Subject: Re: Enforcing unreachability of site local addresses

From: Kurt Erik Lindqvist <[email-masked]>
Date: Sun, 1 Dec 2002 18:04:10 +0100

>> Steven Blake wrote:
>> I'm having a hard time understanding why any of the
>> thousands of institutions with IPv4 PI address prefixes
>> would ever migrate to IPv6 if they had to give up PI
>> addressing.
>
> They would not, but the way of providing them PI addresses is not to
> punch holes in PA space that would lead us directly in the same swamp
> than IPv4.
>

I must have misunderstood something really seriously here. What is the 
difference between how we allocate PI space today (well, there is no 
swamp space in IPv6 of course) compared to the GUPI model? If I have 
got all this right we are suggesting to take a prefix and use it as PI 
space, right? Now this is just a matter of the number of holes and the 
size of them? As an network operator there would be no difference at 
all.

Some here have claimed that GUPI would help to track down incorrect 
announcements but we can today already deal with RFC1918 space that is 
leaked.

Best regards,

- kurtis -

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Michel Py" <[email-masked]>
Date: Mon, 2 Dec 2002 08:13:52 -0800

> Margaret Wasserman
> There was also a "moderate usage" proposal put forth by Bob
> Hinden in the meeting, which would allow the use of site-local,
> but would not allow sites to border each other (site-local
> addresses would be filtered in firewalls).  The details of this
> model haven't been documented in detail, but it has the
> advantage that it would allow the use of site-locals on
> intermittently connected networks (ones that may not always
> have global addresses available from their ISP, or where their
> ISP-provided addresses may change on each connection).
> are you or anyone else working to document the
> "moderate usage" proposal?

The GUSL draft that Charlie Perkins and I will propose soon fits the
"moderate usage" you described.

Michel.

---

From: "Christian Huitema" <[email-masked]>
Date: Mon, 2 Dec 2002 09:28:23 -0800

> and I don't know why an ISP would accept advertisements for GUPIs from
> its peers unless it was paid (well) to do so.

The key part of enforcement is indeed the community effect. If the
community agreement is that GUPIs should not be routed over the
Internet, we will get a situation were GUPIs are automatically rejected
by 90% of the ISP, through a combination of black-hole routes and BGP
filtering. If we get there, then no amount of pressure on individual ISP
can compromise the global routing tables.

What I perceived in the previous discussion was an unwillingness to do
this, because is would ban Internet wide routing of the GUPI forever.
There are some who seem to be willing to use GUPI to sneak PI routing in
IPv6. I believe we should really not go there, and state clearly that PI
addressing will be the result of the MULTI6 work (perhaps), not an
evolution of the GUPI.

-- Christian Huitema

---

From: "Michel Py" <[email-masked]>
Date: Mon, 2 Dec 2002 08:36:34 -0800

> Keith Moore wrote:
> I don't think we need to solve the global routing
> problem for PI addresses to be beneficial. PI
> addresses are extremely useful even if they can only
> be routed by private agreement between networks.
> Trying to make PI addresses be suitable for global
> routing as a pre-condition for having PI addresses
> strikes me as self-defeating. It's nice if it works
> out that way, but it should not be considered a
> necessary condition.

It is not, but asking for PI with no plan to manage the risk of
"privately routed PI" ending up "globally routed PI mess" is a
non-starter. One of the surest ways to kill IPv6 is to make it the same
crud as IPv4 with more bits.

Michel.

---

From: "Michel Py" <[email-masked]>
Date: Sat, 14 Dec 2002 12:24:15 -0800

Bob,

>> Margaret Wasserwan wrote:
>> In my opinion, the only way that we will stop people from
>> using NAT (with or without IPv6 site-local addresses) will
>> be to provider better (architecturally cleaner, more
>> convenient, more functional) mechanisms for people to get
>> the same benefits that they get from NATs today. Although
>> NATs may have started as a response to address space
>> shortage, today their use is driven by the needs for
>> provider-independent addressing and convenient access
>> control.  So, we need to work on better ways to provide
>> those things in IPv6.

> Bob Hinden wrote:
> I am not sure that this is really true.  When I was looking
> for a new DSL provider I found that in many cases I could get
> service> at a specific bandwidth with a singe address for about
> $60 a month. If I wanted a /29 instead, it would cost about
> $30 more a month. 50% more for 6 usable addresses!

I vote with my wallet and this kind of ISP does not have my business.
It's weird you are out of PacBell's reach in bay area.

Pacbell's prices are $49.95 for one dynamic IP and $64.95 for a /29.
Frankly I would not mind paying $15/mo more to have a /29 and I don't
think it is an unreasonable price. [this is not a free add for Pacbell;
their email stinks].
As always market will decide.

That being said, I don't see how this applies to IPv6. Given the fact
that lots of people are giving away /48 tunnels, and that a single IPv4
address also brings a 6to4 /48 prefix, I don't think that there is any
relation between the scarcity of IPv6 addresses and the development of
IPv6 NAT. 

Which leaves us with the main motive behind the development of IPv6 NAT
being the desire for provider independant addresses.

Michel.