Subject: RE: another view of fc00::/7

From: "Michel Py" <[email-masked]>
Date: Tue, 10 Jun 2003 07:58:44 -0700

Kre,

> Robert Elz wrote:
> So, you mean there's a need to have address stability
> inside the VPN?

On some, more than anything else. For example, if the VPN is used as
part of a supply chain, there are access-lists on both ends and a lot of
other manual config all over the place because this involves getting
access into some protected areas of the system.

> I always thought a VPN was more about access control,
> rather than anything else.

Access control means access-lists and similar annoyances and they don't
change dynamically. This blends with the renumbering issue that I don't
want to open again but a perfect example of "un-renumberable" network is
a large, multi-company VPN setup.

> I can't see any particular reason why address stability is
> any more required there than the internet at large.

Because VPN configurations are sometimes a lot more complicated than
Internet configurations.

Michel.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Robert Elz <[email-masked]>
Date: Tue, 10 Jun 2003 23:54:22 +0700

Date:        Tue, 10 Jun 2003 07:58:44 -0700
    From:        "Michel Py" <[email-masked]>
    Message-ID:  <[email-masked]>

  | Access control means access-lists and similar annoyances and they don't
  | change dynamically.

This is something that needs fixing.   We need it to make renumbering
possible.

  | This blends with the renumbering issue

Yes exactly.

There is no great technical problem here (which isn't to say it is trivial)
it just needs the incentive to actually get it to be done.

kre