Subject: Re:

From: "Aldrin Isaac" <[email-masked]>
Date: Tue, 07 Aug 2001 17:47:07 -0400

Before I begin, I would like to apologize for any incorrectness in this 
message.  I am very new to IPv6 so I’m still trying to get all the facts 
straight.

A few individuals in the IPv6 community, including Steve Deering, have told 
me that the IPv6 addressing schema has focused on Internet provider/vendor 
needs, as the groups that decide on IPv6 do not have adequate, if any, 
representation from the non Internet provider/vendor community.  I know this 
may be bad timing but I feel it is necessary to write to those it may 
concern in order to re-iterate some issues.

I work for a large private information provider.  We connect privately to 
over 20000 customer networks which constitute over a million computer 
systems, of which over 150,000 subscribe to our data.  Our private network 
has around 250 POPs connecting over 80 countries to our data centers.  We 
have considered plans to peer several of these POPs to the Internet to 
provide “short-cuts” for our customer networks to access various resources 
on the Internet.  Our network is, however, strictly private.  The company 
has little or no interest in becoming a network service provider, and even 
less interest in becoming an Internet transit service provider.  This, 
unfortunately for us, means that we would not be eligible to apply for a 
[Sub-]TLA, based on RFC 2450.

In the current IPv6 addressing plan a [Sub-]TLA and all contained addressing 
is “owned” by an Internet transit service provider.  This presents several 
problems.  This provider may go out of business, adopt unacceptable business 
policies, get bought by a business rival (btw, this has happened to us), 
etc.  If such things should happen to our [Sub-]TLA provider we stand a risk 
of having to change our addressing.  This would put our business at 
considerable risk due to several factors.

Although RFC 2347 describes a way to have “addressing independence from 
long-haul transit providers” by connecting to the Internet via an 
“exchange”, it says nothing about (1) how an exchange can provide dedicated 
addressing to a global company, (2) how and who will administer it (3) will 
multihoming via an exchange provide the routing “insulation” provided by 
peering independantly?  If an exchange is administered by a public body, 
would we not be entitled to preferential considerations?  Who has the 
answers to these questions?

We use the same routers that large providers use.  We also happen to have 
thousands of distributed servers on our network running several versions of 
several operating systems.  I have not seen any effort on the part of these 
router and systems vendors to simplify the rapid change of addressing.  For 
us this means not only changing addresses on over 40,000 thousand 
interfaces, but also changing over 100,000 lines of distributed policies.  
Not to mention all the data storage, thresholding and alarm systems and 
databases.  Also, in my experience, massive changes have exposed bugs in 
vendor software that have caused loss of service to our customers.  For 
example, when changing policy, if a line of policy does not implement 
properly due to some race condition, this can cause loss of service and/or 
exposure (btw, we have seen this happen).

Almost all of our 20000 customer networks use firewalls.  Our addresses are 
configured into these firewalls.  It takes over a year of letters and 
meetings with 20000 customers to accomplish this.  Not to mention tens of 
thousands of man-hours.

We not only have “canned” connections to customers, but also over 1000 
private connections to our own sources of data, each of which is unique to 
that data provider.  We need to privately peer with these corporations, 
without the ISP in the middle.  These peering points are full of policies in 
both directions and on both sides.

I am not sure if there is an IPv6 study group on the impact of changing 
addresses, or if anyone has published anything regarding this topic.  If 
anyone knows of where I can find information regarding this I would 
appreciate having it.

The current addressing scheme does not solve the problem of multi-homing in 
any concrete way either.  There is a conflict in the current scheme between 
aggregation, multi-homing and address transparency.  If I want to make a 
[Sub-]TLA provider in the Far East happy, I’d need to use an address 
assigned by him.  However, this may not make any of the other 99 ISPs I 
decide to peer with very happy.  I can make every [Sub-]TLA provider happy 
if I do IPv6 NAT using that providers assigned address.  This, however, 
defeats the IPv6 claim to rid the world of NAT and create full address 
transparency.

It seems to me that in the current addressing schema, things like route 
aggregation and host autoconfiguration has taken precedence over some other 
very serious issues.  In what balance were these factors measured for route 
aggregation to win?  Route aggregation solves a single technical problem.  
But it doesn't seem to solve any other significant business issue towards 
the implementation of IPv6.  The industry has proven capable of building 
better routers that can handle more route entries.  I’m not against route 
aggregation.  I use it aggressively in our network.  But I don’t think it’s 
a good idea for a company such as mines to be subjected to having our 
address space outside our control.

I see a lot of intelligent dialogue in these working groups.  But it seems 
to me no one wants to touch the issues that will actually move IPv6 into the 
real world.

I hate to say this to everyone who's worked so hard on IPv6.  The current 
IPv6 addressing schema is unusable by anyone except Internet providers 
trying to serve the household and small business market.  It needs to be 
redone to gain the support of large corporations.

_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Robert Elz <[email-masked]>
Date: Wed, 08 Aug 2001 16:32:18 +0700

Date:        Tue, 07 Aug 2001 17:47:07 -0400
    From:        "Aldrin Isaac" <[email-masked]>
    Message-ID:  <[email-masked]>

  | In the current IPv6 addressing plan a [Sub-]TLA and all contained addressing  | is owned by an Internet transit service provider.  This presents several
  | problems.  This provider may go out of business, adopt unacceptable business
  | policies, get bought by a business rival (btw, this has happened to us),
  | etc.  If such things should happen to our [Sub-]TLA provider we stand a risk
  | of having to change our addressing.

This was known when IPv6 was being developed.   That is, that was the
deliberate plan - it is (currently anyway) the only way that we know how
to make the Internet routing system work.   If you have an alternative,
there are lots of us who would be only too pleased to learn of it.

  | I have not seen any effort on the part of these
  | router and systems vendors to simplify the rapid change of addressing.

That's largely true (from what I have observed as well).   It is a pity.
However, it is also expected - that is, why are they going to do any work
to change what they're currently selling, when everyone is simply content
to keep buying it.

And here, rather than pressure the vendors to change (and with a company
of your apparent size, which would also mean its likely large budget for
equipment) you're attempting to pressure the IETF to change the addressing
plan to make up for that.   That's backwards.   You should instead be
asking the vendors to support what you need.

  | For us this means not only changing addresses on over 40,000 thousand
  | interfaces,

IPv6 should make this much easier than it was with IPv4.  The combination
of auto-config and router renumbering (and perhaps more to come) should
make this task entirely manageable.   That's the plan anyway - if there's
anything missing to make it work, please let us know so that can be fixed.

  | but also changing over 100,000 lines of distributed policies.

But this one is truly a pain to manage currently.   But there's no real
reason why you should have a single IP address (v4 or v6) in such a database.
(That is, perhaps excepting a few well known addresses like 127.0.0.1).

That is, I've never yet heard of a policy which says "addresses that start
with a 10 are allowed in, because I like 10".   Rather, the policy is
"addresses from company X are allowed in" - and then when one looks, one
sees that addresses from company X start with 10, and no-one else's do,
so what goes in the policy is "addresses that start with 10" - then the
router/filewall/whatever has to do less work, its vendor has to do less
work, and you have to do lots more work.   And you're asking for that state
of affairs to continue?

The policies should be expressed in a form that actually expresses what
you want to say, and then should be being converted into something that the
packet forwarding engines can handle (which means, bit values of addresses).
As soon as that conversion gets to be automated, rather than done manually,
it becomes trivial to repeat it as frequently as is necessary to keep up
with any address changes - and what's more to automate that, so that it
all happens automatically, whenever addresses alter.

  | Almost all of our 20000 customer networks use firewalls.  Our addresses are
  | configured into these firewalls.

Same there, they don't care about your address - they care about you.
They shouldn't be configuring your address anywhere.   It is only the
primitive state of the existing tools that has led to this way of doing
things.   Let's fix that, rather than assuming there is no other way.

  | I am not sure if there is an IPv6 study group on the impact of changing
  | addresses, or if anyone has published anything regarding this topic.

There was a working group that considered the issues.   There needs to be
more work on this - it is an important topic.

  | If anyone knows of where I can find information regarding this I would
  | appreciate having it.

Look for the results that came from the pier working group (rfc1916
rfc2071 rfc2072), but don't expect too much.

  | I hate to say this to everyone who's worked so hard on IPv6.  The current
  | IPv6 addressing schema is unusable by anyone except Internet providers
  | trying to serve the household and small business market.  It needs to be0
  | redone to gain the support of large corporations.

It is well known that the current addressing plans are not what we would
really like to have.   But no-one yet has been able to suggest anything better
that will actually work.

There have been other suggestions, the "best of the rest" is probably Tony 
Hain's current suggestion for embedding locations in the address, so your
address says where you are geographically, and hence is unrelated to any
provider, etc.   Similar things (with less analysis and detail) have been
suggested before.   The problem with any of these kinds of schemes is that
to work properly, it requires particular connectivity - that is, it all
still reverts to topological addressing, but with the topology constrained
so addresses can be related to things other than which provider you happen
to be connected to.   There's never been any reason to presume that any
kind of constrained net topology can ever be made to happen.  Tony's draft
allows for that by simply giving everyone the choice - use either ISP
provided addresses, or connect to the constrained topology and get a
fixed address based upon your physical location.   It might work, my guess
is that it won't.

Having said all of that, let me also say that I'm not sure that your
particular situation would be as bad as you make it seem to be.

That is, if the sites you're connecting are on the IPv6 internet already
then you should simply be able to use their IPv6 addresses from their
regular internet connectivity.   Those might change occasionally, but
not all at once (ie: you're likely to have a continual stream of updates to
make, but only comparatively small ones - and nothing more difficult than
what happens due to new customers appearing, or old ones leaving).

If the sites don't have IPv6 connectivity, and you're running a private net
for your own internal purposes, then what do you care what the internet
addressing plan is like?   Just invent your own, assign your own addresses
to the client sites, and you all use those.   I kind of doubt that will
be the case though, it would be rather like the private phone systems, who
put in trunk lines to connect institutions to others assuming that the
people wouldn't also be connected to the PSTN - they will be, and so their
PSTN numbers can be (and are) used over the private lines - that makes things
simpler for everyone (even though there things need to be updated occasionally
when the PSTN numbers change).

There may be other options as well - is the NUSLA proposal ever gets into
implementations, then you could run things using site local addressing
everywhere, so you'd be completely immune to any global address changes.
That is, you'd essentially all just agree to keep your site local addresses
(which have a "which site am I" identifier in them with NUSLA) distinct
from each other, and then you could allow packets to pass between sites
using those addresses.   You get a flat unroutable address space, but your
net is easily small enough that that isn't an issue.

kre

---

From: Matt Crawford <[email-masked]>
Date: Wed, 08 Aug 2001 06:50:33 -0500

Ditto what kre said, plus there's also the possibility of
doing away with address-based controls on access to your data
altogether and substituting access by certificate or shared key
at the application or transport level, or ipsec with something
other than an address as the selector.

---

From: "Srinivasa Rao Nalluri" <[email-masked]>
Date: Wed, 8 Aug 2001 18:00:15 +0530

a test mail.
please click reply

bye
Nalluri

---

From: "Tony Hain" <[email-masked]>
Date: Wed, 8 Aug 2001 17:24:56 +0100

Aldrin,

I for one would like to thank you for the critique. One of the concerns I have had is that the current plans are biased to address the concerns of providers, simply because they had a voice in the process, while the end customers didn't. There are people trying to figure out how to deal with the multi-homing issues now, but again these are frequently focused on how to minimize the pain for provides, with hand-waving about how the result will be better for the end customer. Please feel free to inject some perspective into the debate, and encourage your peers to do the same. I would not want to mislead you that the result will necessarily be what you are looking for, but it stands little chance of being that without the input you could provide.

Tony

---

From: Dianna Adair <[email-masked]>
Date: Tue, 07 Aug 2001 17:43:36 -0700

7 August 2001

"over 20000 customer networks which constitute over a million computer
systems, of which over 150,000 subscribe to our data. " and you do not have the
sophistication to include a subject title or identify what company you propose
to represent, send with a hotmail address, and issue criticism against undefined
vendor software?

My humble opinion: Please spare the technical gurus the need to process these
types of e-mails

Dianna Adair
Volpar Inc

---

From: David Terrell <[email-masked]>
Date: Wed, 8 Aug 2001 20:01:06 -0700

> all happens automatically, whenever addresses alter.

interestingly enough, (and I'm not particularly pro A6), A6 chains
make this easier.

"Allow in all nets referenced by prefix.customer.example.net".

-- 
David Terrell             | "War is peace, 
Prime Minister, Nebcorp   | freedom is slavery, 
[email-masked]              | ignorance is strength 
http://wwn.nebcorp.com/   | Dishes are clean." - Chris Fester
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Matt Crawford <[email-masked]>
Date: Thu, 09 Aug 2001 04:53:23 -0500

I imagine that your routers have no difficulty in carrying a separate route 
for each of your customers, so there's no need for you to get involved in 
assigning them address prefixes.  As for tracking the possible changes in 
their prefixes, you (and your customers) will have to make that effort part of 
the cost of your service.  Whether it's easy or hard is still an open 
question, partly hining (IMHO) on DNS choices to be made in the near future.

---

From: "Aldrin Isaac" <[email-masked]>
Date: Thu, 9 Aug 2001 16:10:35 -0400

Matt,

  | I imagine that your routers have no difficulty in carrying a separate route
  | for each of your customers, so there's no need for you to get involved in
  | assigning them address prefixes.  As for tracking the possible changes in
  | their prefixes, you (and your customers) will have to make that effort part of
  | the cost of your service.  Whether it's easy or hard is still an open
  | question, partly hining (IMHO) on DNS choices to be made in the near future.

In the near future will routers, which currently carry almost all of the route policying
and most of the traffic filtering in large distributed networks, use v6 "DNSSEC" to get
the IPv6 address information they need to apply against arriving packets (rather than
manually coding IPv6 addresses into the routers configuration)?  If so, would there be any
examples of vendors that are participating in this effort?  One cannot look to vaporware
to build a network.

It seems that the new Internet is more DNS and less everything else (except if you are an
ISP).  Maybe it would be better to use DNS name to route packets instead of fixed-length
64-bit addresses (just kidding of course).

AI

P.S. I wonder if there is an illustration of the IPng "vision".  A picture is better than
a thousand words.