Subject: RE: question regarding possible use of SLs in renumbering

From: "Richard Draves" <[email-masked]>
Date: Thu, 7 Nov 2002 11:33:50 -0800

[I'm trying to get caught on the thread after being away for several
days.]

Yes, it is reasonable to assume that a /48 global prefix corresponds to
a site-local scope. I wouldn't rule out other arrangements but I think
this will be the common situation.

Rich

> -----Original Message-----
> From: Keith Moore [mailto:[email-masked]] 
> Sent: Thursday, November 07, 2002 9:10 AM
> To: IPng
> Cc: [email-masked]
> Subject: question regarding possible use of SLs in renumbering
> 
> 
> question:
> 
> is it reasonable to assume that if a network is advertising 
> one or more global prefixes via ND/RD, that the scope of a 
> 'site' for SL addresses corresponds to the scope in which 
> those global prefixes are advertised?
> 
> in other words, would it really be reasonable to assume that 
> one could 
> use SL addresses in some renumbering protocol and have them 
> be able to 
> reach all of the hosts/routers/apps that were affected by a 
> prefix change?
> 
> Keith
> --------------------------------------------------------------------
> IETF IPng Working Group Mailing List
> IPng Home Page:                      http://playground.sun.com/ipng
> FTP archive:                      ftp://playground.sun.com/pub/ipng
> Direct all administrative requests to [email-masked]
> --------------------------------------------------------------------
> 

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Richard Draves" <[email-masked]>
Date: Thu, 7 Nov 2002 14:44:15 -0800

> The issues with global vs. site-local routing in a "site" 
> that had multiple locations connected by leased lines were 
> dismissed, because the multiple locations should be more than 
> one "site". But, even if Wind River would be forced to have 
> 20-something sites by this rule, we would still probably only 
> have a single /48 prefix.

What rule is that? Is the routing within Wind River "convex"? Assuming
it is, I don't see why you wouldn't make Wind River a single site, even
if it is geographically dispersed.

Rich

---

From: "Michel Py" <[email-masked]>
Date: Sun, 10 Nov 2002 17:04:11 -0800

> Mark Smith wrote:
> Does IPsec VPN tunnels / logical links influence any of
> the current site-local discussions ?

As you mentioned in your post, the VPN tunnel keeps the network convex
as it's no different than any other link, and only one site is needed.

Any serious network that does not have redundant private links and
routers has an encrypted router-to-router tunnel for inside traffic.
Latency is not good and encryption might seriously hit the routers, but
it's better than no connection. Client VPNs to get to the other location
if the leased line goes down just makes makes me laugh.

It's not that big of a deal to configure; I have number of setups that
run EIGRP routing over IPSEC tunnels over the Internet, crossing
firewalls. Nothing exotic here.

Michel.

---

From: "Richard Draves" <[email-masked]>
Date: Mon, 11 Nov 2002 11:14:49 -0800

> Wind River has multiple sites with Internet connectivity that 
> are connected via linked lines.  If you think of two of them, 
> you can picture a dumbbell shaped network.  Our ISP is 
> routing different parts of the Wind River network space to 
> different locations.

So in IPv6 terms, your ISP understands the internal structure of your
/48 - for example you might have some /56s routed one way and some
another in your ISPs network?

> However, if the leased line goes down (or one of the routers 
> to it goes down, etc.), global traffic will fall-back to 
> being routed over the global Internet...  This is great 
> because it lets me reach non-secure parts of the other Wind 
> River site, even when my secure link is down.  And, I can run 
> a client VPN solution to get behind the firewall, if I need to.

Hmm, I wonder how prevalent this desire is. I think Microsoft's network
admins would be very upset if my traffic to our Cambridge England lab
(for example) were to end up on the public internet. They try hard to
prevent this.

From my perspective, the Wind River network plan sounds fairly atypical
of enterprise networks. Have you considered using multiple /48s (perhaps
one for the insecure parts of your network and one for the secure parts,
where the routing the secure portion of your network would be convex)?

Rich