Subject: Re: [v6ops] Comments on ULA draft

From: "Liubing (Leo)" <[email-masked]>
Date: Thu, 20 Jul 2017 15:31:48 +0000

Thanks for your response Lorenzo, pls see inline [Bing2].

发件人: Lorenzo Colitti [mailto:[email-masked]]
发送时间: 2017年7月20日 15:10
收件人: Liubing (Leo) <[email-masked]>
抄送: [email-masked] WG <[email-masked]>; [email-masked]
主题: Re: Comments on ULA draft

On Thu, Jul 20, 2017 at 2:56 PM, Liubing (Leo) <[email-masked]<mailto:[email-masked]>> wrote:

[Bing] I guess the firewall at the edge of public and private can simply block all FD::/ prefix?

That only works if there are exactly two zones: public and private. As soon as you have a third zone (e.g., if there is a merger, or a different type of network), every /48 needs to have its own security policy.
[Bing2]: If zones are connected through the public network, the zones communication should not over ULA packet, since the public network would drop the ULA packets in any case. If admins want to do ULA packets across domains, they need to make the packets over some L3/L2 tunnels; or just add a PA prefix. Thus, the edge firewalls between each zone and the public zone, can still apply the blocking FD::/ rule.
For internal firewalls, if it needs to block some specific addresses/prefixes, either using ULAs or PAs, admins both need to configure specific rules, so I think ULAs and PAs are just equal on this point?

They're not equal because with global space, multiple /48s that have the same security policy can be grouped into a single shorter prefix that only requires one firewall rule.
[Bing2]: Yes. That’s something I can add into the document.

Btw, the admins could randomly generated a single one 48/ ULA prefix, and announce it internally, there are still 16bit for sub-organization. So, this could be considered as kind of aggregation?.

Yes, but only for a small network.
[Bing2] I don’t quite understand why only for small networks? Is it because the 16bit is not enough for a large organization to divide sub-networks?

Best regards,
Bing

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 21 Jul 2017 16:52:46 +1200

On 21/07/2017 03:31, Liubing (Leo) wrote:
...
> [Bing2] I don’t quite understand why only for small networks? Is it because the 16bit is not enough for a large organization to divide sub-networks?

With 16 routing bits to play with, the admin has basically the equivalent of
an IPv6 Class A (which contains 2**16 /24s). So yes, campus or regional
based aggregation is entirely possible: to exactly the same extent as with
a GUA /48, of course. In fact, in a network running both a GUA and a ULA
prefix, I'd expect the same aggregation plan to be used for both.

   Brian

    Brian