Subject: RE: NAT != SL (Was: RE: CONSENSUS CALL: Deprecating Site-Local Addressing)

From: "Tony Hain" <[email-masked]>
Date: Wed, 2 Apr 2003 10:40:51 -0800

Jeroen Massar wrote:
> ...
> Did you even _read_ the two drafts? one even has the
> word 'auto' in it. There will be no registry involved here, 
> except for the one registering MAC/EUI64 or other unique 
> addresses from which the automatic unique address is derived. 
> No money involved there, just a correct way of dealing with a 
> load of space without duplicates.
> 
> Morning Tony ;)

Both of those are creating /64's that can't be routed well within an
enterprise network. A proposal that creates globally unique /48's would
be appropriate. 

Tony

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Richard Carlson <[email-masked]>
Date: Thu, 03 Apr 2003 14:04:20 -0600

I agree with Christian on this point.  Communications should only be 
allowed between nodes when the src & dst address scope match.  Doing 
otherwise makes it hard/impossible for bi-directional flows to operate 
without a lot of special knowledge.

Rich

At 10:45 AM 4/3/03 -0800, Christian Huitema wrote:
>If we are serious about NAT != SL, then we should enforce it. Clearly,
>we cannot send the protocol police and whack every market driven
>designer of a NAT, but we can perform "collective enforcement", i.e.
>design our specification in such a way that misusing site local in a NAT
>configuration is guaranteed to break every application, and thus that
>any attempt to deploy an IPv6 NAT using site local will be a deployment
>nightmare.
>
>Suppose for example that we change our spec to forbid any communication
>between addresses of different scopes. This can be enforced by senders
>(refuse to send a packet if dest scope != source scope), routers or
>firewalls (drop packet if srce and dest scope don't match), and
>receivers (drop incoming packet if srce and dest scope don't match). You
>don't need to enforce it in every host and every router to be effective:
>just enforce in in a significant fraction of the hosts makes sure that
>any attempt to use the forbidden pattern will be very unreliable.
>
>This simple suggestion will in fact prevent using SL in the NAT
>scenario, as at some point the scenario relies on communication between
>an SL addressed source (e.g. a client) and a globally addressed
>destination (e.g. a web site).
>
>I think that we should enforce this requirement whether we maintain site
>local or find a replacement for disconnected sites.
>
>-- Christian Huitema
>
>

------------------------------------

Richard A. Carlson                              e-mail: [email-masked]
Network Research Section                        phone:  (630) 252-7289
Argonne National Laboratory                     fax:    (630) 252-4021
9700 Cass Ave. S.
Argonne,  IL 60439

---

From: "Christian Huitema" <[email-masked]>
Date: Fri, 4 Apr 2003 08:39:01 -0800

> > You don't get the point. If enough hosts come programmed to enforce
> > scope restrictions, then the non compliant product ends up with a
> > deployment headache and has to be fixed. This is basically the root
of
> > Internet standards -- enforcement by peer pressure.
> 
> The Globally addressed peer hosts when a communicating host is
> behind NAT are talking to another Global peer address at the NAT
> agent.

That is correct. The enforcement will not be by the remote site, except
maybe if the remote site uses IPSEC.

> This only requires complicity on the NAT box and the host,
> not the peer communicator.  The proposed requirement provides
> no further burden to implementors than NATv4 systems.

Your point is the mirror image of my argument. If a sufficient fraction
of the hosts refuses to play along with the NAT, then the NAT will not
be able to work. The laws of network physics are such that, if solution
A (NAT) is broken, then the easiest next solution will be chosen
(advertise a global prefix). The problem is that vendors of host
software can only deliberately brake the NAT scenario if they have some
"air cover", i.e. if the standard clearly says that communication
between addresses of different scopes is prohibited. Which is why it
should say so...

-- Christian Huitema