Re: I-D ACTION:draft-huitema-multi6-ingress-filtering-00.txt

This is useful. Just a couple of comments:

>    The topology features two hosts, X and Y, whose respective sites are
>    both multi-homed.  Host X has two global IPv6 addresses, which we
>    will note "A:X" and "B:X", formed by combining the prefixes allocated
>    by ISP A and B to "site X" with the host identifier of X.  Similarly,
>    Y has two addresses "C:Y" and "D:Y".

Note that "X" in A:X and B:X need not be the same bit string-
more correctly you should perhaps refer to A:X1 and A:X2,
where X1 and X2 are two different interface identifiers for host X.

Same for Y of course (and in draft-huitema-multi6-addr-selection-00.txt).

I don't think this changes the argument at all.

Single site exit router versus DMZ:

I think there is a third case that you haven't considered, which is
a multi-site enterprise network.  I have to draw it:


         ISP A         ---ISP B---           ISP C
           \          /           \           /
            \        /             \         /
          ------------             ------------
         |   DMZ 1    |           |    DMZ 2   |
          ------------             ------------
               |                         |
               |                         |
          ------------    IGP      ------------
         | sub-site 1 |-----------| sub-site 2 |
          ------------             ------------

In this scenario, prefix A, B or C may be in use at either
of the subsites and a packet from subsite 1 with source
prefix C may end up in DMZ 1. (Just the same if you have a
single site exit router instead of a DMZ.) In this case,
I think tunnels between the two DMZs (or exit routers)
are inevitable.

This is a real scenario.

     Brian