Subject: RE: IPv6 site-locals... end of story...

From: "Stephen Sprunk" <[email-masked]>
Date: Tue, 25 Mar 2003 15:53:53 -0600

Thus spake David Conrad <[email-masked]>
> >The ONLY reason to use NAT was the lack of enough addresses.
>
> No. Another reason is that companies do not want to be held hostage
> due to the cost of renumbering which many would feel would be the
> case should they want to change providers.

This is a point many people seem to be missing.  Renumbering a few subnets
filled with clients is trivial with IPv6 -- just like it is with IPv4 DHCP.
However, renumbering servers and the resultant DNS issues is not trivial,
requiring months of planning if you can get management approval at all.
Worse, renumbering is manpower-intensive when you consider there are
networks out there with 10,000+ sites/subnets, and some being built with the
goal of 50,000+ sites/subnets.  Without 10/8, these networks wouldn't be
administratively possible.

Renumbering is not easy.  Repeating it over and over doesn't make it so.

S

Stephen Sprunk         "God does not play dice."  --Albert Einstein
CCIE #3723         "God is an inveterate gambler, and He throws the
K5SSS        dice at every possible opportunity." --Stephen Hawking

_______________________________________________
routing-discussion mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/routing-discussion

---

From: Eliot Lear <[email-masked]>
Date: Tue, 25 Mar 2003 14:05:16 -0800

How many networks exist that have 10,000 sites/subnets?  The people who 
support such networks ARE service providers...

Eliot

---

From: Eliot Lear <[email-masked]>
Date: Tue, 25 Mar 2003 14:05:16 -0800

Eliot

---

From: "Stephen Sprunk" <[email-masked]>
Date: Tue, 25 Mar 2003 16:27:45 -0600

Thus spake "Eliot Lear" <[email-masked]>
>
> How many networks exist that have 10,000 sites/subnets?  The
> people who support such networks ARE service providers...

I can't give names, but let's think about this.  There are about 15,000
McDonalds restaurants in the US alone; many retail stores have similar
numbers.  Bank ATMs typically have a router and local subnet inside them,
and there's tens of thousands of those things around too.  I don't have
exact numbers, but I'd guess the major oil companies have 20,000 gas station
each.  And let's not forget the US Postal Service with tens of thousands of
post offices.

While it may be tempting to give these folks their own portable space,
they only have a couple dozen machines exposed to the outside world so
that's a horrific waste -- not to mention unfair to all the other folks who
are stuck with provider addresses and renumbering every year or two.

Private addresses solve many different real-world problems, not just a
general shortage of addresses.  I'm not fond of site-local addresses per se,
but we do need a private address block.

S

---

From: "Stephen Sprunk" <[email-masked]>
Date: Tue, 25 Mar 2003 16:27:45 -0600

S

---

From: Eliot Lear <[email-masked]>
Date: Tue, 25 Mar 2003 14:37:45 -0800

> each.  And let's not forget the US Postal Service with tens of thousands of

These are the cases where autoconfig/ppp should do the job.  If it can't 
then IPv6 just isn't ready.

Eliot

---

From: Eliot Lear <[email-masked]>
Date: Tue, 25 Mar 2003 14:37:45 -0800

Eliot

---

From: Curtis Villamizar <[email-masked]>
Date: Wed, 26 Mar 2003 15:45:39 -0500

> each.  And let's not forget the US Postal Service with tens of thousands of

And fedex and UPS have routeable IPv4 addresses for similar purposes.
Works fine for them so Mickey D's and the the banks should be fine
too.  Its about time the banks figured out how to implement real
security within their infrastructures (but with personal
identification still stuck in the stone ages with PIN numbers and US
SS numbers and mother's maiden name, that would be asking a lot).

> are stuck with provider addresses and renumbering every year or two.

Renumbering is supposed to be easy with IPv6.  I always found it
plenty easy enough with IPv4, so I won't comment on whether it is easy
enough with IPv6.

> Stephen Sprunk         "God does not play dice."  --Albert Einstein

Curtis

ps - You happy Kireeti? - I changed the subject line.  (Are we ever
off topic!)

---

From: Curtis Villamizar <[email-masked]>
Date: Wed, 26 Mar 2003 15:45:39 -0500

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Wed, 26 Mar 2003 16:13:22 -0500

> requiring months of planning if you can get management approval at all.

Only if you are incompetent or don't have access to the client.

Create two addresses for the servers and everything else.  Take as
much time as you need to do this.  Then change DNS.  Wait a few days
(weeks) until you are sure that DNS everywhere is flushed out and no
adverse reactions have ocurred.  Then remove the old addresses.  Take
as much time as you need to do this too.

Services are given CNAMEs and servers are given A records.  For
hardware upgrade services were moved to different servers.  We got
good enough at this that we could cut certain services over to new
servers mid-day and no one could tell the difference.

> administratively possible.

Remote administration and shell scripts / perl programs is the only
way to go administering large networks.

> K5SSS        dice at every possible opportunity." --Stephen Hawking

I've done it admitedly for only a few hundred subnets if that many,
but it went fine and was not all that manpower intensive.  This was
without DHCP.

We didn't have to walk up to pee-cees and click in the dialog boxes or
it would have been impossible.

As an ISP we routinely drilled taking the Michagan NOC down and
switching over to the NY NOC, including changing servers for multiple
database services.  All generally worked fine and cutover in 15
minutes would have been easy if the telco didn't consistently mess up
the transition of the incoming NOC phone lines.  :-)

DHCP or autoconfig can actually make the problem harder if learning
two addresses for the same interface is not supported by all clients
and servers.  Two addresses are needed during the transition.

Absent the ability to have two addresses on the clients, a few subnets
at a time have to be cut over with routing between subnets in the old
and the new address space.  Still not overly difficult but a little
better planning is required.

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Wed, 26 Mar 2003 16:13:22 -0500

Curtis

---

From: David Conrad <[email-masked]>
Date: Wed, 26 Mar 2003 14:29:41 -0800

Curtis,

> Only if you are incompetent or don't have access to the client.

I might suggest that you and everyone else on this list have a bit more 
technical competence than the vast majority of folks who are operating 
networks in the real world today.  Oh yeah, and in most large scale 
enterprise networks I've encountered, it is excruciatingly common that 
the folks who run the routers and interact with the ISPs have 
absolutely no access or control over the vast majority of client 
systems.  In many cases that I've personally experienced, the folks who 
run the routers and the folks who run the DNS servers and the folks tho 
allocate addresses/run DHCP servers are all different (and they 
typically don't communicate with each other particularly well).

Pretending that renumbering is never a significant cost in large scale 
networks isn't going to get us anywhere other than NATsville.

Rgds,
-drc

---

From: David Conrad <[email-masked]>
Date: Wed, 26 Mar 2003 14:29:41 -0800

Curtis,

Rgds,
-drc

---

From: Eliot Lear <[email-masked]>
Date: Wed, 26 Mar 2003 14:57:48 -0800

David Conrad wrote:
> networks in the real world today.

Dave, you're absolutely right.  But that puts the burden on us to make 
renumbering easier.  Kludging the answer with site-local would be to 
shirk that responsibility.

> Oh yeah, and in most large scale 
> the folks who run the routers and interact with the ISPs have absolutely 
> no access or control over the vast majority of client systems.

What we're talking about here is the IP address associated with that 
client system.  There we are doing better.  DHCP is the client interface 
to the network, and the network administrator largely controls that.

> In many 
> cases that I've personally experienced, the folks who run the routers 
> and the folks who run the DNS servers and the folks tho allocate 
> addresses/run DHCP servers are all different (and they typically don't 
> communicate with each other particularly well).

While I'm sure this happens, it is not commonplace for enterprises in my 
experience.  Enterprises handle renumbering already.  Once you move 
people you have to reallocate addressing periodically in order to ensure 
there are enough addresses.  There are products out there that make this 
particularly easy.  We sell one such thing.

It's not the client that I would worry about.  It's the big servers who 
stick IP addresses in weird places.

> networks isn't going to get us anywhere other than NATsville.

You're right.  But let's talk realistically about what tools and 
functions need to be dealt with.

Eliot

---

From: Eliot Lear <[email-masked]>
Date: Wed, 26 Mar 2003 14:57:48 -0800

Eliot

---

From: Curtis Villamizar <[email-masked]>
Date: Wed, 26 Mar 2003 18:20:10 -0500

In message <[email-masked]>, David Conrad wri
> networks isn't going to get us anywhere other than NATsville.

You are entirely correct.  An ISP running entire *ix systems with
authentication framework and complete remote administration in place
will have a very easy time renumbering relative to a corporation which
has lost control over the administration of their systems and can't
even get at some machines or contact the people administering them.

The only thing we can do is provide the means for easy renumbering.
We can't really prevent anyone from botching it.  I don't think this
is a reason to continue to support NAT.

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Wed, 26 Mar 2003 18:20:10 -0500

Curtis

---

From: "Stephen Sprunk" <[email-masked]>
Date: Wed, 26 Mar 2003 19:40:16 -0600

> experience.

I have yet to see a large Enterprise where DNS, DHCP, server administration
(all twenty groups of it), and network engineering are run by the same
people -- they're often handled from different continents.

> Enterprises handle renumbering already.  Once you move people you
> have to reallocate addressing periodically in order to ensure there are
> enough addresses.  There are products out there that make
> this particularly easy.  We sell one such thing.

Compare the administrative burden of having to comply with RIR allocation
policies across your entire corporation (which may be under several dozen
different administrative areas) and being forced to pay your ISP per IP
address, vs. just tossing a NAT in, using a public /24 or two for external
servers, and never having to worry about internal allocation.

Companies with legacy class A/B space are an exception.  Remember, under the
proposed IPv6 allocation policies, no end users will have portable space.

> stick IP addresses in weird places.

Something as serious as changing an IP address can be a 6-12 month project
due to all the testing and validation required.  Seems loony, yes, but I've
seen mission-critical servers made inoperable by installing a new printer
driver.  Would you bet your job and your pension on renumbering being a
flawless overnight exercise?

S

---

From: "Stephen Sprunk" <[email-masked]>
Date: Wed, 26 Mar 2003 19:40:16 -0600

S

---

From: "Stephen Sprunk" <[email-masked]>
Date: Wed, 26 Mar 2003 19:51:44 -0600

Thus spake "Curtis Villamizar" <[email-masked]>
> is a reason to continue to support NAT.

Users want NATs, and that means they'll buy and use them.  The IETF can
discourage this practice as it has done with IPv4 NATs, but that's it.
Refusing to standardize it will only hurt us down the road.

Re: the topic.  I'm not advocating site-local addressing or indeed any other
form of scoped addresses; what I do advocate is a single private address
prefix, which many of us had been planning on using the site-local prefix
for.  This may be why anti-NAT folks seem to be taken by surprise at the
number of folks planning to use NATs with IPv6 -- we just weren't going to
tell you.

S

---

From: "Stephen Sprunk" <[email-masked]>
Date: Wed, 26 Mar 2003 19:51:44 -0600

S

---

From: Eliot Lear <[email-masked]>
Date: Wed, 26 Mar 2003 18:01:08 -0800

> people -- they're often handled from different continents.

You snuck one in there, and made it a red herring.  Server 
administration is a very different beast.  Take that out and I would 
hazard to say that the majority of enterprises aggregate these roles 
into either network engineering or network management.  The keyword 
there is "network".

> servers, and never having to worry about internal allocation.

Ye of little faith.  This is what a healthy market is for.  Service 
providers sell bandwidth.  If they make it too hard to add networks and 
hosts they will sell less bandwidth.  They know this.  RIRs sell 
addresses.  If addresses get too expensive then we need more RIRs.

> proposed IPv6 allocation policies, no end users will have portable space.

Not so.  Anyone can buy address space.  Whether it's routable is another 
story.

> flawless overnight exercise?

I *did* bet my job on renumbering a large corporate network, complete 
with mission critical components.  Network didn't work?  No bookings. 
If you're challenging whether I take this stuff seriously, I certainly do.

Eliot

---

From: Eliot Lear <[email-masked]>
Date: Wed, 26 Mar 2003 18:01:08 -0800

Eliot

---

From: "Stephen Sprunk" <[email-masked]>
Date: Wed, 26 Mar 2003 20:14:41 -0600

> And fedex and UPS have routeable IPv4 addresses for similar
> purposes.  Works fine for them so Mickey D's and the the banks
> should be fine too.

A few have legacy class A/B allocations for this, but those who don't use
10/8.  Even many companies with portable addresses use 10/8 anyways because
it offers more flexibility.

Much of this would be solved if we'd give portable IPv6 addresses to anyone
with a reasonable justification.  It's not like there's a shortage of them.

> plenty easy enough with IPv4, so I won't comment on whether it is easy

Renumbering costs manpower, and businesses do not spend time (aka money) on
projects like that unless there is a financial return.  Renumbering is not
free and _it has no business value_.  Given that, NATs will win in the real
world no matter how much we work to reduce the absolute cost of renumbering.

S

---

From: "Stephen Sprunk" <[email-masked]>
Date: Wed, 26 Mar 2003 20:14:41 -0600

S

---

From: Chip Elliott <[email-masked]>
Date: Wed, 26 Mar 2003 21:26:55 -0500

At 08:51 PM 3/26/2003, Stephen Sprunk wrote:
>for.

One more datapoint for this discussion. I have never been able to figure
out how I would define or use site-local addressing in my life, but have often
had applications for a private address space. It would not be hard to carry
that IPv4 concept over into IPv6 and would, IMHO, in fact be useful.

Cheers,

Chip Elliott
Principal Engineer, BBN

---

From: Chip Elliott <[email-masked]>
Date: Wed, 26 Mar 2003 21:26:55 -0500

Cheers,

Chip Elliott
Principal Engineer, BBN

---

From: David Conrad <[email-masked]>
Date: Wed, 26 Mar 2003 18:57:42 -0800

Eliot,

On Wednesday, March 26, 2003, at 06:01  PM, Eliot Lear wrote:
> into either network engineering or network management.

Not in my experience, but the world is full of surprises.

> providers sell bandwidth.  If they make it too hard to add networks 
> and hosts they will sell less bandwidth.  They know this.

Customers buy Internet connectivity.  If it is easier/cheaper to obtain 
that connectivity via NAT, they'll do so.  The "problem" is that NAT's 
true costs are not direct -- they show up in end user and system 
administrator time and/or inability to run certain applications, many 
of which CIOs don't particular care about anyway (and the ones that 
CIOs do care about get application layer gateways or other hacks).

>  RIRs sell addresses.

No they don't.

> If addresses get too expensive then we need more RIRs.

I once used to argue for competitive address allocation organizations.  
People shouted me down.  Suffice it to say, it doesn't work this way.

> Anyone can buy address space.

Well, yes, in as much anyone can buy snake oil, but in reality, no.  It 
is possible to obtain address space via money, but it is a bit ... 
complicated.

> Whether it's routable is another story.

One out of four is pretty bad... :-)

In any event, I suspect we are in violent agreement about the needs to 
make renumbering easy.  Private addressing (site local or otherwise) is 
a bandaid on a sucking chest wound -- the real need is a scalable 
routing architecture and/or mechanisms that remove the costs/pain 
associated with addressing and renumbering.  Lacking those, you'll have 
NAT -- I'd bet your life on it... :-)

Rgds,
-drc

---

From: David Conrad <[email-masked]>
Date: Wed, 26 Mar 2003 18:57:42 -0800

Eliot,

No they don't.

Rgds,
-drc

---

From: David Conrad <[email-masked]>
Date: Wed, 26 Mar 2003 19:00:22 -0800

Stephen,

On Wednesday, March 26, 2003, at 06:14  PM, Stephen Sprunk wrote:
> with a reasonable justification.

Define "reasonable justification".

As you note, scarcity is not the current constraining factor.  Swamp 
avoidance is.

Rgds,
-drc

---

From: David Conrad <[email-masked]>
Date: Wed, 26 Mar 2003 19:00:22 -0800

Stephen,

Rgds,
-drc

---

From: "Stephen Sprunk" <[email-masked]>
Date: Wed, 26 Mar 2003 23:02:01 -0600

Thus spake "David Conrad" <[email-masked]>
> > Much of this would be solved if we'd give portable IPv6 addresses to
> > anyone with a reasonable justification.
>

I don't see how we can expect to reduce the tables to less than one prefix
per ASN, so that's a start right there: every ASN comes with a pre-assigned
prefix*.  This is how 6bone worked for many years, in fact.

Beyond that, it's hard to say.  I can't think of any examples of companies
with substantial internal networks that don't have an ASN already, but I'm
sure there are some.  Given how easy it is to get an ASN, I'm not sure
there's much utility in developing a rule for the no-ASN case.

* I'd suggest a /48 for AS-based allocations, not to be suballocated to
customers; ISPs would need a second, larger allocation and probably not use
the AS-based one.

S

---

From: "Stephen Sprunk" <[email-masked]>
Date: Wed, 26 Mar 2003 23:02:01 -0600

S

---

From: Curtis Villamizar <[email-masked]>
Date: Thu, 27 Mar 2003 12:10:25 -0500

> K5SSS        dice at every possible opportunity." --Stephen Hawking

It is true that renumbering cost is not zero.  Given the cost of
connectivity, the cost to renumber is minimal if IT staff is not too
severely challenged (in which case cost of anything can approach
infinity).  The onging cost of using a NAT is also high because the
NAT itself gets in the way of getting things done particularly in a
multilocation environment where more than one NAT is needed.

We need to agree to disagree.  I keep trying to the point that the
IETF has made efforts to provide no barriers to renumbering and
explicit support for it, and that there is existance proof that
renumbering large numbers of hosts can be done quite painlessly.  You
keep pointing out that the PC software industry and the MIS world
repeatedly demonstrates widespread incompetence, and despite providing
the capability to renumber and providing advice on good and bad
practices, will carry most or all existing IPv4 bad practices through
any IPv6 transition and will manage to make it overly difficult to
renumber in IPv6.  We're both at least partially right because a
subset of organizations will update their practices when transitioning
to IPv6 and another subset will try to carry existing bad practices to
IPv6, and the largest subset will do nothing and continue to run IPv4.

It may be perfectly reasonable to allow users to retain NATs and stay
with IPv4 or transition to IPv6 topology based (non-portable)
addresses.  I think it is reasonable and you don't and that is where
we need to agree to disagree.

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Thu, 27 Mar 2003 12:10:25 -0500

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Thu, 27 Mar 2003 12:19:01 -0500

> K5SSS        dice at every possible opportunity." --Stephen Hawking

The current situation in IPv4 is that the topology is quite diverse
but each provider has a small number of provider aggregates covering
the majority of customers and a large number of provider independent
(PI) aka portable prefixes that are singly homed.  The result is
250,000 global routes where the number of routes could be about two
decimal orders of magnitude smaller if all single homed site address
space mapped into the topology.

That is the situation we are trying to avoid in IPv6 without resorting
to NAT to accomplish it.  Otherwise we might as well stick with IPv4
and declare IPv6 a failure.

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Thu, 27 Mar 2003 12:19:01 -0500

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Thu, 27 Mar 2003 10:10:42 -0500

> flawless overnight exercise?

I fully agree that renumbering should not be expected to be an
overnight transition and can take months, even well over a year,
depending on the size and administrative entropy of the organization.

The purpose of a "renumbering grace period" is to accommodate an
address transition is to allow 6-12 months to renumber if that is what
an organization needs.

Back when RFC1957 was being discussed in the IETF and the idea of
address lending discussed I strong advocated that the ISPs agree to
provide some minimum grace period for their customers to renumber as a
*requirement* for the IPS to get the number space.

An organization can have 2 number spaces for a long period of time
while parts of the organization under separate administration are
notified of the transition and given sufficient time to complete the
transition of their systems.

Absent this cooperation among ISPs, a customer wishing to switch
service providers must contract from two providers during the
renumbering transition period.  This puts a great deal of pressure on
the staff to complete the renumbering in under a month which in many
cases is difficult or impossible.

If we are to learn from our mistakes, we should not only put a burden
on end customers, giving them non-portable addresses, but we must put
a burden on the ISPs with manditory minimum renumbering grace periods
in order for the ISPs to get address allocations.

What the ISPs have to do is punch a temporary hole in their aggregate
for the duration of the grace period and accept that advertisement
from other providers.  This will increase the number of routes but
only to the extent that their are unsatisfied customers in the midst
of this sort of transition.

Failure to provide a manditory renumbering grace period was a major
contributor to the trend toward requesting PI addresses and to a
lesser extent toward NATs.  If these are things we want to avoid in
IPv6, we should consider a requirement for manditory renumbering grace
period enforced by the address registries.

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Thu, 27 Mar 2003 10:10:42 -0500

Curtis