Subject: RE: IPv6 site-locals... end of story...

From: Daniel Senie <[email-masked]>
Date: Mon, 24 Mar 2003 18:48:55 -0500

At 05:27 PM 3/24/2003, Tony Li wrote:

>The argument for why they're not necessary is quite simple:
>
>1) If the site is not connected, then use any number space to begin
>with.  When the site connects, renumber.  Note that if you had a
>defined address space, you would STILL be renumbering, so the special
>address didn't do anything for you.
>
>2) If the site is connected, then the real benefit out of site
>local addressing is to support NAT.  NAT is not necessary so you
>don't need an address space to support it.

Tony, I disagree that these two are it.

Example: I run a colo with two interfaces per server. Public interface of 
each server has a public address. Second interface has an RFC1918 address. 
The second interface is used for backups, inter-server database 
connectivity, NFS, etc. Tell me why I should waste public space on that? 
Explain how I justify that space when asking for a subnet from an upstream, 
when that space isn't going to EVER be connected to the public network.

There's no NAT here. There's no public connection. HOWEVER, it is 
CRITICALLY important that the address space used for the private network 
not conflict with any public address space.

Maybe I just do really odd things with my server configurations, but I 
somehow doubt I'm the only one who does such things. Tying private address 
space to NAT does not tell the whole story.

Dan 

_______________________________________________
routing-discussion mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/routing-discussion

---

From: Eliot Lear <[email-masked]>
Date: Mon, 24 Mar 2003 16:00:44 -0800

Daniel Senie wrote:
> Example: I run a colo with two interfaces per server. Public interface 
> of each server has a public address. Second interface has an RFC1918 
> address. The second interface is used for backups, inter-server database 
> Explain how I justify that space when asking for a subnet from an 
> upstream, when that space isn't going to EVER be connected to the public 
> network.

Because this is like wasting sand in the desert.

Eliot

---

From: Eliot Lear <[email-masked]>
Date: Mon, 24 Mar 2003 16:00:44 -0800

Eliot

---

From: Curtis Villamizar <[email-masked]>
Date: Mon, 24 Mar 2003 21:44:27 -0500

In message <[email-masked]>, Daniel Senie 
> when that space isn't going to EVER be connected to the public network.

You ask for it.  I've asked for IPv4 addresses in order to dual home
machines for redundancy and got it (actually I thing Jessica Yu asked,
so it was a while ago, ya'll remember Jessica).  As long as you have a
good reason and can account for tight packing of the allocated space
you get it.  You can even ask for one address per interface plus one
for the loopback and modify code to bind to the loopback for
redundancy (no interface loss results in a broken TCP connection).  If
you ask for address space to support what appears to be expansion
fantacies or are unwilling to provide supporting evidence that you
have actually used the addresses (account for the machines in detail)
will you be denied.  (Yes, plenty of requests are denied).

> not conflict with any public address space.

If your security is based on obsurity, better not be backing up and
PCs on that LAN because your security has just been shot by the first
luser to open a poisoned mail attachment.  They'll get that through
their public side interface assuming they have any access at all.

Private addresses also neither hurts or helps maintain security of
completely disconnected networks.  In IPv6 there is enough to go
around so might as well be public addressed.

Absent those reasons, why should it be private space?

> space to NAT does not tell the whole story.

Sorry Dan.  Not a very convincing argument.

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Mon, 24 Mar 2003 21:44:27 -0500

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Mon, 24 Mar 2003 21:47:11 -0500

> Because this is like wasting sand in the desert.

Good analogy.  Does that mean the address registries are selling sand
in the desert and somehow getting a good price for it?  :-)

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Mon, 24 Mar 2003 21:47:11 -0500

Curtis

---

From: Daniel Senie <[email-masked]>
Date: Mon, 24 Mar 2003 22:10:54 -0500

At 09:44 PM 3/24/2003, Curtis Villamizar wrote:

> upstream,
>You ask for it.

I ask for plenty of space for the public interfaces to these servers. 
You're suggesting I waste a block of space for the private network, which 
has no direct (or indirect) connectivity?

>   I've asked for IPv4 addresses in order to dual home
>you get it.

Yes, I get all the space I justify. I do not need or want to justify the 
space used for a private segment.

>   You can even ask for one address per interface plus one
>If your security is based on obsurity,

Good. You're making some severe assumptions.

>  better not be backing up and
>PCs on that LAN

Colo. Servers. No users. Get it?

>  because your security has just been shot by the first
>luser to open a poisoned mail attachment.

what users?

>   They'll get that through

Yep. You confirmed you didn't read my original note.

>completely disconnected networks.

Did I say I did it for security reasons? Please go reread my original note 
and point out where I said that. I said I had no need for the traffic there 
to go to or from the public Internet. Why do folks instantly assume a 
security motive? I dual-home the servers so that backup and database 
traffic does not interfere with traffic to/from the rest of the world. 
Works quite effectively in building server farms.

>   In IPv6 there is enough to go

So let's waste it all. I understand your position.

>Absent those reasons, why should it be private space?

Well, it comes down to this: when you replace my reasons with yours, and 
then raise questions, you get YOUR reasons for shooting down my particular 
issue. That's very nice for you, but doesn't address what I was raising.

>Sorry Dan.  Not a very convincing argument.

Sorry, Curtis, I'm disappointed you didn't read my argument as I wrote it, 
but instead interpreted it.

I've sent this privately. I'm about ready to give up on this matter. All I 
really wanted was for some RFC1918-like space to be left around. I don't 
really give a damn if routers know what the IPv6 private space is and 
attempt to do something useful with it. I just want some block to be 
reserved. Since that CLEARLY is a major problem for everyone but me, I 
guess I should stop arguing.

Sheesh.

---

From: Daniel Senie <[email-masked]>
Date: Mon, 24 Mar 2003 22:10:54 -0500

what users?

Sheesh.

---

From: Curtis Villamizar <[email-masked]>
Date: Mon, 24 Mar 2003 22:52:16 -0500

In message <[email-masked]>, Daniel Senie 
> has no direct (or indirect) connectivity?

For IPv4, if it is never reachable from the outside world "no" because
addresses are not plentiful.  For IPv6, "yes", since there are plenty
of addresses.  If the addresses are reachable from the Internet and
there was a legitimate reason for two interfaces per host, then for
either IPv4 or IPv6 you would be justified in asking for addresses.

Where IPv4 allocation should obviously be denied is when the company
with 10 PCs, very little clue, and a grandious business plan comes to
a routing registry asking for their own /19.

> space used for a private segment.

Then don't.

In our case all interface addresses were reachable and we needed an
additional (loopback) address that would never go down.  We had a good
reason.  We had no problem.

> Colo. Servers. No users. Get it?

Depends on what services you run.  If they are all secure, then fine.
No MIS types running windoze, that's good.

> Yep. You confirmed you didn't read my original note.

Fine colo only, no other systems are backed up.  I did read your note
and I get your point.  Servers only, no lusers.

> Works quite effectively in building server farms.

In that case it would be a performance reason.

> So let's waste it all. I understand your position.

The desert won't run out of sand.

> issue. That's very nice for you, but doesn't address what I was raising.

Since security missed the mark and it appears that performance is the
reason to have a second interface, then that's fine too.  If
performance doesn't adequately summarize, then you tell me the reason.
In either case, performance or security, it doesn't make sense in IPv6
not to just allocate from routeable addresses.

> guess I should stop arguing.

Sorry to have misinterpreted your message.  I still think its an
incredibly weak argument in favor of RFC1918-like space, whether the
reaon for the extra interface is performance, security, or as in our
case redundancy.

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Mon, 24 Mar 2003 22:52:16 -0500

Then don't.

Curtis

---

From: "Tim Price" <[email-masked]>
Date: Tue, 25 Mar 2003 09:42:05 -0500

Hi Daniel,

Actually, you are not even close to being wrong, and I hope you don't give
up the ship.  I have not been involved in the discussions other than the
recent flurry of emails, but my suspicion is that your opponents have a
completely skewed view of reality.  I guarantee you there are hundreds of
thousands of small networks (connected or not) out there that are being
maintained by administrators with limited experience or training.  They are
likely to be unfamiliar with the procedure for getting a network address,
nor are they likely to bother with the procedure.  Additionally, these
networks are almost guaranteed to be connected by primitive means to the
Internet (but not necessarily at the same time as the initial configuration
of the network)- leading to a natural NAT situation.  I submit that as a
standards body you must address your entire intended audience, which means
that the least-common-denominator approach should be considered.  If the
argument is that address space in IPv6 is boundless, then retaining a block
of addresses for private use costs you absolutely nothing as a standards
body.  That doesn't necessarily mean that these addresses not be routed
across gateways, but at the very least guaranteeing the addresses won't be
registered helps.  However, the logic needed in a router is minimal, which
also costs virtually nothing.  If it costs nothing AND accommodates the
needs of a large segment of your audience then I submit you have a win-win
scenario.

I also suggest that you recognize the (sometimes unfortunate) need to
maintain backward compatibility.  In this case, I would ask that you retain
the philosophy of reserved private addresses.  Removing functionality always
leads to a grass roots rebellion, regardless of whether or not you "have
their best interests in mind".  No, it does not necessarily follow the
symmetry and beauty of the v6 design- but we live in the real world and you
frankly have to consider what the user may want.

********************************************************
Tim Price
[email-masked]
(856) 787-2704

 -----Original Message-----
From: 	[email-masked]
[mailto:[email-masked]]  On Behalf Of Daniel Senie
Sent:	Monday, March 24, 2003 10:11 PM
To:	[email-masked]
Cc:	[email-masked]
Subject:	Re: IPv6 site-locals... end of story...

> > Example: I run a colo with two interfaces per server. Public interface
of

what users?

Sheesh.

---

From: "Tim Price" <[email-masked]>
Date: Tue, 25 Mar 2003 09:42:05 -0500

Hi Daniel,

 -----Original Message-----

of

what users?

Sheesh.

---

From: Curtis Villamizar <[email-masked]>
Date: Tue, 25 Mar 2003 11:36:58 -0500

> frankly have to consider what the user may want.

Your argument seems to be that regardless of more than sufficient
address space in IPv6, IPv6 autoconfig is not sufficiently idiot proof
for a large segment of the network population, therefore IPv6 NAT is
needed.

If that is not the case, then you had better restate your argument.

Please note that I haven't commented either way on whether IPv6
autoconfig is sufficiently idiot proof or not.

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Tue, 25 Mar 2003 11:36:58 -0500

Curtis

---

From: Eliot Lear <[email-masked]>
Date: Tue, 25 Mar 2003 08:51:06 -0800

Tim Price wrote:
> of the network)- leading to a natural NAT situation.

To start with, small networks should be well served by mechanisms such 
as prefix delegation.  That delegation occurs in two ways: either 
automatic such as the way Droms, et. al have gone, and manual through 
the provisioning process (ie., use these addresses as opposed to 
others).  This is done today in the real world.

>  I submit that as a
> that the least-common-denominator approach should be considered.

No, this is not how one engineers.  One engineers for the largest set of 
general use cases, not the least common denominator.

>  If the
> body.

It costs the end user peer to peer connectivity.

>  That doesn't necessarily mean that these addresses not be routed

You could also provide security via identd.  That costs virtually 
nothing, but offers about the same.

> maintain backward compatibility.  

This is not a case of backward compatibility.  You are changing 
protocols.  Private network address space was offered due to address 
space shortage.  That engineering requirement has evaporated.  So should 
private address space.

Eliot

---

From: Eliot Lear <[email-masked]>
Date: Tue, 25 Mar 2003 08:51:06 -0800

Eliot

---

From: David Conrad <[email-masked]>
Date: Tue, 25 Mar 2003 11:15:07 -0800

Eliot,

On Tuesday, March 25, 2003, at 08:51  AM, Eliot Lear wrote:
> as prefix delegation.

Along with the mechanisms to (for example) rewrite the filter lists on 
the separate firewall box?  Can you point me at the protocol spec to do 
this?

> space shortage.

Only partly.  It was also offered:
- to remove dealing with registries or ISPs and justifying the need for 
addresses
- to enable provider independence by removing the need to renumber

> That engineering requirement has evaporated.

The _perceived_ IPv4 address shortage has evaporated.  The other 
aspects of what has driven NAT have not and will not unless IPv6 is 
fixed.

> So should private address space.

And their should be peace in the world.

Rgds,
-drc

---

From: David Conrad <[email-masked]>
Date: Tue, 25 Mar 2003 11:15:07 -0800

Eliot,

Rgds,
-drc

---

From: Eliot Lear <[email-masked]>
Date: Tue, 25 Mar 2003 11:40:14 -0800

Gosh I feel like I've been here before ;-(
> the separate firewall box?  Can you point me at the protocol spec to do 

That's a provisioning function, so that would be scp.  To be fair, I 
think you're right that there could be better tools in this area.  It's 
not clear to me that a *protocol* is the right answer, but certainly 
tools are.  That having been said, we're overstating the relationship of 
renumbering and site-locals.  You have to be able to renumber the public 
portions of the network.  If you can't do that then IPv6 isn't ready for 
prime time anyway, as I mentioned previously.

> - to remove dealing with registries or ISPs and justifying the need for 

That is due to address space exhaustion.

> - to enable provider independence by removing the need to renumber

You've got to fix this problem *anyway* or there's no point of moving to 
IPv6.

> The _perceived_ IPv4 address shortage has evaporated.  The other aspects 
> of what has driven NAT have not and will not unless IPv6 is fixed.

As we wrote in RFC 1627, we already ran out of v4 addresses the moment 
we had to use private address space.  Because of this the network lost 
functionality.  The end to end principle was violated.  If we can't fix 
it with IPv6 let's not bother moving forward and live with what we've 
got.  We could all save a lot of time and effort.

Eliot

---

From: Eliot Lear <[email-masked]>
Date: Tue, 25 Mar 2003 11:40:14 -0800

Eliot

---

From: Curtis Villamizar <[email-masked]>
Date: Tue, 25 Mar 2003 15:39:07 -0500

> got.  We could all save a lot of time and effort.

We never ran out of IPv4 address space and most of it is still unused.
We are allocating it more cautiously so that we don't run out in the
future due to severely sloppy localized numbering or due to hoarding.

Curtis

---

From: Curtis Villamizar <[email-masked]>
Date: Tue, 25 Mar 2003 15:39:07 -0500

Curtis

---

From: David Conrad <[email-masked]>
Date: Tue, 25 Mar 2003 13:45:13 -0800

Eliot,

On Tuesday, March 25, 2003, at 11:40  AM, Eliot Lear wrote:
> You have to be able to renumber the public portions of the network.  
> If you can't do that then IPv6 isn't ready for prime time anyway, as I 
> mentioned previously.

I agree.

>> - to remove dealing with registries or ISPs and justifying the need 
>> for addresses

Yes, that is how it started.  It would be interesting to see how much 
of ISP revenues now derive from address space charges (I know I'm 
paying quite a bit per month for the 8 static IP address I have) and 
how amused ISPs will be to forgo those charges.  But perhaps I'm too 
cynical.

Rgds,
-drc

---

From: David Conrad <[email-masked]>
Date: Tue, 25 Mar 2003 13:45:13 -0800

Eliot,

I agree.

Rgds,
-drc