Subject: RE: Why IPv6 is a must?

From: Charles Adams <[email-masked]>
Date: Wed, 28 Nov 2001 13:05:12 -0600

> Look, either your fridge is accessible from outside so that you can check
> how much milk you have from the office, or it isn't. That's independent
> of whether its address happens to be NATted. It's dependent on the
> security policy you choose to apply.
>
>    Brian

So does that mean that if I take down my firewall (i.e. my security policy),
you'll be able to ping my servers whose addresses are NATted???

Let me propose a new question....

If there is a means for all hosts to have addresses that are reachable from
all other hosts (barring that a security policy is in place), will companies
renumber their internal networks to coincide with this addressing scheme?

If we (the Internet community) used private addresses and NAT for all hosts
that do not want/need/require access from the Internet, would the addressing
problem be as much of a problem as it appears to be?  If we are as generous
with the IPv6 addresses, how soon before we have the same address problem?

Charles

---

From: "Tony Hain" <[email-masked]>
Date: Wed, 28 Nov 2001 12:10:15 -0800

> with the IPv6 addresses, how soon before we have the same

If you want a set of hosts to be only reachable internally, then set the
policy to use site local addresses. For the set of nodes that need both
internal addresses and external addresses, you don't need NAT like you
do for IPv4, because each IPv6 host will have both a site-local & a
global address to use. This will use exactly the same amount of address
space as a static-mapped non-port-sharing IPv4 NAT, and has exactly the
same security implications. The difference is that with IPv6, the end
host knows its real address, and can take advantage of that knowledge
for protocols that need it (IPsec, H.323, FTP, etc). THe only way the
IPv4/NAT scenario limits address usage is when ports are shared, which
limits which devices get a given port and when.

Tony

---

From: Keith Moore <[email-masked]>
Date: Wed, 28 Nov 2001 16:01:03 -0500

> renumber their internal networks to coincide with this addressing scheme?

given that they could easily derive IPv6 addresses from the current IPv4
numbers in use, I don't see why not.

even in IPv4, renumbering is only difficult because we haven't really
tried to develop good tools for doing it.

> problem be as much of a problem as it appears to be?  

there's a dubious assumption that any significant group of hosts does not
want/need/require access from the Internet - and especially that you can
separate the hosts that do need such access from ones that don't.  

> If we are as generous with the IPv6 addresses, how soon before we have 
> the same address problem?

so long that by the time it happened, we wouldn't be using any of the
same platforms, applications, or protocols.

to the extent that the danger of IPv6 address exhaustion exists, it
isn't from using them like we do IPv4 addresses.  it requires doing
things like assigning a separate IPv6 address to every process created, 
or every smart pill that someone swallows (daily) to diagnose potential 
medical problems, or every network-capable toy that gets included as a 
prize in a cereal box, AND using lots of delegation layers in routing.

Keith