Subject: RE: stable addressing

From: "Fleischman, Eric" <[email-masked]>
Date: Tue, 20 Apr 2004 09:48:45 -0700

>Why don't you just deploy proxy servers at the edge of your network?  
>It allows you to talk to the outside using local addresses, while 
>disguising the internal topology as only the proxy servers' addresses 
>are known?

>Much better than deploying v6 NAT.

Pekka,

Thank you for your helpful posting. The use of proxy servers is a good suggestion, since they can also be part of a larger authenticated firewall solution. However, due to the sheer number of the internal devices that need to be exposed in a highly controlled manner (e.g., hundreds if not low-thousands of devices), proxy servers aren't likely to be able to scale to handle the job -- hence the use of authenticated NATs that are associated with the firewall.

--Eric

---

From: Tim Chown <[email-masked]>
Date: Tue, 20 Apr 2004 18:03:16 +0100

> Thank you for your helpful posting. The use of proxy servers is a good suggestion, since they can also be part of a larger authenticated firewall solution. However, due to the sheer number of the i…

If an organisation wishes to continue with NAT, it might as well stick with
IPv4 though?   What's the gain then from having IPv6?

Would be nice to have a "Fortune 1000" scenario documented, as it's an
interesting subcase of the v6ops enterprise scenario.

Why not just allocate Fortune 1000 companies a /32 each anyway? ;)

Tim

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 21 Apr 2004 08:21:11 +0200

Tim,

If it really is only 500 or 1000 enterprises world-wide, they will in the
end get PI space and it will be routed in the DFZ, by simple economics.

The challenge is not so much there. It's

a) to solve the problem for the few million companies that aren't as big
as Boeing but are too big to be connected in a simple way to a single ISP.
That's why multi6 is here.

b) to produce a suite of techniques that are *better* than NAT-based
security-by-obscurity for the companies that have fallen into the
"NAT = Security" trap.

Only point a) is the problem of this WG.

   Brian

-- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Brian E Carpenter 
Distinguished Engineer, Internet Standards & Technology, IBM

---

From: Pekka Savola <[email-masked]>
Date: Wed, 21 Apr 2004 14:54:56 +0300 (EEST)

> That's why multi6 is here.
[...]

Which is why I've argued that it might make sense to try to find a 
definition which could be used to give PI space to these very big 
enterprises, while disallowing to the rest.

The only difficulty is drawing the line, but if someone could do 
that, we might be better off.

Still, in many cases PI-space might not be the optimal solution if the 
prefix would not be accepted as de-aggregated, if the enterprises 
wouldn't want to advertise the whol /32 in all the peering/upstream 
points (and handle the internal connectivity using more expensive 
links -- this was the case taken up by C. Huegen from Cisco).

So, I'm not sure how much PI-space would *really* help because often 
that would require advertising more specifics for TE purposes as well, 
and that's not something we'd want to go for...

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: "marcelo bagnulo" <[email-masked]>
Date: Wed, 21 Apr 2004 14:41:48 +0200

Hi Pekka,

> that, we might be better off.

I agree that very big sites probably will get PI.
I also agree that the complex issue is to define the criteria used for
asigning.

But i think this is not a problem for this wg nor the IETF, imho this is a
problem for the RIRs

Regards, marcelo

---

From: Tim Chown <[email-masked]>
Date: Wed, 21 Apr 2004 14:33:56 +0100

I agree, I'm just saying don't get hung up on the Fortune 1000's, for the
reason you state.

Tim

---

From: Pekka Savola <[email-masked]>
Date: Wed, 21 Apr 2004 17:13:01 +0300 (EEST)

> But i think this is not a problem for this wg nor the IETF, imho this is a

I agree that this is a problem for the RIRs (or more appropriately,
the global-v6 discussion list) as soon as multi6 has said "It's all
right by us for you to try to figure out if you can specify PI
allocations for very big sites".

First, IMHO, we need to get to the point that we (as in, the IETF) 
thinks going down that road is a good idea.

Nothing prevents RIRs taking this up on their own, of course, but if 
there is multi6 "encouragement" or "blessing", it's certainly going to 
help in the process...

---

From: "Joel M. Halpern" <[email-masked]>
Date: Wed, 21 Apr 2004 10:48:22 -0400

One obvious candidate rule to consider would be something like
     Can justify needing more than a /48 of space.
Given H ratio and other similar parameters, an organization like Boeing 
might well meet that requirement.

Yours,
Joel M. Halpern

---

From: "marcelo bagnulo" <[email-masked]>
Date: Wed, 21 Apr 2004 19:33:35 +0200

> there is multi6 "encouragement" or "blessing", it's certainly going to

agree.
IMHO we won't be able to stop big sites to get PI
i guess that we are still delaying our "blessing" until we provide an
alternative solution, as attractive as we can, so that as many sites as
possible will preffer it over the PI option (especially if getting PI is
hard)

Regards, marcelo

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 22 Apr 2004 14:22:20 +0200

Marcelo,

> possible will preffer it over the PI option (especially if getting PI is

Completely agree. That's why I'd prefer that we drop this thread
and concentrate on finding that solution.

   Brian

---

From: Kurt Erik Lindqvist <[email-masked]>
Date: Thu, 22 Apr 2004 16:31:55 +0200

> Why not just allocate Fortune 1000 companies a /32 each anyway? ;)

Well then maybe we at least would get over that 1000 routes 
barrier...:-)

- - kurtis -

---

From: Kurt Erik Lindqvist <[email-masked]>
Date: Thu, 22 Apr 2004 21:09:34 +0200

> there is multi6 "encouragement" or "blessing", it's certainly going to

This is already happening with micro allocations.

- - kurtis -

---

From: Pekka Savola <[email-masked]>
Date: Fri, 23 Apr 2004 06:57:54 +0300 (EEST)

> This is already happening with micro allocations.

Yes, but micro allocations aren't necessarily being globally routed.

I'm a bit worried about Marcelo's approach, i.e., just delaying until
we have a solution (for some multi6 sites).  If that solution isn't
going to work for the specific kind of sites, we've just delayed their
v6 set-up for a couple of years, made them go around the policies,
start requesting v6 NATs, etc.

---

From: Kurt Erik Lindqvist <[email-masked]>
Date: Fri, 23 Apr 2004 09:10:06 +0200

> Yes, but micro allocations aren't necessarily being globally routed.

True, but then again - there is nothing that we can write that will 
influence what is routed where. That is an economic decision and back 
to the "no-peer" BGP community discussion.

> start requesting v6 NATs, etc.

And that is a concern that should be reflected in what this WG ends up 
proposing.

- - kurtis -