Subject: RE: draft-ietf-ipngwg-site-prefixes

From: Richard Draves <[email-masked]>
Date: Mon, 13 Dec 1999 22:03:42 -0800

> Is there a case where the site has e.g. 100 prefixes but the 
> subnets only
> have say 3 prefixes?

This gets back to the definition of a site... suppose you have a company
with 100 branch offices scattered across the globe. Each branch office is
connected to a local ISP. Each branch office has subnets with just one
global site prefix allocated from the local ISP. But there is a common
subnet numbering across the entire company and there is a desire to use
site-local addressing across the entire company. The branch offices are all
connected via VPN tunnels.

So in this example, the site has 100 global prefixes but each subnet has
only one global prefix.

Rich
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 14 Dec 1999 09:48:13 -0800 (PST)

> So in this example, the site has 100 global prefixes but each subnet has

Agreed. I think Steve would argue that they are actually different sites
but that wouldn't prevent users from actually deploying the above type of
scenario.

I just don't know how common place this will be.
Today I suspect that major corporations will not have direct Internet access
at all 100 branch offices since each access point requires a firewall complex
of some sort plus real people to watch over the firewalls, upgrade them, etc.

For that reason today the number of access points will be limited.
(Yes, the branch offices can still be on the inside of the corporate firewalls
by having a VPN over the public Internet - but they will not have direct
access to the Internet over that wire.)

For the future we can only speculate.
If you believe in the motivations for distributed firewalls (see
   [Bellovin] Distributed Firewalls, S. Bellovin, available at
   http://www.research.att.com/~smb/papers/distfw.pdf or
   http://www.research.att.com/~smb/papers/distfw.ps (work in progress).
you might get your above example. 

   Erik