Subject: Globally unique site-locals was [repost] A few comments on Site-Local Useage

From: "Michel Py" <[email-masked]>
Date: Thu, 21 Nov 2002 20:35:38 -0800

Bob,

> Bob Hinden wrote:
> Another router issue that gets talked around is should
> packets with site-local destination be forwarded to
> "default".  Given that site-local addresses are not
> created without being configured, one approach could be
> to have a "black hole" route for FEC0::/10 preconfigured
> in all routers.

There is some potential in this.

Rationale: ambiguity is a fail-safe for routes that leak in the DFZ even
though they were not supposed to and for ISPs that don't filter them
even though they were supposed to.

If we could add to this black hole a preconfigured prefix-list for each
peer that would deny FEC0::/10 ge 10 (1) that would likely be good
enough to let ambiguity go and we would make a step towards globally
unique site-locals.

(1) I am thinking about something like the default deny at the end,
except that it would be at the beginning and would be effective even
though there is no prefix-list applied to the peer. Something that would
require a separate command and a confirmation to de-activate. Why would
one want site-locals in BGP anyway?

Michel.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Mark Smith <[email-masked]>
Date: 22 Nov 2002 16:45:58 +1100

> require a separate command and a confirmation to de-activate.

 Why would
> one want site-locals in BGP anyway?

I've worked on a scenario where BGP was the most appropriate routing
protocol to use as an IGP(!) within a VPN scenario, due to its ability
to handle the distribution of much larger number of routes verses the
limitations of the IGP implementations available. Topology requirements
prevented us from aggregating addressing enough for the IGP to support
the number of routes we were dealing with.

So, although probably fairly rare, there are reasons that BGP needs to
support site-locals.

I think I mentioned it before, BGP confederations could also be a reason
to not to restrict site-local routes from being distributed by BGP.

I think it would be fine to have (e|i)BGP filter out site-locals by
default, but I certainly would want a knob to switch that filtering off.

Mark.

---

From: Pekka Savola <[email-masked]>
Date: Fri, 22 Nov 2002 15:48:51 +0200 (EET)

> > to have a "black hole" route for FEC0::/10 preconfigured

For site-locals this seems like the only sane policy:

 1) expect that someone will very probably filter them if you send them 
out of the site
 2) expect that site-local packets will arrive at your site from outside

"trust no one" is an absolute requirement.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords