Subject: RE: Default site-local behavior for routers

From: "Richard Draves" <[email-masked]>
Date: Thu, 31 Oct 2002 10:11:12 -0800

> Does anyone have an operational network that uses site-local 
> addresses to provide private addressing within a globally 
> connected network?  Why did you choose to do this?  What were 
> your experiences? Please note that I am interested in 
> deployed, operational networks, not theoretical deployments.

Yes Microsoft operates such a network.

> Have any network administrators installed a two-faced DNS 
> that returns IPv6 site-local addresses within the site, but 
> not externally? How did that work out?

Yes it uses two-faced DNS. It works fine.

Rich

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Fri, 01 Nov 2002 03:46:39 +0900

>Yes Microsoft operates such a network.

	curious: do you run any router which participates to multiple sites?

itojun

---

From: Keith Moore <[email-masked]>
Date: Thu, 31 Oct 2002 13:51:11 -0500

> Yes it uses two-faced DNS. It works fine.

not everyone uses Microsoft software, you know.

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 31 Oct 2002 11:11:33 -0800

> 	curious: do you run any router which participates to 

Why would they? It is an address space that they can use for internal
purposes. If they wanted to communicate to an external entity, they
would either have to coordinate use of the SL space, or simply use
globals. 

Tony

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 31 Oct 2002 11:20:25 -0800

> not everyone uses Microsoft software, you know.

That was not a sales pitch from Rich, so don't turn it into one. The
question Margaret asked was if anyone had an example of running code. A
yes answer tends to deflate the argument that it can't be done.

Tony

---

From: Ralph Droms <[email-masked]>
Date: Thu, 31 Oct 2002 14:26:38 -0500

Perhaps Microsoft has a requirement for multiple, independent address 
spaces (there's nothing that requires Microsoft == one-site)?  Or the 
Microsoft net is in some way adjacent to another network using SLs?

Adjacent nets that both use SLs is an interesting (potentially 
problematic?) architecture - I would be interested in finding out about 
deployment experience with that case.

- Ralph

---

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Fri, 01 Nov 2002 04:30:13 +0900

>would either have to coordinate use of the SL space, or simply use

	depending on your definition of site border, Microsoft router can
	participate both Microsoft site as well as upstream-ISP site.

	see Miyakawa-san's DSL service plans - CPE participates to both ISP
	site as well as customer site.

	i still think it necessary to:
	- limit nodes from joining more than (including) 2 sites at the same
	  time.
	- document site-border router's behavior in full

itojun

---

From: Keith Moore <[email-masked]>
Date: Thu, 31 Oct 2002 14:31:58 -0500

> That was not a sales pitch from Rich, so don't turn it into one. 

sorry, not how I read it at all - I read it as saying "it works for us".
but since Microsoft mostly runs Microsoft software, the fact that SLs
work within Microsoft isn't much of an indicator for sites that don't
exclusively use Microsoft software.

> The question Margaret asked was if anyone had an example of running code. 
> A yes answer tends to deflate the argument that it can't be done.

nobody has claimed that a network using SLs can't be done - only that it's 
not a good idea.  the fact that Microsoft has done something certainly 
doesn't demonstrate that it is a good idea.

Keith

---

From: Keith Moore <[email-masked]>
Date: Thu, 31 Oct 2002 14:47:36 -0500

> would either have to coordinate use of the SL space, or simply use

well, if an issue with SLs is how they affect apps that talk across
site boundaries, then it doesn't appear that they would have exercised
that case unless they had multiple sites internal to their network.

Keith

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 31 Oct 2002 12:16:03 -0800

itojun wrote:
> ...

Participate in both, but not route SL prefixes between them. This is
easy since it can track which interface is appropriate for any given
use. 

> 	- limit nodes from joining more than (including) 2 

If it is not capable of tracking which interface is in which site, it
should not be able to join more than one at a time. If it can, there is
no reason to limit its ability to be connected to. 

> 	- document site-border router's behavior in full

I agree that it should be documented. The conditions that need specific
attention are; the case where there are multiple disconnected SL routing
spaces, and the node just happens to be attached to more than one
(multi-homed host model); the case where a site-border is also the
transition between the IGP & EGP (well understood border model); the
case where the site-border is expected to route between different SL
address administrations (unless the interconnecting router is also a
nat, this amounts to a normal IGP with one address domain under
distributed management). 

Tony

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 31 Oct 2002 12:25:55 -0800

> deployment experience with that case.

This is exactly the case that Keith is concerned about. There is no
magic here, in this situation the address space needs to be coordinated,
or a nat is required. Since we are all trying to avoid nat, the hammer
approach is to simply ban SL. My argument is that it is more pragmatic
to simply document the failure modes. If we can just do that, we will be
able to put the effort into developing a PI approach with better support
for the multi-party app.

Tony

---

From: Ralph Droms <[email-masked]>
Date: Thu, 31 Oct 2002 15:45:54 -0500

Tony,

I don't know about any magic involved; I'm just interested in hearing about 
operational experience that would help us understand exactly what's 
involved in all of the possible cases.

Also, perhaps it was good that I asked the question, because I'm not sure I 
understand part of your response.   You wrote "the address space needs to 
be coordinated, or a nat is required." for a "PI approach with better 
support for the multi-party app."  I must have missed this part of the 
thread in the flood of e-mail on the topic - are we looking for a way to 
support applications that span multiple sites that each use site-local 
addresses?

- Ralph

---

From: Keith Moore <[email-masked]>
Date: Thu, 31 Oct 2002 15:54:17 -0500

> to simply document the failure modes.

I certainly think it's worthwhile to document the failure modes.

I'm not at all sure it is more pragmatic to do "simply" that than
to discourage SLs more forcefully - it's certainly easier to do
the "simple" thing but I doubt that the result would be considered
successful.  I don't want to end up with lots of networks that use 
SLs and can't support apps because (as happened with NATs) network 
admins weren't sufficiently aware of just how much SLs break apps.  

(i.e. there's still a significant gap between documenting the 
failure modes and actually understanding how much this hurts - 
for the same reason that reading my "what nats break" web page 
doesn't tell you which of the apps that you want to run will 
not run.)

as has been pointed out several times, SLs will be attractive
to many network admins simply because they exist and they look like
what many people are predisposed to think of as the "right" solution.
so there's a bit of an uphill battle to discourage them, but 
I really think it's what we need to do.

Keith

---

From: Keith Moore <[email-masked]>
Date: Thu, 31 Oct 2002 16:24:44 -0500

> are we looking for a way to

the reality is that if SLs are widely used in v6 networks, apps will 
be expected to span sites using SLs, just as they are now expected 
to span between the public internet and sites using RFC 1918 addresses, 
and sometimes between multiple sites using RFC 1918 addresses.

today that tends to require either that all nodes on private networks 
maintain an open connection to a point-of-contact in the public 
network, and/or that there be appliation-specific proxies at points
where the various realms meet.  and it often requires a fair amount 
of complexity in the app due to lack of a usable global address space
and the need to do routing through such proxies.

Keith

---

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Fri, 01 Nov 2002 07:06:21 +0900

>easy since it can track which interface is appropriate for any given

	you need to have separate routing table for those, or you need to do
	other tricks (like KAME's embedded link-local scope identifier).  and
	routing protocol interaction is tricky.

>no reason to limit its ability to be connected to.=20

	i'm proposing to limit it because it is (i believe) way too difficult
	to support routing protocol instances for multiple sites.  for example,
	if you get a default route from three sites you are joined to, what
	are you going to do?  or what if you get 2001:240::/32 from both sides,
	what are you going to do?

itojun

---

From: [email-masked]
Date: Fri, 01 Nov 2002 09:45:00 +1100

> Yes it uses two-faced DNS. It works fine.

	I suspect that you need to qualify that with "Provided there is
	only one site".

	Mark
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------