Subject: RE: Taking two steps back (Was: Re: one question...)

From: "Michel Py" <[email-masked]>
Date: Tue, 26 Nov 2002 11:38:59 -0800

Margaret,

> - How will these addresses be allocated and/or generated?

Charlie Perkins has proposed a perfectly good way.

> - Will enterprises end up paying their ISPs to route these
>   addresses globally?

They will try if there is a chance it works.

> - If so, we need an aggregable way to allocate/generate
>   these addresses, so that they won't cause
>   explosive growth of the IPv6 core routing tables.

Not good enough. This would simply trigger people that want private
addresses to use 2002:0A00::/24 instead of site-locals and problems will
remain. The lack of global routability of site-local addresses is a
feature, not a bug. 

> - If not, then we can probably just allocate these
>   addresses sequentially and/or randomly.

Sequentially guarantees uniqueness.

> For the home environment, it would be nice to be able
> to ship nodes that are configured, by default, only to
> be accessible locally -- i.e. storage devices or home
> security systems (I'm actually not that worried that
> hackers will use my printer :-)).

That's what link-locals are for.

If you want to have several subnets in your home (why?), it requires
multiple hubs or a switch with VLAN capabilities.
It also requires routing between subnets, which implies that this $100
Linksys actually is a L3 switch; sometime maybe but not tomorrow
morning.
This kind of setup is unlikely to be configured by unsophisticated
users, and at that point configuring manually a site-local and RAs would
be a no-brainer.
 
> Since these devices will be installed and used by
> fairly unsophisticated users (like me :-)) who do
> not want to set-up firewalls, ACLs and split DNS
> to protect their resources, it would be good if
> there were a way for these addresses to recognize
> certain prefixes as inherently "local", and only
> accept traffic from nodes with addresses within
> those prefixes.

- Single-subnet, use link-local.
- Multiple subnets, this requires some configuration in terms of VLANs
anyway and if you can configure VLANs you don't have a problem going to
Charlie's server to get your site-local prefix.
- Site-locals to VPN to the office: Either the office will provide you
with some SLs part of their block, or they will want to know what your
prefix is (for ACLs), which in both cases turns out that you have to
configure SLs manually.

I can't find a reason why you would want site-locals to be automatically
configured, and this point has been made before here.

Michel.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Keith Moore <[email-masked]>
Date: Tue, 26 Nov 2002 15:29:52 -0500

> The lack of global routability of site-local addresses is a
> feature, not a bug.

I don't think we have concensus on that.  there seem to be at least
a few  people who want PI addresses that *are* routable, or at least,
for which such restrictions are not imposed.

I'm sympathetic to the concerns about routing table size and routing
computation overhead, but I'm not sure that mandatory or even default
filtering of GUPIs is the right thing in the long term.

Keith

---

From: Pekka Savola <[email-masked]>
Date: Tue, 26 Nov 2002 22:32:27 +0200 (EET)

> Charlie Perkins has proposed a perfectly good way.

I wouldn't call one organization _assigning to end-users_ prefixes 
from the space of about 2^28 perfectly good, not even _good_.

Quite the contrary.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: "Charles E. Perkins" <[email-masked]>
Date: Tue, 26 Nov 2002 13:16:59 -0800

Hello Pekka,

> from the space of about 2^28 perfectly good, not even _good_.

You forgot to say why.  Plus, depending on the constraints, the
exponent could conceivably be selected to be a number larger than
28, depending on how many subnets a site-local allocation is
expected to have by default.  Evan at 2^28, with an average of 10
seconds between allocations, that would last over 80 years.

Regards,
Charlie P.

---

From: Pekka Savola <[email-masked]>
Date: Tue, 26 Nov 2002 23:44:35 +0200 (EET)

> seconds between allocations, that would last over 80 years.

I thought the "why" for no to flat-space end-site allocations by IANA was 
self-evident.

How do you do reverses in an automatic manner (that's about the most 
significant reason for totally unique, and that's by a long stretch)?

What data would you require for an assignment?  What do you do when 
everyone requests assignments?  What to do when someone sets up a fancy 
script which requests assignments at the pace of 1000 per second, just 
for fun?

"No infrastructure" is just so much better.

---

From: "Charles E. Perkins" <[email-masked]>
Date: Tue, 26 Nov 2002 13:58:00 -0800

Hello Pekka,

> I thought the "why" for no to flat-space end-site allocations by IANA was

Well, it's not to me anyway!

> significant reason for totally unique, and that's by a long stretch)?

This wasn't stated as a requirement.  If it is a requirement,
then I believe I could design something, but until that is
made clear I'd rather not have to do that.

> What data would you require for an assignment?

None.

> What do you do when everyone requests assignments?

Rate-limiting has to be part of the solution.
Thankfully, it's not very hard.

>                             What to do when someone sets up a fancy

If they keep doing it, then we ought to filter out extraneous
requests.

> "No infrastructure" is just so much better.

I agree, and I like the randomized solution, as long as
it meets the requirements.  

If not, then I offer a centralized allocation solution as
an alternative.

Regards,
Charlie P.

---

From: Andrew White <[email-masked]>
Date: Wed, 27 Nov 2002 12:39:45 +1100

> Charlie's server to get your site-local prefix.

I disagree.  Several people have already *built* multi-subnet multi-router
systems which require minimal user configuration (see zerouter BOF).  I
don't want to administer my routers - I want to plug them together and have
them work.  And I want this to work independent of the presence or absence
of an ISP.

Sure, I could build the network as one massive layer-2 bridged subnet (um,
lets delegate that up to layer 3 instead rather than reimplement routing at
layer 2) or a multi-link subnet (has possibilities), but there are
advantages to running a traditional L3 subnetted architecture.

This is why I find the idea of generating an entire /64 prefix per subnet
without needing ANY interaction beyond the router so attractive.  Why should
humans be doing work that the routers can do themselves?

> configured, and this point has been made before here.

I've built (experimental) networks that rely on this functionality.  And
it's possible to apply most of these mechanisms for globals too.

-- 
Andrew White                [email-masked]