Subject: RE: Turning off link-locals?

From: "Christian Huitema" <[email-masked]>
Date: Mon, 20 Jan 2003 15:54:56 -0800

> Secondly, again, why grant institute-wide access when it isn't
required.
> If
> I just want to get a file from laptop a to laptop b (which isn't
> registered), or print a file, then why go through all that, when LL
gives
> you that ability, and is what it's *designed* for.

Well, it seems that we have a rough consensus on at least one point: if
a host has a DHCP allocated address, it should not need to also
configure a LL address for the same interface. The consensus could be
implemented by removing the statements in the specification that
preclude communication between LL addresses and configured addresses on
the same link.

We have a debate on another point which is whether DHCP configured hosts
should accept to communicate with LL configured hosts on the same link
"all the time" or only "when explicitly authorized" -- what I called the
second knob. There is some weak security benefit to disallowing such
communication, but it could be argued that the benefit is not worth the
operational cost, and that if we want to prevent link layer access then
we should use some real link layer access service. There is also a
modest operational benefit in disallowing this communication: it forces
the "visiting device" to acquire a global, non ambiguous address, and
thus avoids the programming hassles caused by scoped addresses on multi
homed hosts and routers.

My take on this would be to define an explicit DHCP option that says
"don't speak to LL on this link"; in the absence of the option, LL-aware
hosts would happily exchange packets with LL-addressed hosts on the same
link.

-- Christian Huitema

---

From: "John C. Welch" <[email-masked]>
Date: Mon, 20 Jan 2003 19:05:22 -0500

> preclude communication between LL addresses and configured addresses on

If you have a visitor that needs to print, and you don't have open DHCP
access on your network, then that printer which has a DHCP configured
address needs to be able to simultaneously use a LL address on the same
interface. They don't need, nor even want to talk to global or NAT'd
addresses...they need a connection that lasts long enough to kill trees. LL
provides this perfectly.

john

-- 
John C. Welch
Consultant III
Administrative Computing
(617) 253 - 1368 work
(508) 579 - 7380 cell
bynkii2          AIM

---

From: Ian Lister <[email-masked]>
Date: Tue, 21 Jan 2003 10:17:01 +1000 (EST)

On Mon, 20 Jan 2003, John C. Welch wrote:
>interface.

It just needs to be able to communicate with LL devices. It (being LL
aware, of course) just needs a 169.254.0.0/16 route for the local subnet,
and the visitor (being not only LL aware but having a LL address) has a
0.0.0.0/0 route for the local subnet. Thus they can both route to each
other without compromising any other network connectivity they would have
otherwise had. Mac OS X 10.2 implements this (or something along these
lines), so you can talk to your LL devices without having a LL address
yourself.

Several people have pointed this out and I haven't seen anybody argue
against it.

Ian

---

From: "John C. Welch" <[email-masked]>
Date: Mon, 20 Jan 2003 23:02:22 -0500

> lines), so you can talk to your LL devices without having a LL address

Right. But if DHCP kill LL, then this won't work. If you make it some
bizaare switch, then it will only work correctly *sometime*, which is worse
than not working at all.

john

-- 
John C. Welch
Consultant III
Administrative Computing
(617) 253 - 1368 work
(508) 579 - 7380 cell
bynkii2          AIM