Subject: RE: Fw: Welcome to the InterNAT...

From: "Michel Py" <[email-masked]>
Date: Wed, 26 Mar 2003 14:37:51 -0800

>> Jeroen Massar wrote:
>> Seeing that route filtering only gets done automaticaly for
>> the last couple of years and the fact that that is only a
>> route + ASN mapping I don't see why all of a sudden there
>> will be some magical solution for renumbering complete networks.

> Fred Baker wrote:
> Really? I started to design such a procedure, and it's not
> terrifically  hard if you set your sights correctly.
> [SNIP]

Really?
What do you do for:
- Route-maps.
- Prefix-lists.
- Access-lists.
- Customers that are stupid enough to configure links to your EDI
systems with a hard-coded IP instead of a FQDN?
- Firewall configs.
- Suppliers that have configured your systems in their hosts.allow.
- etc.

Michel.

---

From: "Jeroen Massar" <[email-masked]>
Date: Thu, 27 Mar 2003 00:04:32 +0100

> - Suppliers that have configured your systems in their hosts.allow.

Thanks Michel for listing the things that I once forgot too.
I also had the idea that it 'was simple to renumber' untill someone
pointed out to me that DNS + routers are not everything :(
Especially 

But I do like Fred's point in making a procedure/document which
at least documents all the points which one will come across
when one is going to renumber. I think the identification of
these points alone could be quite valuable. Thoug admittedly
it all is quite based on which hard+software one is using
and those can vary a lot.

Greets,
 Jeroen

---

From: Fred Baker <[email-masked]>
Date: Wed, 26 Mar 2003 16:22:55 -0800

>- Access-lists.

Those fall under "configure the router"... Yes, things one does that use 
prefixes are going to have to be reconfigured using prefixes.

>- Firewall configs.

A firewall is either an application gateway or a router depending on what 
it does; it at minimum receives packets and forwards them, and may 
translate them in some sense. "configure the router..."

>- Customers that are stupid enough...

Someone else's stupidity is not my problem.

>- Suppliers that have configured your systems in their hosts.allow.

hosts.allow, last I checked, uses names. But nonetheless, this is (ahem) 
not the world's most secure mechanism for much of anything (ahem).

---

From: Tim Chown <[email-masked]>
Date: Thu, 27 Mar 2003 00:47:26 +0000

> translate them in some sense. "configure the router..."

Don't forget your IP addresses also often appear in other people's router
configs and firewalls.
 
Tim

---

From: "Stephen Sprunk" <[email-masked]>
Date: Wed, 26 Mar 2003 20:05:11 -0600

Thus spake "Fred Baker" <[email-masked]>
> Someone else's stupidity is not my problem.

As a vendor, every customer problem is your problem.

Go visit some Fortune 500 customers and ask:
.  Are you aware you won't be able to get portable IPv6 addresses?
.  How would you like to renumber your entire network every year?
.  How would you like us to sell you IPv6 NATs so you'll never have to
renumber again?

S

Stephen Sprunk         "God does not play dice."  --Albert Einstein
CCIE #3723         "God is an inveterate gambler, and He throws the
K5SSS        dice at every possible opportunity." --Stephen Hawking

---

From: Måns Nilsson <[email-masked]>
Date: Thu, 27 Mar 2003 03:35:05 +0100

> .  How would you like us to sell you IPv6 NATs so you'll never have to

Most F500 customers or similar have their own AS numbers. They can easily
become a LIR and get their own assignment. 

Most of the things making renumbering hard are issues with short-sighted
"optimisations", like host files instead of DNS, IP addresses in
applications, and similar. These all can be taken away in time -- most of
the applications that suggest this behaviour are v4-only today, and thus
NOW is the time to act decisively to get the message out: "Prepare to
renumber".

As Fred wrote; it is already today possible to build with caution to make
renumbering easy. 

You as a vendor should, instead of making paint-oneself-into-corners
misbehaviour possible, make it intuitive to DTRT. 

-- 
Måns Nilsson    http://vvv.besserwisser.org

---

From: Pekka Savola <[email-masked]>
Date: Thu, 27 Mar 2003 09:11:57 +0200 (EET)

> become a LIR and get their own assignment. 

You don't get a portable IPv6 address allocation only by being a LIR.

Except by lying or having an interesting interpretation of the required
"200 customers" in the application, of course...

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Måns Nilsson <[email-masked]>
Date: Thu, 27 Mar 2003 08:25:04 +0100

> "200 customers" in the application, of course...

That is because the LIR communities haven't changed that yet. I think it
should be changed to what was the intention of a RIPE meeting not long ago;
give all who want some space, as long as they are a LIR.