Subject: RE: Limiting the Use of Site-Local

From: "Michel Py" <[email-masked]>
Date: Thu, 31 Oct 2002 09:17:15 -0800

Margaret,

[you have not adressed the security issues?]

> I am _not_ operating under the assumption that all
> globally-unique addresses will appear in global routing
> tables.  If I want to have a private network, I should
> be able to get a globally unique (routable, but _not_
> necessarily globally routed) address, and _not_ have my
> ISP advertise that prefix into the global routing tables.

Problem is, nobody has bought this yet, because these addresses are PI,
whatever you might call them, and will be misused and leaked to the
defaultless table one day or the other, especially in the lack of a
multihoming solution.

> I actually _agree_ that it would be better if I could
> obtain provider-independent global addresses.  But
> perhaps that is a different fight for a different
> day...

I have co-authored a draft on the topic, but it's not going anywhere
anytime soon; in the meantime, deployment of Ipv6 needs *something*
comparable to site-locals, or else people will hijack prefixes anyway.

> Site-local addresses could continue to be useful in
> networks that are not routed (at all) to the global
> network. This would include isolated sites, non
> Internet-connected sites within cars and planes, etc.

This needs to be clarified. How many "networks" or "sites"  is the
diagram below, not including the ISP nor the first router that I
included only for reference purposes?

<------------------- Global Addresses ---------------><-- SL addr -->
+-----+
| ISP |
+--+--+
   !
+--+-------+  +----------+     +----------+     +----------+
| Router A +--+ Firewall +--+--+ Firewall +--+--+ Router B +----+
+----------+  +----------+  |  +----------+  |  +----------+    |
                            |                |                  |
                        +---+--+          +--+---+         +----+----+
                        | DFZ  |          | Host |         | Control |
                        | Host |          +------+         | Device  |
                        +------+                           +---------+
               <---------------------- Network ---------------------->

In my reading, one. I am all for a draft or something that says that the
part that has SL addresses can never talk to anybody past the outside
firewall, but it needs to talk to the regular hosts that have global
addresses between the first firewall and router B, and possibly to the
DFZ hosts.

What concerns me is that this network would not be considered an
isolated network. Without getting in the details of stack implementation
and scopes, it does not appear impossible to me to have the two sides
communicate. I have configured many IPv4 sites that would match the
diagram above, replacing SLs with RFC1918, that did not have NAT, and
where the network's internal routing table contained both public and
private addresses. Someone still has to explain me what's wrong with the
picture above.

Michel.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Keith Moore <[email-masked]>
Date: Thu, 31 Oct 2002 13:48:24 -0500

> defaultless table one day or the other, especially in the lack of a

I don't buy it.  If the standards say that ISPs in the public Internet 
are supposed to filter advertisements for global PI addresses, I'm 
confident they will get filtered in the vast majority of cases.

It's not like the situation with v4 where there are varying levels of
gray about which prefixes it's reasonable to advertise.  We're talking
about a clear-cut distinction here, ideally a single (short) prefix
that should be black holed.

Of course if individual ISPs want to advertise routes to such prefixes
internally, perhaps because they're paid to do so, that's their own 
business. 

Keith

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 31 Oct 2002 11:16:37 -0800

Keith Moore wrote:
> > Problem is, nobody has bought this yet, because these addresses are 
> > PI, whatever you might call them, and will be misused and leaked to 
> > the defaultless table one day or the other, especially in 
> the lack of 
> > a multihoming solution.
> 
> ...
> Of course if individual ISPs want to advertise routes to such 
> prefixes internally, perhaps because they're paid to do so, 
> that's their own 
> business. 

You contradict yourself. Michel points out that an unambiguous address
space will be leaked, and you end up agreeing that the ISPs will do that
when paid. The only way to prevent that case is for the ISP to have the
technical barrier of ambiguity to push back on the business side of the
house.

Tony

---

From: Keith Moore <[email-masked]>
Date: Thu, 31 Oct 2002 14:29:47 -0500

> when paid. 

no.  what an ISP advertises to itself and what it advertises (and accepts)
across ISP boundaries are different things.

> The only way to prevent that case is for the ISP to have the

there are even better business reasons for filtering such advertisements 
unless the owner of that block of addresses is paying you specifically 
to route them within your network.  that, and the threat of router
overload for ISPs that don't filter such advertisements, should be sufficient.

Keith

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 31 Oct 2002 12:03:58 -0800

Keith Moore wrote:
> ...
> no.  what an ISP advertises to itself and what it advertises 
> (and accepts) across ISP boundaries are different things.

You assume that an ISP is not paid enough to make sure the upstream is
also paid to accept it.

> 
> > The only way to prevent that case is for the ISP to have 
> the technical 
> > barrier of ambiguity to push back on the business side of the house.
> 
> to route them within your network.  that, and the threat of 
> router overload for ISPs that don't filter such 
> advertisements, should be sufficient.

We have an existence proof in the current BGP table that it is not
sufficient.

Tony

---

From: Keith Moore <[email-masked]>
Date: Thu, 31 Oct 2002 15:24:25 -0500

> You assume that an ISP is not paid enough to make sure the upstream is

If an ISP wants to pay each of its upstream ISPs to advertise 
those routes, and provide a single bill to its customers,
it's free to do so.  As routing table space becomes more
precious, so will each ISP's cost to advertise a prefix.   
Provider-based routing will be cheaper because it needs to 
advertise fewer prefixes due to aggregation.

> > there are even better business reasons for filtering such
> > advertisements unless the owner of that block of addresses is paying you
> > specifically  to route them within your network.  that, and the threat of

as I already said, I don't think the current situation is a good predictor 
because of the IPv4 swamp, and because there is no clear distinction
between provider-based and provider-independent addresses in IPv4.

Keith

---

From: Margaret Wasserman <[email-masked]>
Date: Thu, 31 Oct 2002 15:41:09 -0500

>[you have not adressed the security issues?]

Which security issues?

 From what I can see, there are a number of people on
this list who know a lot more than I do about security,
and you are divided on the issue of whether or not
IPv6 site-local unicast addresses have any security
benefits at all...

What would I have to add to that?

Margaret