Subject: RE: IPv6 site-locals... end of story...

From: "Tony Li" <[email-masked]>
Date: Wed, 26 Mar 2003 10:16:49 -0800

Folks,

One of the points that is being entirely missed in this 
discussion is the distinction between NATs and firewalls.
Yes, many NAT boxes also perform firewalling and we're not
at all out to architecturally deprecate firewalls (at least
here and now).  The question is soley about NAT functionality.

As other posters have said, either IPv6 renumbering works well and
you don't need NAT because you can run your entire network on
PA addresses comfortably, or IPv6 renumbering (and therefore
all of IPv6) isn't ready for prime time.

While an Internet architecture should certainly not preclude
the many things that folks will want to do, it should also not
endorse the functions that we find to be counter-productive to
the overall life of the Internet.  In that spirit, if we have
done our jobs correctly with IPv6, NAT should not be required.
It serves no purpose that a correctly architected and implemented
IPv6 doesn't do.  Endorsing NAT is an admission that IPv6 has
failed.

Tony

|    > When there are hundreds of sites out there 
|    > running unpatched old versions of BIND or IIS 
|    > ...why waste your time breaking through a NAT box?
|     
|    Because the target is atractive?  
_______________________________________________
routing-discussion mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/routing-discussion

---

From: Subhendu Ghosh <[email-masked]>
Date: Wed, 26 Mar 2003 13:38:39 -0500 (EST)

> IPv6 doesn't do.  Endorsing NAT is an admission that IPv6 has

There is a difference between architecture and cost. While NAT may not be
needed in the architecture, it may be forced by pricing and address
allocation policies a couple of levels downstream from the RIRs.

Thus while endorsement of NAT is not needed - explictly disallowing NAT 
has a huge cost for a lot of small shops.

Without regard to NAT, the concept of an address block available for 
private use similar 1918 is a useful one. 
site-locals are not the only way to get private address and are probably 
much more of a pain to debug and manage.

-- 
-subhendu

---

From: Subhendu Ghosh <[email-masked]>
Date: Wed, 26 Mar 2003 13:38:39 -0500 (EST)

-- 
-subhendu

---

From: Eliot Lear <[email-masked]>
Date: Wed, 26 Mar 2003 11:06:19 -0800

> has a huge cost for a lot of small shops.

The presence or absense of assigned site-local address space will not 
allow or disallow NATs.  You can just as easily pull a random unassigned 
value out of a hat.  And I think this also harkens back to RFC-1627. 
Some practices should NOT be codified.  Doesn't mean you can't do them. 
  It just means they're a bad idea.

Eliot

---

From: Eliot Lear <[email-masked]>
Date: Wed, 26 Mar 2003 11:06:19 -0800

Eliot

---

From: Kireeti Kompella <[email-masked]>
Date: Wed, 26 Mar 2003 11:14:50 -0800 (PST)

Thoroughly engrossing discussion.  But please change the subject line.

Kireeti.

---

From: Kireeti Kompella <[email-masked]>
Date: Wed, 26 Mar 2003 11:14:50 -0800 (PST)

Kireeti.