Subject: RE: another renumbering question

From: [email-masked]
Date: Wed, 7 Feb 2001 20:15:00 -0600

hello paul (long time since we have talked),

> > Common where? Yes for firewalls and extranets I agree.   
> But that is not
> the
> > same paradigm as two face dns for sitelocal addresses as an
> implementation.
> > Two different beasts all together.  And the world is not 
> good today to
> with
> > all the NAT and Tunnels it is horrible we should be careful to not
> propogate
> > such behavior whenever possible with IPv6.
> >
> 
> So Jim, in the absense of two-faced DNS how do you think a host should
> decide whether it should use site-local for another host, or 
> do you think
> using site-local addresses is a bad idea?
> 

Its no secret I think site-local addresses are a bad idea and have not
decided how to even find something good about them in the book I am writing
about IPv6.  But we are stuck with them and we need to use them very
carefully and put limitations on there use like we do handguns in the U.S.
or have health warnings for them for users like the sign I have in the back
of my woods "Nevermind the Dog beware of the Owner".  They should only be
exposed within a site.  They should never be used as a source address to any
dst address of greater scope under any circumstances.  If we could get all
to follow these simple precepts they may not poison the innocent users
adopting IPv6 who are duped to use them under the guise of the ill-begotten
mantra of dynamic renumbering, who should be able to use global IPv6
addresses without ever having to use anything else for peer to peer
application communications. But the solution I would provide to a customer
if I was an IPv6 Consultant who insisted on using them is to not permit
multisited servers across site boundaries for DNS at all. Any multisited DNS
servers (or DHCPv6 servers) should never be deployed and support site-local
addresses as RRs or IP addresses for assignment.  If a server is multisited
(wire to two different site logical points) it only supports global
thingees.  This just eliminates the problem.

I do think site-local addresses may be useful for traffic engineering or
routing exchanges within a site or multisite boundary but that is work for
further study.  But for peer to peer apps end-2-end, etc for applications
folks run their business on they are unacceptable just so folks have
renumbering.  The business and administrative trade-offs are not worth and
also I could show same customer how to renumber their network with global
IPv6 addresses with tools and specs we have today so saying there useful for
renumbering is bogus for me.

But as an engineer who builds products I will have to support this garbage
in the IPv6 architecture just like abusive tunneling protocols and NAT in
IPv4.  But this garbage should  not be propogated to customers servers that
are multisited.

Using the firewall and NAT argument is naive and not the same.  I know this
from building shipping products and to support gateway mechanics at one
point in a network in a controlled box at the ingress/egress point of the
Intranet is far far different than supporting multisited servers across many
sites within an Intranet and control it.  In theory and 10,000 foot level
discussions and maybe on some powerpoint weak architecture slideware it
appears to the the same but down where the grunts live building server
software and maintaing state machines for the database and shipping this
stuff its not the same thing at all.

regards,
/jim

regards,
/jim
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: [email-masked]
Date: Thu, 8 Feb 2001 10:24:16 -0600

> 
> Firewalls are no reason for a two faced DNS.   Those are 
> forced upon us by
> NAT, because of the re-use of addresses.  With IPv6 we will 
> have no need
> to re-use addresses, and so no reason to bother with two 
> faced DNS (which
> isn't to say that they may not still be people who would 
> prefer to use it).

good point at dec we did this with our net 16 address exactly and two face
dns was not
required.

so the firewall argument is bogus here.

/jim

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 08 Feb 2001 12:30:05 -0500

>so the firewall argument is bogus here.

There are several reasons for using two-faced DNS with firewalls.
First, there's the desire to hide inside hosts.  A domain name such as
myhost.supersecretproject.somecompany.com is rather revealing.
Second, there's the risk of DNS cache contamination.  DNSSEC will
solve that problem, but of course DNSSEC isn't deployed yet.
You also tend to need different name servers internally for subdomains
-- and hence different NS records -- because internal name servers
are inside the firewall, and not reachable from the outside.  (The
recent set of BIND security holes is ample evidence for the wisdom
of this policy.  One of the main reasons for firewalls is to shield
all the myriad services running on the inside from the consequences
of as-yet unknown bugs.)  The same can be said of MX records -- I want
internal mail to stay internal, but I also don't want externally-
originating mail to have to wait for several minutes of futile attempts
to contact internal MX designees.

You may disagree with some of the above reasons.  Lots of folks buy
in to some of them, enough that there's a lot of two-faced DNS
setups out there, and I don't see anything in v6 that will make
them go away.
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: [email-masked]
Date: Thu, 8 Feb 2001 11:33:10 -0600

I am passing on talking to you on this one we can't seem to connect.  I
don't agree with you and your chanting mantras and belief systems at me and
I am trying to bring you down to the implementation details.  site locals
will be managed and controlled.  as one person I will not advocate them.
pretty simple really.  good bye on this thread.

/jim

> -----Original Message-----
> From: ext Brian E Carpenter [mailto:[email-masked]]
> Sent: Thursday,February 08,2001 12:09 PM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]; [email-masked]
> Subject: Re: another renumbering question
> 
> 
> I really think you're missing my point, which is that this is 
> nothing to do
> with NAT; people were hiding internal-only hosts for years 
> before NAT came along,
> and they always will. This is nothing to do with address 
> space. Your border
> router doesn't route unsolicited packets to the hidden host 
> and your external 
> DNS doesn't propagate its RRs. Hiding site-local addresses is 
> no different.
> 
>   Brian
> 
> [email-masked] wrote:
> > 
> > no he is not.  I know three large corporations using the 
> fact that they got
> > nice large ipv4 address space and do this in totally secure 
> manner.  the
> > evil here is nat your concerned about and site local 
> addresses can cause
> > that evil again.  also many of the ietf mantras are getting 
> trashed in the
> > real world.  we need to update our mantras.
> > 
> > /jim
> > 
> > > -----Original Message-----
> > > From: ext Brian E Carpenter [mailto:[email-masked]]
> > > Sent: Thursday,February 08,2001 11:28 AM
> > > To: Robert Elz
> > > Cc: [email-masked]; [email-masked]; 
> [email-masked]
> > > Subject: Re: another renumbering question
> > >
> > >
> > > Robert Elz wrote:
> > >
> > > >   | Why would any enterprise publish the A record of
> > > internalserver.example.com
> > > >   | outside the firewall?
> > > >
> > > > Why wouldn't they?
> > >
> > > Truly, you are out of touch with the way large corporate
> > > intranets are run.
> > >
> > >   Brian
> > >
>

---

From: [email-masked]
Date: Fri, 16 Feb 2001 09:49:28 -0600

> 
> On a separate note, I know this is probably just digging up dead
> discussions, but have people considered creating a new IPv6 
> space which is
> "globally unique but not globally routable" for use in this 
> sort of internal
> site communications?  Such an address space would be useful, 
> for instance,
> when merging two sites (which, if using site-local addresses, 
> will require
> renumbering of one of the sites).
> 
> Such addresses (lets call them unique-local addresses) could 
> be put in DNS
> without concern for thier being mis-interpreted by other 
> nodes.  Granted
> when a node did a DNS lookup, it wouldn't know if a given unique-local
> address was in the same site, but it could learn easily by 
> just sending a
> packet to that address and either succeeding or getting an ICMP dest
> unreachable.

I was thinking on this too the other day.  We have room for additional
scopes.
Would an organizational scope fit your model which would be > than
site-local.
Then multisited servers would only hold organizational and avoid the global
address if they want to.

/jim

---

From: Samita Chakrabarti <[email-masked]>
Date: Fri, 16 Feb 2001 13:12:48 -0800 (PST)

> 
> > I think there are two motivations for site-locals (that not everybody
> > agrees with):
> > 1. For sites that are isolated i.e. do not have a global prefix.
> > 2. To completely isolate traffic local to a site from 
> > site-renumbering events.
> 
> Let me add a third motivation - site-local addresses allow for very
> simple security policies or filters. For example the default
> configuration for a file server might be to provide service only to
> site-local clients.
> 

Another good example for this is an admistrative domain which does not
want to expose it's internal ipv6-address topology to outside world.
The nodes within this administrative domain communicate with each other
only and do not require to communicate with outside world or communicate
through only one node (in that domain) which maintains global addresses.
Site-local addresses are appropriate choice in this scenario. This may
be a scenario when we envision IPv6 in the operator's access
network.

-Samita

---

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Sat, 17 Feb 2001 12:09:25 +0100

> > >
> > => Another reason, is the ability to discover
> > some "basic" services within a site. The DNS discovery
> > draft has recommended the Site-local anycast address
> > for this purpose.
> >
> 
> Yeah, anycast with site scope strikes me as a good use of site locals.  On
> the other hand, DHCP provides an example of discovery with link-locals, so
> there are other ways of doing it.
> 
	=> Sure, we also have stateful and stateless address 
	configuration. I'd rather not have a DHCP server if 
	I can. 

	Hesham