draft-vandevelde-v6ops-harmful-tunnels-01.txt 1 Are they the future of the Internet? Non-Managed Tunnels Considered Harmful Gunter Van de Velde, Ole Troan, Tim Chown

The Controverse-o-Meter Highly controversial Medium controversial (whatever that means) Not controversial

Objectives The noble goal of the IPv6 Internet What do people say? What are managed tunnels? Non-managed tunnel properties Conclusion Why do Non-managed tunnels exist?

What is a Managed tunnel? The user has a contact “to bark at” when connectivity is not working as expected The tunneling is facilitated by a contactable administration Realm for the tunnel head and tail-end Security, performance and integrity of the tunnel is managed The user experience for using either IPv4 or IPv6 is invisible, so that the network environment feels and smells like true native connectivity

Tunnel Experiences The end-user view My ISP does not provide IPv6, so 6to4/Teredo is my easy way to get IPv6… and I am very happy with the IPv6 quality Oh… I didn’t know I was using IPv6…. The enterprise view 6to4 has capability for sub-optimal routing, however, 6to4 does not have always sub-optimal routing (ie. When sending packets between two 6to4 sites) The service provider Some ISP deliver on purpose a 6to4 relay to increase the quality of IPv6 for their customers, but it costs $ and resources to maintain… and the service is not just (always) restricted to the ISP’s customers Content providers observe a measurable difference in RTT and reliability in some cases, and are hence reluctant to bring all services to mainstream IPv6 for all users “just yet”

The noble goal of the IPv6 Internet Provide a platform for content and services to be developed with high quality and performance A simple control plane for end-2-end connectivity The IPv6 Internet connectivity should be as good (or better) as the perceived quality of the IPv4 Internet All people and devices around the globe have the potential to be connected Allow connectivity to grow without limits Do non-managed tunnels follow these fundamentals?

The noble goal of the IPv6 Internet Provide a platform for content and services to be developed with high quality and performance A simple control plane for end-2-end connectivity The IPv6 Internet connectivity should be as good (or better) as the perceived quality of the IPv4 Internet All people and devices around the globe have the potential to be connected Allow connectivity to grow without limits Do non-managed tunnels follow these fundamentals?

Why do non-managed tunnels exist? Early adopters Not trivial to move a system in lock-step towards IPv6, and tunnels aid in this process Provide de-coupling between infrastructure IPv6 readiness and application readiness

Anycast/well-known address usage Asymmetric connectivity models when relying on 3 rd party relay Impacts statefull security services (firewalls) Anycast or other well known addresses may direct towards badly functioning relay-router 6to4 well-known relay addresses /24 Teredo MSFT default: teredo.ipv6.microsoft.com Non-managed Tunnel Properties IP Anycast/well known based service

Non-managed Tunnel Properties Performance There is a logistic decoupling of performance between (1) What the relay router can provide (2) What the user is expecting The impact is that initial deployments have been working really well, but if used for mainstream operation (for millions of customers, instead of the technologist), then performance expectation may not be stable (no motivation for the relay-router providers to upgrade capacity for non-customers) IP Anycast/well known based service User does typically not know who is owner of the relay listening to the well-known address

Non-managed Tunnel Properties Realm of control Operational provisioning - good tunnel performance and reliability is often outside the control of the person using the tunnel (3 rd party involvement, unforeseen traffic paths) Sub-optimal flows (increase in RTT and packet loss) If a low performance relay-router is overloaded due to non-managed tunnels, then how can user provide feedback on the bad performance? Who is responsible for troubleshooting if connectivity is degraded?

Non-managed Tunnel Properties Security Do you trust the 3 rd party ag/de-gregator Firewall, IDS and tunneling Lawful Intercept Tunnel security issues documented in “draft-ietf-v6ops-tunnel-security- concerns-02” are amplified by un-managed tunnels due to a lack of trust Tunnels may bypass Security inspection IP Ingress and Egress Filtering Source Routing after the tunnel client Non-trust of enterprise NOC manager towards tunnel security and openness DPI for tunneled packets NAT holes increase attack surface Tunnel address related risks 6to4 security considerations - rfc3964 – RFC from 2004

Conclusion Early adopters have been working fine with non- managed tunnels For mainstream usage: Blackholing Perverse traffic paths Lack of business incentive Difficult security model Hard to have a managed service relying on non-managed infrastructure Consequence: Reason that Content providers can’t offer universal IPv6 services Reason that white-listing complexity is being discussed

Next Steps Adopt as WG item? draft-vandevelde-v6ops-pref-ps-0014

15 draft-vandevelde-v6ops-harmful-tunnels-01.txt THANK YOU!