Subject: RE: Address allocation schemes (Re: Naming and site-local)

From: "Michel Py" <[email-masked]>
Date: Tue, 12 Nov 2002 08:02:51 -0800

> Margaret Wasserman wrote:
> But, what I don't understand is how the use of
> overlapping site-local addresses on globally-attached
> networks is any better than NAT.

It's not as bad (does not break apps that embed port numbers in the
payload, for example) but this is an irrelevant argument: it still is
bad.

As I said before, it seems that everyone agrees that a globally unique
site-local would be the way to go, but there are two major roadblocks to
remove on that path:
- Make sure that site-locals are not globally routable (I posted some
comments about this earlier)
- Solve the multihoming issue.

Only when these are solved will we be able to move ahead towards
globally unique, not globally routable site-locals. In the meantime, the
crusade to remove site-locals is futile and a waste of everyone's time
as 1. they have reached previous consensus and 2. will continue to be
used until a better mouse trap is available.

Michel.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Keith Moore <[email-masked]>
Date: Tue, 12 Nov 2002 12:44:25 -0500

> comments about this earlier)

seems fairly easy.  the hard part is the wordsmithing.

- addresses with this prefix range MUST NOT be advertised to other networks.

- advertisements for addresses with this prefix range that are received from
other networks SHOULD be filtered

- traffic with source or destination addresses in this prefix range
SHOULD be filtered from external connections unless there is an explicit
agreement with the peer to accept traffic for a specific range of addresses. 

> - Solve the multihoming issue.

Multihoming is a problem, but the multihoming issue seems orthogonal 
to site-locals.

Keith

---

From: Margaret Wasserman <[email-masked]>
Date: Tue, 12 Nov 2002 12:54:27 -0500

Do you meant to imply that a separate block of addresses should be
set aside for non-globally-routable globally-unique addresses?

I'm not sure what we gain by doing that, as opposed to setting aside
private address space from any global prefix by filtering it at
administrative boundaries...

Margaret

---

From: Keith Moore <[email-masked]>
Date: Tue, 12 Nov 2002 13:03:14 -0500

> set aside for non-globally-routable globally-unique addresses?

yes.

> administrative boundaries...

we need the ability to assign global prefixes to sites that aren't
directly connected to the public Internet, even though they might
be connected to large numbers of other networks.

Keth

---

From: Pekka Savola <[email-masked]>
Date: Tue, 12 Nov 2002 20:39:49 +0200 (EET)

> be connected to large numbers of other networks.

Allocating one /32 and giving these sites a /48 each should last for the
first 64k such private networks (which are assumed to be rather rare).

Should be pretty easy to accomplish if this is really necessary..

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Keith Moore <[email-masked]>
Date: Tue, 12 Nov 2002 13:43:33 -0500

> first 64k such private networks (which are assumed to be rather rare).

they might be more plentiful than you think.  I have no problem 
with starting out with a /32  but perhaps that /32 should be allocated
from the "top end" of (otherwise unallocated) v6 space so that 
additional allocations could be aggregated with the initial one in
a single prefix (for the purpose of filtering)

the "hard" part is establishing the mechanism for doling them out.

Keith

---

From: Margaret Wasserman <[email-masked]>
Date: Tue, 12 Nov 2002 13:45:36 -0500

>be connected to large numbers of other networks.

Okay.

But, why make them inherently private, non-routable addresses?
If we come up with a reasonable way to allocate globally-unique,
provider-independent addresses, is there a reason to require
that they be non-globally-routable?

There is some work underway in multi6 regarding mechanisms for
provider-independent allocation of globally routable addresses.
Wouldn't that be better?

Then, if you wanted part of your network to be private, you
could make it private via filtering both traffic and routing
protocol advertisements.

Margaret

---

From: Pekka Savola <[email-masked]>
Date: Tue, 12 Nov 2002 20:50:51 +0200 (EET)

On Tue, 12 Nov 2002, Keith Moore wrote:
> they might be more plentiful than you think.  [...]

Well, personally, I can clearly see a few cases (e.g. in the military), 
but the rest, I could separate to a few cases:

1) have IPv4 connectivity but no IPv6 (or stable IPv6 -- something like 
6to4 with dynamic v4 address)

2) have zero 'net connectivity ("clear cases") -- usually by design

3) have full connectivity but want somehow permanent addresses, to be used 
locally, for renumbering, to be leaked to the internet, etc.etc.

Which cases we want to provide addresses for?

(btw. I suggested one /32 but one for each RIR + room for expansion would 
be more adequate, I think.)

---

From: Keith Moore <[email-masked]>
Date: Tue, 12 Nov 2002 15:05:52 -0500

> locally, for renumbering, to be leaked to the internet, etc.etc.

4) have zero connectivity to the public internet (by choice) but have
interconnections with an arbitrary number of other private networks 
(which might or might not have connectivity to the public internet).

this is actually fairly common.  we need to get away from the assumption
that the reason that people use IP is to connect to the public Internet.

Keith

---

From: Keith Moore <[email-masked]>
Date: Tue, 12 Nov 2002 15:03:21 -0500

> that they be non-globally-routable?

those would be okay for my purposes.  because I see global routing
in the public network as a special case of routing between networks, 
I don't see that having a "non globally routable" attribute embedded 
in the address is that useful - any more than having a "site local" 
attribute.  if you don't trust your border filters I don't know why
you'd trust the rest of the network to do your filtering for you.
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------