Subject: RE: Taking two steps back (Was: Re: one question...)

From: "Christian Huitema" <[email-masked]>
Date: Tue, 26 Nov 2002 08:15:09 -0800

> Let's take two steps back, stop discussing possible solutions for a
> moment and discuss the problem statement.  I'd like it to be possible
for
> an enterprise to:
> 
>          - Have resources (i.e nodes or services) that are accessible
>                  only to sub-groups within the enterprise (i.e.
>                  departments).  Example:  a printer that only
marketing
>                  is allowed to use.
>          - Have resources that are available to the whole enterprise,
>                  but that are not accessible outside the enterprise.
>                  Example:  An HR benefits website.
>          - Have resources that are available on an extranet (between a
>                  selected group of enterprises) that are not
accessible
>                  to all other enterprises.  Example:  A
supplier/customer
>                  network.
>          - Have resources that are globally available, and be able to
>                  send global traffic. Example:  Google.
> 
> All of these things can be achieved without site-locals, using
> provider-allocated global addresses and appropriate configurations of
> firewalls, ACLs, route filtering and split DNS.

In theory people would be smart and would never assign any security
property to an address. They would base access control on actual
authentication protocols, authorizing an activity if they have enough
trust in the user initiating the activity and the remote computer
through which the activity is performed. I wish everybody understood
that.

In practice, many system administrators do assign some properties to
addresses. In a large network, assigning properties to addresses
translates in a large number of access control lists in which the "only
marketing" or "HR benefits" restriction is translated into a set of
address prefixes. Experience proves that updating these prefixes during
network renumbering is a major pain. Having a stable set of prefixes
that you can use internally is thus very helpful.

-- Christian Huitema

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Tue, 26 Nov 2002 15:00:37 -0800

Keith,

> > The lack of global routability of site-local addresses is a 
> feature, 
> > not a bug.
> 
> I don't think we have concensus on that.  there seem to be at 
> least a few  people who want PI addresses that *are* 
> routable, or at least, for which such restrictions are not imposed.
> 
I am just trying to understand this part. From what I can understand,
the relative stability of the GUPI addresses with respect to global
addresses is higher. Is that the sole reason why you would pay an
ISP to route these prefixes instead of getting a global prefix from
the same ISP ? What are the reasons why uou want the GUPI to be
routeable ?

thanks
mohan

> I'm sympathetic to the concerns about routing table size and 
> routing computation overhead, but I'm not sure that mandatory 
> or even default filtering of GUPIs is the right thing in the 
> long term.
> 
> Keith

---

From: "Michel Py" <[email-masked]>
Date: Tue, 26 Nov 2002 15:09:04 -0800

Mohan,

> Mohan Parthasarathy wrote: 
> I am just trying to understand this part. From what I
> can understand, the relative stability of the GUPI
> addresses with respect to global addresses is higher.
> Is that the sole reason why you would pay an ISP to
> route these prefixes instead of getting a global prefix
> from the same ISP ? What are the reasons why uou want
> the GUPI to be routeable ?

There are two main reasons why you would pay the ISP to leak a prefix:
1. You want to multihome.
2. You want to be able to switch ISPs without renumbering.

Michel.

---

From: "Michel Py" <[email-masked]>
Date: Tue, 26 Nov 2002 18:44:59 -0800

> Mark Smith wrote:
> Are we happy with the existing problem definition, that
> (near) globally unique site local addressing is a better
> solution for than traditional site-local addressing,

I think yes, but only if we address the unreachability /
not-publicly-routable issue at the same time.

> have the recent discussions on near globally unique site
> local addressing / GUPIs caused us to inadvertently loose
> focus on our problem definition, making it necessary for
> us to restate and redefine it ?

I think the problem definition is to get rid of ambiguity for site-local
addresses. Whether it leads to almost unique, completely unique, or a
mix of both is debatable.

Michel