Subject: IPv6 networking: Bad news for small biz

From: Sabahattin Gucukoglu <[email-masked]>
Date: Tue, 3 Apr 2012 21:25:06 +0100

IPv6 networking: Bad news for small biz
### You may not get fired for buying Cisco, but you can go bust
http://www.theregister.co.uk/2012/03/31/ipv6_sucks_for_smes/

From the comments the author opines (among other things):
<quote>
The article exists for one reason: to let the high priests of the internet know “oh, BTW, that NPT66 thing that? It’s in products and in use in SME shops all over the damned place already.” In other words: the utter failure of the priesthood to engage care for the issues faced by SME outfits resulted in them (shockingly!) going out and choosing the cheap and simple alternative that actually already existed! Note the two key words: “cheap” and “simple.”
</quote>

That's us he's talking about.  It seemed only fair to share that perspective, since I don't see any other mention of the article here.  Needless to say, I really can't speak in polite terms of some of the shortsightedness demonstrated.

But of course, I'm always delighted to hear your opinions.  Is renumbering *really* that big of a deal?  I suppose multihoming is the bigger, more serious concern - that's the one we see no viable solution but NAT for, given small site constraints and aggregation.  And yet, here we are, on our way to flipping the big switch, and nobody seems to be in much of a panic.  I do not operate on sites large enough, or disaster-resistant enough, to know one way or the other how big of an issue this really is.  My gut feeling is that this article is not the whole story and that the author has worked up a good whinge.  But I do think the belligerent attitude in this article says we won't be long finding out just how far a NAT-free existence will get us.  Especially true given how much blame we get for "Not thinking it through properly" or, worse, directly compared with OSI protocols with all those fancy network path discovery features that we felt we didn't need, application-layer DNS kludges for failover, etc, that would have remediated these problems if the naysayers are to be believed.  No doubt there's work to be done.  I see already the progress made in v6ops of IPv6 multihoming without NAT.  Cool.  And, of course, there's HomeNet for putting the title of this article into question.

Cheers,
Sabahattin

---

From: Mark Andrews <[email-masked]>
Date: Wed, 04 Apr 2012 08:29:16 +1000

In message <[email-masked]>, Sab
ahattin Gucukoglu writes:
> =46rom the comments the author opines (among other things):
> <quote>
> The article exists for one reason: to let the high priests of the =
> internet know =93oh, BTW, that NPT66 thing that? It=92s in products and =
> in use in SME shops all over the damned place already.=94 In other =
> words: the utter failure of the priesthood to engage care for the issues =
> faced by SME outfits resulted in them (shockingly!) going out and =
> choosing the cheap and simple alternative that actually already existed! =
> Note the two key words: =93cheap=94 and =93simple.=94
> </quote>
> 
> That's us he's talking about.  It seemed only fair to share that =
> perspective, since I don't see any other mention of the article here.  =
> Needless to say, I really can't speak in polite terms of some of the =
> shortsightedness demonstrated.

He is also talking rubbish. 
 
> But of course, I'm always delighted to hear your opinions.  Is =
> renumbering *really* that big of a deal?  I suppose multihoming is the =
> bigger, more serious concern - that's the one we see no viable solution =
> but NAT for, given small site constraints and aggregation.

Total hogwash.  Add a bit of source address based routing within
the enterprise so that you hit the right exit routers for the source
address being used.  Tag route entries with valid source prefixes.
Add redirect based on source address signaling.

> And yet, =
> here we are, on our way to flipping the big switch, and nobody seems to =
> be in much of a panic.  I do not operate on sites large enough, or =
> disaster-resistant enough, to know one way or the other how big of an =
> issue this really is.  My gut feeling is that this article is not the =
> whole story and that the author has worked up a good whinge.  But I do =
> think the belligerent attitude in this article says we won't be long =
> finding out just how far a NAT-free existence will get us.  Especially =
> true given how much blame we get for "Not thinking it through properly" =
> or, worse, directly compared with OSI protocols with all those fancy =
> network path discovery features that we felt we didn't need, =
> application-layer DNS kludges for failover, etc, that would have =
> remediated these problems if the naysayers are to be believed.  No doubt =
> there's work to be done.  I see already the progress made in v6ops of =
> IPv6 multihoming without NAT.  Cool.  And, of course, there's HomeNet =
> for putting the title of this article into question.
> 
> Cheers,
> Sabahattin
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Fred Baker <[email-masked]>
Date: Wed, 4 Apr 2012 00:11:50 +0100

On Apr 3, 2012, at 11:29 PM, Mark Andrews wrote:

> Total hogwash.  Add a bit of source address based routing within the enterprise so that you hit the right exit routers for the source address being used.  Tag route entries with valid source prefixes. Add redirect based on source address signaling.

that's about 10% of the complexity for the edge network, and the author's point is that it's something they don't need to deal with in IPv4 due to NAT. I think the author of the article would point to the above tone as characteristic of the "priesthood" he's complaining about. You might want to rethink that.

---

From: Mark Andrews <[email-masked]>
Date: Wed, 04 Apr 2012 09:20:04 +1000

In message <[email-masked]
rks.com>, Greg Daley writes:
> Hi Mark,=20
> =20
> > > But of course, I'm always delighted to hear your opinions.  Is =3D
> > > renumbering *really* that big of a deal?  I suppose multihoming is the
> > > =3D bigger, more serious concern - that's the one we see no viable
> > > solution =3D but NAT for, given small site constraints and aggregation.
> >=20
> > Total hogwash.  Add a bit of source address based routing within the
> > enterprise so that you hit the right exit routers for the source address =
> being
> > used.  Tag route entries with valid source prefixes.
> Source based routing is a pain to maintain and to troubleshoot!

Why is a pain to maintain?  Because no one has written a routing
protocol to exchange the necessary information?  Routing engines
havn't been updated to use this information?  The border routers add
source address prefix tags to the routes they advertise internally
for the prefixes they have been delegated by the ISP.

This destination with these source addresses goes to this next hop.

If you have PI then "these source addresses" becomes ::/0 in most cases.

> In business-land I have had to pull out cruddy, unmaintainable solutions wh=
> ich modify normal routing behaviour and sit undocumented in various busines=
> ses.  This is salient because some of the businesses are small, or started =
> small.

So rather than make a maintainable solution you throw out the idea.
 
> Please don't suggest strange addressing or routing tricks, and I will not s=
> uggest strange DNS tricks ;-)
> 
> I would be OK if there was a straightforward RPF-like check which could be =
> applied at edge routers to ensure that packets exit via the correct ISP, bu=
> t my customers' routing tables are destination based, like 99% of the Inter=
> net.

And they still will be destination based with source addresses use
to differentiate between different entries.

> Greg Daley

---

From: Doug Barton <[email-masked]>
Date: Tue, 03 Apr 2012 17:01:40 -0700

On 4/3/2012 1:25 PM, Sabahattin Gucukoglu wrote:
> But of course, I'm always delighted to hear your opinions.  Is renumbering *really* that big of a deal?  I suppose multihoming is the bigger, more serious concern - that's the one we see no viable solution but NAT for, given small site constraints and aggregation.  And yet, here we are, on our way to flipping the big switch, and nobody seems to be in much of a panic. 

Some of us have been saying these things for 10+ years, and continue to
grumble them audibly periodically just in case someone might listen this
time.

Regardless of how it might offend the sensibilities of some (and however
misguided their reasoning might be), People Like NAT. Failure to learn
from the reasons why makes us more irrelevant day by day.

... and yes, renumbering IS that big a deal.

Doug

---

From: Masataka Ohta <[email-masked]>
Date: Wed, 04 Apr 2012 09:53:49 +0900

Mark Andrews wrote:

> address being used.

While source address based routing is not easy, it is a
lot less difficult than let end systems select the proper
source addresses.

> Tag route entries with valid source prefixes.

With IGP which can carry source prefixes for corresponding route
entries, an exit router of a route entry has a source prefix of
the route entry.

Thus, no source address based routing necessary.

						Masataka Ohta

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 04 Apr 2012 07:24:03 +0100

> ... and yes, renumbering IS that big a deal.

We could go on having this argument, or we could take constructive steps
to deal with the new flexibility that we have gained from IPv6, which indeed
leads to new problems to solve as we start to use that flexibility.

Oh look, we have WGs tackling those problems: MIF, HOMENET, 6RENUM, and
of course V6OPS.

   Brian

---

From: Masataka Ohta <[email-masked]>
Date: Wed, 04 Apr 2012 17:26:36 +0900

> leads to new problems to solve as we start to use that flexibility.

The problem of IPv6 is that it was so poorly architected that
it is fundamentally broken.

Expected new flexibility had resulted in just new complications
for nothing, which causes the new problems.

> Oh look, we have WGs tackling those problems: MIF, HOMENET, 6RENUM, and

Do look.

They are adding even new problems without any flexibility, of
course.

						Masataka Ohta

---

From: John C Klensin <[email-masked]>
Date: Wed, 04 Apr 2012 09:34:57 -0400

--On Wednesday, April 04, 2012 07:24 +0100 Brian E Carpenter
<[email-masked]> wrote:

>...
> We could go on having this argument, or we could take
> constructive steps to deal with the new flexibility that we
> have gained from IPv6, which indeed leads to new problems to
> solve as we start to use that flexibility.
> 
> Oh look, we have WGs tackling those problems: MIF, HOMENET,
> 6RENUM, and of course V6OPS.

And, for better or worse, the existence and work programs of
that large number of WGs -- seemingly growing over the years and
including SOFTWIRES and others that are more specifically
focused on transition -- leads some skeptics to conclude that we
still don't understand how to transition to IPv6 or to operate
it once we get there.   That may lead, in turn, to a "wait until
they do and, if necessary, deploy kludges in the interim"
strategy which probably does no one any good in the long term.

     john

---

From: Randy Bush <[email-masked]>
Date: Wed, 04 Apr 2012 06:36:31 -0700

>> enterprise so that you hit the right exit routers for the source
>> address being used.  Tag route entries with valid source
>> prefixes. Add redirect based on source address signaling.
> 
> that's about 10% of the complexity for the edge network, and the
> author's point is that it's something they don't need to deal with in
> IPv4 due to NAT. I think the author of the article would point to the
> above tone as characteristic of the "priesthood" he's complaining
> about. You might want to rethink that.

the priesthood does not think.  they just bury their heads deeper in the
sand and scream at others about why v6 is not deploying.

randy

---

From: Randy Bush <[email-masked]>
Date: Wed, 04 Apr 2012 06:41:07 -0700

> to deal with the new flexibility that we have gained from IPv6,

uh, i hate to spoil your fantasy.  but large ipv4 deployments want an
absolutely minimal, compatible, feature-match upgrade to ipv6.  they do
not want to study to adopt a new religion.  they have work to do.  and
they are the customer, and they have the money, not we.

after 15+ years of failure, that folk still spout this bs is simply
amazing and a tragic global scale indictment of the ietf.

randy

---

From: "Worley, Dale R (Dale)" <[email-masked]>
Date: Wed, 4 Apr 2012 09:59:01 -0400

> From: Randy Bush [[email-masked]]
> 
> large ipv4 deployments want an
> absolutely minimal, compatible, feature-match upgrade to ipv6.

I'm not in the loop, but it seems to me that this is obvious.

What has the IETF done to define a way that IPv4 deployments
can make the transition they want?  If IPv6 is better than IPv4 in
every way, this goal must be attainable.

Dale

---

From: "Worley, Dale R (Dale)" <[email-masked]>
Date: Wed, 4 Apr 2012 10:04:55 -0400

> From: Sabahattin Gucukoglu [[email-masked]]
> 
> Is renumbering *really* that big of a deal?

I'm no expert, but I see that it easily could be.  Renumbering is one of those
things that's easily understood by IT people, but much harder for non-IT people
to do.  Also, looking at which side of the bread is buttered, a laborious but
assuredly-successful project is a *good thing* if you're an IT person but a *bad thing*
if you're *paying* an IT person to do it.

What the customers want is to plug it in and have it work.  Surely we can
make that happen by now?  We've been at this for 40 or 50 years...

Dale

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 04 Apr 2012 16:49:53 +0100

Randy,

> absolutely minimal, compatible, feature-match upgrade to ipv6.  

Yes of course. Isn't that what straight dual stack deployment is
meant to provide? (I don't mean that it does provide it perfectly,
but that is the goal of straight dual stack and countless people
have reported that dual stack just works.)

The flexibility comes after that.

John,

On 2012-04-04 14:34, John C Klensin wrote:

> still don't understand how to transition to IPv6 

What we are seeing in the last few years is a search for
coexistence mechanisms for operators who are facing up to
IPv4 exhaustion without having rolled out IPv6 in time. That's
not a failure of the IETF; actually it's the IETF responding
to operators.

> or to operate
> it once we get there.

People who got there a while ago are operating IPv6 as a matter
of course. I don't see anything happening in IPv6 rollout that
didn't happen during IPv4 rollout ~20 years ago. Of course there
will be a shakedown period for every operator.

> "...deploy kludges in the interim"

Sad but true.

   Brian

---

From: Greg Daley <[email-masked]>
Date: Wed, 4 Apr 2012 08:39:32 +1000

Hi Sabahttin,

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Sabahattin Gucukoglu
> Sent: Wednesday, 4 April 2012 6:25 AM
> To: [email-masked]
> Subject: IPv6 networking: Bad news for small biz
> 
> The article exists for one reason: to let the high priests of the internet
> know "oh, BTW, that NPT66 thing that? It's in products and in use in SME shops
> all over the damned place already." In other words: the utter failure of the
> priesthood to engage care for the issues faced by SME outfits resulted in them
> (shockingly!) going out and choosing the cheap and simple alternative that
> actually already existed! Note the two key words: "cheap" and "simple."
> </quote>
> 
> That's us he's talking about.  It seemed only fair to share that perspective,
> since I don't see any other mention of the article here.  Needless to say, I
> really can't speak in polite terms of some of the shortsightedness
> demonstrated.
> 
> But of course, I'm always delighted to hear your opinions.  Is renumbering
> *really* that big of a deal?  I suppose multihoming is the bigger, more
> serious concern - that's the one we see no viable solution but NAT for, given
> small site constraints and aggregation.  And yet, here we are, on our way to
> flipping the big switch, and nobody seems to be in much of a panic.  I do not
> operate on sites large enough, or disaster-resistant enough, to know one way
> or the other how big of an issue this really is.  My gut feeling is that this
> article is not the whole story and that the author has worked up a good
> whinge.  But I do think the belligerent attitude in this article says we won't
> be long finding out just how far a NAT-free existence will get us.  Especially
> true given how much blame we get for "Not thinking it through properly" or,
> worse, directly compared with OSI protocols with all those fancy network path
> discovery features that we felt we didn't need, application-layer DNS kludges
> for failover, etc, that would have remediated these problems if the naysayers
> are to be believed.  No doubt there's work to be done.  I see already the
> progress made in v6ops of IPv6 multihoming without NAT.  Cool.  And, of
> course, there's HomeNet for putting the title of this article into question.

Of course, The Register does have a reputation of being an IT tabloid, but ...

Renumbering in small organizations _is_ a big deal, especially when they don't have in-house skills to manage systems.

They may not even have the skills to determine that something deployed in their network has failed renumbering, or is left behind due to static configuration.

I was at "Cisco Live" a week or so ago, and the Cisco advisor stated that people should use PA Global addressing and not even look at ULA (even for internal resources). 

With approaches like that, renumbering will be a significant pain, or people will just not change ISP.

What we need is simple, template guidance for SMEs that can be deployed to reduce the risk of future costs in IPv6 deployment, and minimizes the cost of operating and troubleshooting networks in the mean time.

Sincerely,

Greg Daley

---

From: Greg Daley <[email-masked]>
Date: Wed, 4 Apr 2012 08:46:28 +1000

Hi Mark, 
 
> > = bigger, more serious concern - that's the one we see no viable
> > solution = but NAT for, given small site constraints and aggregation.
> 
> enterprise so that you hit the right exit routers for the source address being

In business-land I have had to pull out cruddy, unmaintainable solutions which modify normal routing behaviour and sit undocumented in various businesses.  This is salient because some of the businesses are small, or started small.

Please don't suggest strange addressing or routing tricks, and I will not suggest strange DNS tricks ;-)

I would be OK if there was a straightforward RPF-like check which could be applied at edge routers to ensure that packets exit via the correct ISP, but my customers' routing tables are destination based, like 99% of the Internet.

Greg Daley

---

From: Doug Barton <[email-masked]>
Date: Wed, 04 Apr 2012 12:50:18 -0700

> Oh look, we have WGs tackling those problems: MIF, HOMENET, 6RENUM, and

Right, and a lot of that work is useful/relevant, and as you know I've
participated in some of those discussions.

My comments were directed towards those who still have the mindset, "NAT
is the enemy, and must be slain at all costs!"

Doug

-- 
    If you're never wrong, you're not trying hard enough

---

From: Randy Bush <[email-masked]>
Date: Wed, 04 Apr 2012 16:49:38 -0700

> The flexibility comes after that.

it's been fifteen years.  i guess the wonderful flexibility will come
in another decade or two.  btw, i hope it works through massive ipv4
natting, because that is what you religious ipv6 high priests have
given us.

> What we are seeing in the last few years is a search for coexistence
> mechanisms for operators who are facing up to IPv4 exhaustion without
> having rolled out IPv6 in time. That's not a failure of the IETF;
> actually it's the IETF responding to operators.

it is an abject failure of the ietf.  they did not roll it out because
they thought they were in business, not in religion.  and ipv6's
incompatibility and the high cost of its kinkiness made no business
sense.

randy

---

From: Hector <[email-masked]>
Date: Wed, 04 Apr 2012 20:27:54 -0400

I always wondered how the world would be today if we layman market of 
users and operators now had to remember their IPv6 number as we easily 
can do today with #.#.#.# format and also perhaps privately publish it 
for their customers. The assumption that every public IP has a public 
domain associated is not always the case.  It seems that this would be 
a tuned out ergonomic factor with IP6.

---

From: David Conrad <[email-masked]>
Date: Thu, 5 Apr 2012 12:58:04 -0700

Brian,

On Apr 4, 2012, at 8:49 AM, Brian E Carpenter wrote:
> meant to provide?

Well, no.  Dual stack was meant to allow people to continue to run IPv4 to do IPv4 things and also run IPv6 to do IPv6 things.  I believe Randy is saying that the folks who run large IPv4 deployments want IPv6 to (at least) do the same things as IPv4.

However, since Dual Stack was a failure as a transition strategy, I'm not sure why raising it is even relevant.

Regards,
-drc

---

From: Fred Baker <[email-masked]>
Date: Fri, 6 Apr 2012 05:46:40 +0200

> Renumbering in small organizations _is_ a big deal, especially when they don't have in-house skills to manage systems.

I tried to look at that in RFC 4192. The question isn't whether it's a pain or not; it's what makes it painful. If building and deploying a protocol that will automagically renumber devices in a network will solve that, let's spruce up RFC 2894 and make it happen.

In the discussions we had, it turned out to be that any automated service solved the easy 99% of the problem, whether it's done using DHCP, and fancy protocol, or a database back end. The real issues in renumbering aren't so much the process of distributing prefixes (IPv6 networks, route maps, ACLs, and so on) as much as dealing with broken software that makes silly assumptions about addresses - that an address that is meaningful to me is meaningful to you, that addresses once assigned never change, that a host or service has exactly one address, that given that knowledge one doesn't need to worry about names, and so on. Unfortunately, when one actively goes out of one's way to bypass anything that would allow us to automate the procedure, automated procedures can't help us.

I agree that renumbering is a pain. I'm not certain what we could do in the protocol that fixes "stupid".

That said, I'll put in a plug for RFC 6296, or for ILNP. ILNP would be a superior solution if I thought I could change TCP and UDP; I think RFC 6296 is a pragmatic step that is actually deployable (and deployed).