RE: When to do Return Routability Checks

hi francis, 

>  In your previous mail you wrote:
> 
>    discussions during the ietf meeting (see issue tracker web 
> page) concluded
>    that it is a policy issue when to perform the return 
> routability checks.
>    this conclusion seems to be fine with me. i will try to 
> produce a new text
>    proposal. 
>    
> => this is my position but there is an exception: the update 
> is to an authorized* address but from an unknown address. A 
> RR check should be performed in this case, not because of a 
> security issue, but because the node can have just moved 
> behind a NAT (the RR check for the authorized address fails, 
> the RR check for the unknown (in fact NATed) address succeeds).

i have read this paragraph several times but i am not quite sure that i
understood it. 
a picture might help....


ciao
hannes
> 
> *I use the term "authorized" in order to keep the policy 
> decision to the peer, i.e., the RR check can be a part of the 
> authorization procedure.
> 
> Regards
> 
> [email protected]
>