Subject: Exposing DC topology in IIDs [draft-zhang-6man-scale-large-datacenter-00.txt]

From: Brian E Carpenter <[email-masked]>
Date: Sun, 15 Mar 2015 10:52:15 +1300

Hi,

This draft wants to find up to 24 bits for  Cluster ID/Switch ID addressing.
If the DC has its own /24, that's simple (draft-smith-enhance-vne-with-ipv6).

That isn't craziness. 2000::/3 contains two million of them; an RIR
policy allowing large DCs to have their own /24 seems perfectly
imaginable.

> A public IPv6 address block can be procured from IANA.

Actually, from an address registry such as an RIR or LIR.

Also, this implies that these addresses will be visible outside
the DC, or else a ULA prfix would be sufficient. Therefore:

> 14. Security
> 
> 
>    No new security threat is expected to be imposed by this proposal.

I would have thought that IPv6 addresses that transparently reveal
the topology of a multi-tenant hosting centre would be considered a
threat, because they simplify scanning attacks and damage the kind of
privacy implied by draft-ietf-6man-default-iids.

At least, I am glad to find that "No IPR disclosures have been
submitted directly on draft-zhang-6man-scale-large-datacenter."

Regards
   Brian

---

From: Christopher Morrow <[email-masked]>
Date: Sat, 14 Mar 2015 18:02:53 -0400

> the DC, or else a ULA prfix would be sufficient. Therefore:

gosh, I wish that ULA didn't exist :(

ULA isn't necessarily (I would say 'never', but... ships sailing and
all that) sufficient.
Also, plans change and today you may not send the /24 externally, but
tomorrow you might have to.

> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------