Subject: RE: site-local observations from the outside

From: "Michel Py" <[email-masked]>
Date: Mon, 4 Aug 2003 10:46:30 -0700

Todd,

> Todd T. Fries wrote:
> Either you have link-local addresses, or you have
> global routable addresses.

From a transit provider point of view this is true, but not for the
enterprise. There are lots of large networks that require private
addresses and use RFC1918 today. Examples that have been discussed
before are a large cruise ship and utility companies. Part of the
requirements is that private addresses must not be routed on the public
Internet.

> Any attempt at providing something that is site local suggests
> to me that you open the doors wide for something like NAT,
> which of course none of us wants.

There is some truth to this, but in the end avoiding NAT will not be
achieved by not providing site-local addresses, as they are not required
per say; people that need them will simply hijack an unused block in the
middle of nowhere in the IPv6 address space, like they did for IPv4 pre
RFC1597/RFC1918. A good hijack candidate is 2002:RFC:1918, for example.
The only way to avoid NAT is to provide what NAT does, which is
portable, globally unique, globally routable addresses, which we don't
have today.

> There is enough address space in the global table,

Wrong. There is enough address space today, but the global routing table
cannot handle billions of entries, at least not with BGP4+. It's not a
matter of memory, it's a matter of stability.

> why can we not have some sort of free reservation system
> (the free tunnel brokers would suggest it is economically
> feasible) for sites that want local addresses but do not
> intend on globally routing them.

jj has proposed something like this not too long ago. A draft soon?

Michel.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Bound, Jim" <[email-masked]>
Date: Sat, 9 Aug 2003 09:49:24 -0400

As one who has been here since the beginning and implemented this
protocol I agree with you.  I do think Bob Hinden has given us a
compromise that is acceptable but alas we are not able to move on here
as children it seems to me.

/jim

> -----Original Message-----
> From: Todd T. Fries [mailto:[email-masked]] 
> Sent: Monday, August 04, 2003 12:38 PM
> To: [email-masked]
> Subject: site-local observations from the outside
> 
> 
> While I do not pretend to be the most versed in all of the 
> IPv6 related RFC's, I am questioning what the goals of 
> site-local or a similar replacement would be.
> 
> Either you have link-local addresses, or you have global 
> routable addresses.
> 
> Any attempt at providing something that is site local 
> suggests to me that you open the doors wide for something 
> like NAT, which of course none of us wants.
> 
> There is enough address space in the global table, why can we 
> not have some sort of free reservation system (the free 
> tunnel brokers would suggest it is economically feasible) for 
> sites that want local addresses but do not intend on globally 
> routing them.
> 
> Should these sites want connectivity to the global internet, 
> they would then get an allocation from their ISP as necessary.
> 
> I expect I'm missing something, but perhaps not.
> -- 
> Todd Fries .. [email-masked]
> 
> 
> Free Daemon Consulting, LLC                    Land: 405-748-4596
> http://FreeDaemonConsulting.com              Mobile: 405-203-6124
> "..in support of free software solutions."
> 
> Key fingerprint: 37E7 D3EB 74D0 8D66 A68D  B866 0326 204E 3F42 004A
>             Key: http://todd.fries.net/pgp.txt
> 
> (last updated 2003/03/13 07:14:10)
>

---

From: "Bound, Jim" <[email-masked]>
Date: Sat, 9 Aug 2003 10:02:03 -0400

Michel,

If we simply say these NEVER leave the site then all is fine.  Thats the
bottom line.

/jim

> From: Michel Py [mailto:[email-masked]] 
> Sent: Monday, August 04, 2003 1:47 PM
> To: [email-masked]; [email-masked]
> Subject: RE: site-local observations from the outside
> 
> 
> Todd,
> 
> > Todd T. Fries wrote:
> From a transit provider point of view this is true, but not 
> for the enterprise. There are lots of large networks that 
> require private addresses and use RFC1918 today. Examples 
> that have been discussed before are a large cruise ship and 
> utility companies. Part of the requirements is that private 
> addresses must not be routed on the public Internet.
> 
> 
> suggests to me 
> > that you open the doors wide for something like NAT, which 
> of course 
> > none of us wants.
> 
> There is some truth to this, but in the end avoiding NAT will 
> not be achieved by not providing site-local addresses, as 
> they are not required per say; people that need them will 
> simply hijack an unused block in the middle of nowhere in the 
> IPv6 address space, like they did for IPv4 pre 
> RFC1597/RFC1918. A good hijack candidate is 2002:RFC:1918, 
> for example. The only way to avoid NAT is to provide what NAT 
> does, which is portable, globally unique, globally routable 
> addresses, which we don't have today.
> 
> 
> Wrong. There is enough address space today, but the global 
> routing table cannot handle billions of entries, at least not 
> with BGP4+. It's not a matter of memory, it's a matter of stability.
> 
> 
> > feasible) for sites that want local addresses but do not intend on 
> > globally routing them.
>

---

From: "Michel Py" <[email-masked]>
Date: Sat, 9 Aug 2003 12:11:53 -0700

Jim,

> Jim Bound wrote:
> If we simply say these NEVER leave the site then all
> is fine. Thats the bottom line.

I'm ok with that. Not only never leave the site but making sure that
they can't.

Michel.

---

From: "Bound, Jim" <[email-masked]>
Date: Thu, 14 Aug 2003 23:46:11 -0400

Valid.  If it goes to RFC status will that make you comfortable?
thanks
/jim

> Sent: Sunday, August 10, 2003 3:11 PM
> To: Bound, Jim; [email-masked]
> >>> If we simply say these NEVER leave the site then
> >>> all is fine. Thats the bottom line.
> 
> >> Michel Py wrote.
> >> I'm ok with that. Not only never leave the site but
> >> making >sure that they can't.
> 
> > Even better yes. They "can't".
> 
> You can't guarantee that for the Hinden/Haberman draft, which 
> is the reason I will not use it until we have a solution on a 
> PI-like setup. It's a matter of risk: If I use the 
> Hinden/Haberman draft as private addresses, and if it ends up 
> being perverted as PI, my entire network design goes to the 
> trash. If I hijack a random prefix for private addresses, the 
> risk of collisions although not null is a lot less.
> 
> Michel.
> 
> 
>

---

From: "Michel Py" <[email-masked]>
Date: Thu, 14 Aug 2003 22:54:13 -0700

Jim,

> Valid.  If it goes to RFC status will that make

Nope. The very point I am trying to make is that RFC != enforcement
mechanism.

Michel.