Re: [DNA] Question regarding prefix assignment

[Brett Pentland <brett.pentland@eng.monash.edu.au>]

dunmore@comp.lancs.ac.uk wrote:
> Tero Kauppinen wrote:
> 
> 
>>During the yesterday meeting it was brought up that using prefixes to
>>conclude whether a link has changed or not can be problematic
>>in certain
>>cases. Can someone confirm whether the following scenario is
>>possible or
>>not?
>>
>>                Router(s) advertising
>>                  prefixes A and B
>>                         |
>>                         |__________X_______ AP2
>>                         |                  (may use only prefix A)
>>                         |
>>                         |
>>                        AP1
>>               (may use prefixes A and B)
>>
>>X marks a box-in-the-middle e.g. a bridge (as mentioned yesterday).
>>
>>If this is possible, the problem lies here in the fact that
>>if the node
>>is first connected to the AP1 it can configure either prefix
>>A or B, and
>>if it then moves to AP2 it may only use prefix A even though still
>>connected to the same link. Let's assume that a node uses
>>prefix B and
>>is connected to AP1. It also knows that the complete prefix
>>list for the
>>current link is A and B. It then moves to AP2 and receives an RA,
>>notices that the advertised prefix(es) match and thus link has not
>>changed. However, it's now using prefix B which is not valid
>>under this
>>section of the link.
>>
>>If this is the case, I'm also curious how you actually prevent a node
>>connected to AP2 from not configuring prefix B. Do the box X
>>hassle with
>>router advertisements?
>>
> 
> 
> I believe this scenario *could* be possible but I'm not sure any sane
> administrator would do this. If X is a vlan switch and the switch allows
> vlan tags to be switched to multiple ports, then you could have a scenario
> such as
> 
> vlan x = prefix A
> vlan y = prefix B
> 
> and
> 
> vlan x switched to AP2 and AP1
> vlan y switched to AP1 (thus only AP1 gets RAs for prefix B)
> 
> The only reason I can think of why anyone would do this is if there is some
> administrative reason why only AP1 should see prefix B. Perhaps this would
> be a restricted prefix that equates to an SSID for a 'top secret' meeting
> room.

I think that in this case, we would detect attachment to the VLANs.  If
we attach to AP2, vlan x, we receive prefix A.  If we move to AP1, vlan
x, we see prefix A, and should through some means decide that we have 
not moved (logically) and our configuration is still valid.

If we move to AP1, vlan y, we see prefix B and through some means should 
decide that we have moved and need to reconfigure.

If we move to AP1 and can receive packets from both vlans x and y at the 
same time, then things get messy.  If we can abstract connections to 
vlans as virtual interfaces, then we can probably treat them separately 
and apply DNA on a per-virtual-interface basis.  If not, then I'm not 
sure how best to deal with the situation.

Any thoughts?
Brett.