Subject: [v6ops] Discussion of draft-ietf-v6ops-ula-usage-recommendations

From: "Fred Baker (fred)" <[email-masked]>
Date: Tue, 21 Jul 2015 14:02:10 +0000

https://tools.ietf.org/html/draft-ietf-v6ops-ula-usage-recommendations
  "Considerations For Using Unique Local Addresses", Bing Liu, Sheng
  Jiang, 2015-05-03

This draft came up from the floor this afternoon. I think we need some concentrated constructive conversation regarding it - we have had a lot of the other kind.

What issues do we need to address to complete it. and what specific recommendations would that include?

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 21 Jul 2015 16:18:59 +0200

1. Brian suggested to recommend that globals should be there on the
machines having ULAs as well, if I understand correctly.

But I think so only on some Hosts, mainly the Hosts of end users.

2. the ULA RFC suggests a ULA prefix can be generated out of a MAC
address.  That sixxs implementation does it.  Except it takes it too
serious: it does not accept a MAC address which is not a real MAC
address - in that oui.txt.  And random MAC addresses (for privacy)
certainly are not in that oui.txt.

I think this is an undesirable situation to be in: unable to generate
ULAs because the only tool out there (sixxs) can't refuses a copy paste
a MAC address from the widely used windows 7 laptops.

I am not sure what the problem is, but it's very good to have a very
easy way to generate ULAs.

3. in an enterprise deployment there was a problem of ULAs deployed in a
intra-network and another ULA space in another intra-network, of the
same enterprise.  So we wanted to make sure two things: the two ULA
spaces are distinct, or otherwise make sure the gateway router does not
route between the two intranets' ULAs (but yes, route between their
respective GUAs).   I am not sure how to translate that into advice,
because I am not sure how it will unfold in the near future.

Alex

> Jiang, 2015-05-03
>
> This draft came up from the floor this afternoon. I think we need
> some concentrated constructive conversation regarding it - we have
> had a lot of the other kind.
>
> _______________________________________________ v6ops mailing list
> [email-masked] https://www.ietf.org/mailman/listinfo/v6ops
>

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 22 Jul 2015 02:53:53 +1200

> But I think so only on some Hosts, mainly the Hosts of end users.

All hosts that need external communication.

> a MAC address from the widely used windows 7 laptops.

That isn't a standards issue, but I agree that operationally, there needs
to be a viable way for anyone to generate a random number. Wait a minute,
that doesn't seem hard.

> respective GUAs). 

Why not? ULA to ULA routing on a private link might be desired
(e.g. after two networks merge without renumbering). From a routing
PoV there is nothing special about a ULA prefix; we just need to
configure carefully where it is routed and where it is not routed.

Anyway - I'd like to see the draft progress. Has it already had a WGLC?

    Brian

> I am not sure how to translate that into advice,
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops
>

---

From: Mark Andrews <[email-masked]>
Date: Wed, 22 Jul 2015 01:24:34 +1000

> certainly are not in that oui.txt.

This is a ULA generator.  You do not need a MAC.

% dd if=/dev/random bs=7 count=1 | od -t x1 | awk '/0000/ {print "fd" $2 ":" $3 $4 ":" $5 $6 ; exit}'
1+0 records in
1+0 records out
7 bytes transferred in 0.000024 secs (293601 bytes/sec)
fd61:cb66:8851
% 

> a MAC address from the widely used windows 7 laptops.

*All* you need is 7 bytes of random numbers.  Many modern CPU's
will do this for you today.  If you don't have that then you can
use the pseudo random number generator in the rfc.

The algorithm is for CPE devices without a good source of randomness.

> Le 21/07/2015 16:02, Fred Baker (fred) a =E9crit :
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 21 Jul 2015 18:23:19 +0200

Le 21/07/2015 16:53, Brian E Carpenter a écrit :
>> 1. Brian suggested to recommend that globals should be there on
>> the machines having ULAs as well, if I understand correctly.
>>

I agree, all hosts that need external communication.

>> address.  That sixxs implementation does it.  Except it takes it
>> too serious: it does not accept a MAC address which is not a real
>> MAC address - in that oui.txt.  And random MAC addresses (for
>> privacy) certainly are not in that oui.txt.
>>
>> I think this is an undesirable situation to be in: unable to
>> generate ULAs because the only tool out there (sixxs) can't refuses
>> a copy paste a MAC address from the widely used windows 7 laptops.
>
> That isn't a standards issue, but I agree that operationally, there
> needs to be a viable way for anyone to generate a random number. Wait
> a minute, that doesn't seem hard.

It's easily done centrally, but in a distributed manner it's harder -
how am I sure the network I connect to has ULAs generated such that they
dont clash with mine?

>> I am not sure what the problem is, but it's very good to have a
>> very easy way to generate ULAs.
>>
>> 3. in an enterprise deployment there was a problem of ULAs deployed
>> in a intra-network and another ULA space in another intra-network,
>> of the same enterprise.  So we wanted to make sure two things: the
>> two ULA spaces are distinct, or otherwise make sure the gateway
>> router does not route between the two intranets' ULAs (but yes,
>> route between their respective GUAs).
>
> Why not? ULA to ULA routing on a private link might be desired (e.g.
> after two networks merge without renumbering). From a routing PoV
> there is nothing special about a ULA prefix; we just need to

Yes, private routing should be ok, but only if these ULAs are unique.
If people on different networks use different generation methods then
it's dubious to be sure of the uniqueness.  Maybe I choose fd00:1::/64
being sure that no random generator will make it, and it happens my
neighbors does the same.  That leads to conflict on fd00:1::/64 and we
dont want routing enabled between the two.

> Anyway - I'd like to see the draft progress. Has it already had a

I agree, it already has advice in it worth progressing.

Alex

>
> Brian
>
>> I am not sure how to translate that into advice, because I am not
>> sure how it will unfold in the near future.
>>
>> Alex
>>
>>> Jiang, 2015-05-03
>>>
>>> This draft came up from the floor this afternoon. I think we
>>> need some concentrated constructive conversation regarding it -
>>> we have had a lot of the other kind.
>>>
>>> What issues do we need to address to complete it. and what
>>> specific recommendations would that include?
>>>
>>>
>>>
>>> _______________________________________________ v6ops mailing
>>> list [email-masked] https://www.ietf.org/mailman/listinfo/v6ops
>>>
>>

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 21 Jul 2015 18:26:23 +0200

> 7 bytes transferred in 0.000024 secs (293601 bytes/sec)

Are we sure that if I use this generator it will not clash with somebody 
else using other generator?

> use the pseudo random number generator in the rfc.

I agree.  But we want to make sure randomness is ensured.

> The algorithm is for CPE devices without a good source of randomness.

Ok.

Alex

---

From: Mark Andrews <[email-masked]>
Date: Wed, 22 Jul 2015 02:28:35 +1000

In message <[email-masked]>, Alexandru Petrescu writes:
> 
> 
> Le 21/07/2015 16:53, Brian E Carpenter a crit :

*YOU* generate you ULA properly.
 
> dont want routing enabled between the two.

Generate.  Don't choose.  If you generate then you should be ok.
 
> >> Le 21/07/2015 16:02, Fred Baker (fred) a crit :

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 21 Jul 2015 18:32:46 +0200

> *YOU* generate you ULA properly.

You for single or plural?

Until now I was saying to my peers: I take 192.168.1.1 please take 
something else and I'll route to you.

Now I am saying: generate ULA properly, make it truly random.  But how?

Ok.

But it's much easier to choose.

We want simple ULA addresses, simple to remember, simple to type, 
ideally based on a dictionary.

This is something everybody building even the simplest IPv6 network has 
to do: what simple ULA IPv6 addresses to put there to not break something.

Alex

---

From: joel jaeggli <[email-masked]>
Date: Tue, 21 Jul 2015 18:40:58 +0200

> something else and I'll route to you.

that's to of dramatically underselling the amount of coordination
required to use rc1918 space between administrative domains.

> ideally based on a dictionary.

Wierdly when you go to an RIR you don't get to pick what your prefix is...

if you don't see your selection with randomness your probability of a
collision within your organzation is going to go way up.

> to do: what simple ULA IPv6 addresses to put there to not break something.

I don't have any ula in in my production networks.

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 22 Jul 2015 06:05:18 +1200

On 22/07/2015 04:32, Alexandru Petrescu wrote:

...
> Now I am saying: generate ULA properly, make it truly random.  But how?

This is not the place to debate the philosophical question whether the
phrase "truly random" has any meaning. The (im)probability of collisions is
thoroughly covered in RFC 4193, section 3.2.3.

I would advise using something better than rand(); you can even read
RFC 4086, but really this is all very old news.

   Brian

---

From: Gert Doering <[email-masked]>
Date: Tue, 21 Jul 2015 20:43:44 +0200

Hi,

> ideally based on a dictionary.

Go away.  DNS exists.

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (0)89/32356-444           USt-IdNr.: DE813185279

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 21 Jul 2015 22:13:55 +0200

>> ideally based on a dictionary.

Of course, DNS exists and has its role in giving good names to addresses.

Yet ULA gives a certain freedom in the hextets after fd00::, and I would 
not waste it by generating a fd00:ca10:8fa3 which has no logic.

fd00:cafe:: is a random prefix, easier to pronounce, to remember and to 
tell on the phone.

Alex

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 21 Jul 2015 22:14:14 +0200

> thoroughly covered in RFC 4193, section 3.2.3.

Yes.

> RFC 4086, but really this is all very old news.

I am not telling the old news about how good the randomness may be.

But that's ok, next time I will no longer take advices like sixxs.

Alex

---

From: Gert Doering <[email-masked]>
Date: Tue, 21 Jul 2015 22:23:06 +0200

Hi,

> fd00:cafe:: is a random prefix, easier to pronounce, to remember and to 

I encourage all my competitors to use "easy to pronounce and remember"
ULA prefixes.  Their address collisions are my saved OPEX.

Gert Doering
        -- NetMaster

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 21 Jul 2015 22:26:46 +0200

> ULA prefixes.  Their address collisions are my saved OPEX.

Ok for competitors.

But for friends?

Alex

---

From: Gert Doering <[email-masked]>
Date: Tue, 21 Jul 2015 22:29:39 +0200

Hi,

> > ULA prefixes.  Their address collisions are my saved OPEX.

Isn't that implicitely clear?  Be a good netizen, follow RFC4193 when
generating ULAs - or use GUAs instead.  And totally forget about
"easy to pronouce, remember, tell on phone" (and learn about DNS
and network automatization).

Gert Doering
        -- NetMaster

---

From: Mark Smith <[email-masked]>
Date: Wed, 22 Jul 2015 11:46:41 +1000

>> ULA prefixes.  Their address collisions are my saved OPEX.

Your friends usually do the right thing too or can be encouraged to.
But even if they don't, but you do, you won't have a ULA address space
collision.

If you both choose the same ULA value, you've both failed to learn
from history and will both will pay the price. RFC3879 describes the
prices you'll effectively be paying.

You would also be surprised at how easy it is to remember a random
value if you use it enough e.g., type it in enough. I was assigned a
random 6 letter character/number username at an employer in 1998, that
I used up until the end of 1999. I suspect it was so that usernames
weren't guessable, as a further security measure. I can still very
easily remember it today, despite not having used it regularly since
then.

Regards,
Mark.

---

From: Mark Smith <[email-masked]>
Date: Wed, 22 Jul 2015 13:31:22 +1000

> a MAC address from the widely used windows 7 laptops.

sixxs is not the only ULA generator out there.

Here's 4 others that showed up when I did a search for "ula generator"

http://unique-local-ipv6.com/

https://www.ultratools.com/tools/rangeGenerator

http://www.simpledns.com/private-ipv6.aspx

http://www.kame.net/~suz/gen-ula.html

I'm using random local MAC addresses on all of this host's interfaces,
yet a number of the above links generated an automatic ULA prefix for
me without issue (and I can't tell if they're IPv6 accessible and
might have used my IPv6 IID as a MAC address after removing FF:FE
etc.)

> because I am not sure how it will unfold in the near future.

RFC4193 recommends that by default ULA addressed packets and routes
are not leaked outside of the ULA /48 assigned site.

https://tools.ietf.org/html/rfc4193#section-4.3

---

From: joel jaeggli <[email-masked]>
Date: Wed, 22 Jul 2015 08:52:34 +0200

> fd00:cafe:: is a random prefix, easier to pronounce, to remember and to

stop, please.

No document with a discussion that looks this is coming out of the IETF
so long as I am in a position to prevent it.

---

From: Erik Kline <[email-masked]>
Date: Wed, 22 Jul 2015 12:03:46 +0200

> so long as I am in a position to prevent it.

(hug)

---

From: "Liubing (Leo)" <[email-masked]>
Date: Thu, 23 Jul 2015 15:16:19 +0000

Hi Brian,

> Anyway - I'd like to see the draft progress. Has it already had a WGLC? 

Not yet. Hope it could be launched later.

Best regards,
Bing