Subject: Re: Local addresses and security? (was: SL deprecation draft)

From: Mark Smith <[email-masked]>
Date: Mon, 24 Nov 2003 19:40:30 +1030

On Mon, 24 Nov 2003 10:58:43 +0200
"EricLKlein" <[email-masked]> wrote:

> Tim Chown wrote

> > It is not unlikely that people will be lazy and just use fd00::/48 for
> sites,
> > and thus add back in great ambiguity to the probabilisticly unique address
> > space.
> 
> First you ask a question, and then answer it. I am concerned that the many
> network "experts" out there that are trained in a 2 week certification
> course will take what is taught to them as an example and will make it
> gospel, and thus use the exact same addresses in multiple networks in close
> geographic proximity, and thus on the same Carrier edge router. Consider
> what happens when a carrier implements IPv6 in a city, and suddenly there
> are 10 companies connected by inexperienced network "experts" (and they have
> the certificate to prove it) that all follow the exact same course
> "template". Now this one carrier edge router is connected to 10 incorrectly
> configured routers all using the exact same "probabilistically unique
> address". this is where the original need for RFC1918 came from.

That is an education problem, not a technical one. They weren't taught what they needed, or should have expected to be taught. They need to ask their training provider for their money back.

Regards,
Mark.

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Tim Chown <[email-masked]>
Date: Mon, 24 Nov 2003 08:37:56 +0000

On Mon, Nov 24, 2003 at 08:37:39AM +0200, EricLKlein wrote:
> 
> I am still have 2 concerns with these concepts:
> 1. People do not want to register their secure internal network nodes (bank
> central computes etc) so the "registered unique local addreses" may not meet
> their needs. They do not want to have even theoritically reachable addresses
> on a Cash machine or other secure node that needs to be connected as part of
> the private network.

So they can use addresses from the probabilistically unique range under
the space fd00::/8.  There is, in terms of raw usage, no difference between
using fd00::/8 or fec0::/10.   External networks would still have to route
the prefixes back to you for you to be reachable, which is just as hard/easy
under either system.
 
> 2. For the "approxiamtely" or "probably" unique local addresses I am
> concerned that these addresses will eventually be assigned as part of the
> registered addresses and can then be in conflict with "legitimate" nodes.

No, the registered address space is under fc00::/8.   The two spaces are 
distinct, as per section 3.2 of 
http://www.ietf.org/internet-drafts/draft-ietf-ipv6-unique-local-addr-01.txt

It'll be many, many years before additional space needs to be allocated for 
these local address types.
 
> So between the 2, I do not see a solution that will work better than a
> RFC1918 type of address space. The more I hear about these options the more
> I want to bring back site local addresses.

Well, addresses under fd00::/8 and fd00::/8 can be used locally just like 
site-local addresses, only they have the nice property of significantly 
reduced (probabilisticly unique) or complete removal of (registered unique) 
ambiguity, so I don't see where your concern is?   

It is not unlikely that people will be lazy and just use fd00::/48 for sites, 
and thus add back in great ambiguity to the probabilisticly unique address 
space.  

Tim