Subject: RE: Limiting the Use of Site-Local

From: "Michel Py" <[email-masked]>
Date: Mon, 28 Oct 2002 14:04:07 -0800

> Margaret Wasserman wrote:
> I've spent much of the last 7+ years working on IPv6
> stacks for embedded systems, and they have all
> supported global addressing.

The issue is not the capability of the devices to support global
addressing, but the desire of the network designer to configure a set of
devices that specifically don't have access to the public address space.

There are some military applications where devices have no business
talking to the outside world. Control devices or sensors on a water
distribution system or a power grid are another good example. These
devices have no business whatsoever accessing the public internet, and
it might be a requirement that the devices themselves have support for
public addresses removed.

Michel.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Alain Durand <[email-masked]>
Date: Mon, 28 Oct 2002 14:33:35 -0800

> public addresses removed.

Oh... the old argument that NAT/private address brings security...

	- Alain.

---

From: Margaret Wasserman <[email-masked]>
Date: Mon, 28 Oct 2002 17:49:50 -0500

>public addresses removed.

Private addressing does not provide any time of security that cannot
be obtained (and more easily, in most cases) by appropriate
configuration of firewalls or filters on routers.

Margaret

---

From: Keith Moore <[email-masked]>
Date: Mon, 28 Oct 2002 17:50:53 -0500

> devices that specifically don't have access to the public address space.

the device designer has absolutely no business assuming
that "site-local" threats are different than "global" ones.

otoh, if the network designer wants to impose such constraints,
packet filtering on global addresses is far more flexible and 
foolproof.
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------