

There is strong WG consensus behind this document.

(10) Has anyone threatened an appeal or otherwise indicated extreme
discontent? If so, please summarise the areas of conflict in separate
email messages to the Responsible Area Director. (It should be in a
separate email because this questionnaire is publicly available.)

No.

(11) Identify any ID nits the Document Shepherd has found in this
document. (See http://www.ietf.org/tools/idnits/ and the Internet-Drafts
Checklist). Boilerplate checks are not enough; this check needs to be
thorough.

No errors were found on the ID nits check.

(12) Describe how the document meets any required formal review
criteria, such as the MIB Doctor, media type, and URI type reviews.

N/A

(13) Have all references within this document been identified as either
normative or informative?

Yes.

(14) Are there normative references to documents that are not ready for
advancement or are otherwise in an unclear state? If such normative
references exist, what is the plan for their completion?

No.

(15) Are there downward normative references references (see RFC 3967)?
If so, list these downward references to support the Area Director in
the Last Call procedure.

No.

(16) Will publication of this document change the status of any existing
RFCs? Are those RFCs listed on the title page header, listed in the
abstract, and discussed in the introduction? If the RFCs are not listed
in the Abstract and Introduction, explain why, and point to the part of
the document where the relationship of this document to the other RFCs
is discussed. If this information is not in the document, explain why
the WG considers it unnecessary.

No.

(17) Describe the Document Shepherd's review of the IANA considerations
section, especially with regard to its consistency with the body of the
document. Confirm that all protocol extensions that the document makes
are associated with the appropriate reservations in IANA registries.
Confirm that any referenced IANA registries have been clearly
identified. Confirm that newly created IANA registries include a
detailed specification of the initial contents for the registry, that
allocations procedures for future registrations are defined, and a
reasonable name for the new registry has been suggested (see RFC 5226).

The document requires no IANA actions.

(18) List any new IANA registries that require Expert Review for future
allocations. Provide any public guidance that the IESG would find useful
in selecting the IANA Experts for these new registries.

N/A

(19) Describe reviews and automated checks performed by the Document
Shepherd to validate sections of the document written in a formal
language, such as XML code, BNF rules, MIB definitions, etc.

N/A