Subject: RE: Limiting the Use of Site-Local

From: [email-masked]
Date: Thu, 31 Oct 2002 08:44:50 -0500

Ladies and Gentlemen,

First, please excuse my lack of background and intellectual knowledge in
all this discussion.

Many of the comments that I have read over the past few weeks regarding
this seem to revolve around the "theory" of how it should work. Theory is
great. Many of the people in this group that post are from acedemia and
research areas. I don't see too many posts from people that are actually
trying to make this all work.

The comments that "NAT shouldn't be used in IPv6 since we will have more
than enough IPs" is also great, in THEORY! Did we all think that we would
have enough IP numbers when IPv4 was started? I work for a federal agency
that has over 6,000,000 devices that need IP numbers. Most need access to
the "outside" world. However, do I want all of these devices visible to the
out side world? NO! Yes, we have border routers and firewalls that block
access from many of the "undesirables" that are out there.

Even if we get enough IPv6 numbers to ensure that every device can have a
unique number, we will still use NAT. Ok, federal government and leading
edge technology go together like military intelligence. The use of
site-local is a great proposal. What I think should be done is just like in
the IPv4 world, reserve a block (or a couple of blocks) of numbers that are
non-routable. This will allow companies to know what nubers they are to use
when setting up site-local numbers based on the number of devices.

Now, if I have misunderstood the entire context of this post, please refer
back to my opening sentence.

Gary Allmond

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Keith Moore <[email-masked]>
Date: Thu, 31 Oct 2002 09:58:28 -0500

> trying to make this all work.

Why in the world do you believe that people "from academia and research
areas" are not "actually trying to make this all work"?  I won't speak
for others, but "actually trying to make this all work" is *exactly* 
what I'm doing!  

Perhaps we should similarly disregard contributions from .gov addresses on 
the theory that the US government is just trying to interfere with, or tax,
the net's operation (or worse)?  It makes about as much sense.

I'd prefer that we judge posts on their technical merit rather than assuming
things about the purpose or background of people based on their email addresses.

Keith

p.s. And if you think that NAT is an appropriate mechanism to prevent access
to your devices from outside, perhaps you should remedy your "lack of 
background and intellectual knowledge".  There's no security benefit
that NAT provides that can't be provided with less disruption by stateful 
firewalls.
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 31 Oct 2002 08:37:34 -0800

Gary,

You have correctly assessed what this thread is about. The argument
boils down to 'we should prevent you from doing harm to yourself by
insisting that scissors were never invented'. That way we don't have to
keep telling you not to run with them. 

Thinking about it in the shower this morning, it occurs to me that the
disconnect stems from a strong desire to get out of the swamp we find
ourselves in with IPv4. The problem is that simply standing on the
outside of the swamp and saying 'jump over here' will never work. We
have to meet people where they are and provide them with stepping stones
that allow them to take the incremental step to work their way out.
People that run production networks need to keep focus on the real
expectations of that first step, or we run the risk of putting it too
far away which just prevents progress.

Tony

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> [email-masked]
> Sent: Thursday, October 31, 2002 5:45 AM
> To: Hesham Soliman (EAB)
> Cc: 'Pekka Savola'; Richard Draves; [email-masked]
> Subject: RE: Limiting the Use of Site-Local
> 
> 
> 
> Ladies and Gentlemen,
> 
> First, please excuse my lack of background and intellectual 
> knowledge in all this discussion.
> 
> Many of the comments that I have read over the past few weeks 
> regarding this seem to revolve around the "theory" of how it 
> should work. Theory is great. Many of the people in this 
> group that post are from acedemia and research areas. I don't 
> see too many posts from people that are actually trying to 
> make this all work.
> 
> The comments that "NAT shouldn't be used in IPv6 since we 
> will have more than enough IPs" is also great, in THEORY! Did 
> we all think that we would have enough IP numbers when IPv4 
> was started? I work for a federal agency that has over 
> 6,000,000 devices that need IP numbers. Most need access to 
> the "outside" world. However, do I want all of these devices 
> visible to the out side world? NO! Yes, we have border 
> routers and firewalls that block access from many of the 
> "undesirables" that are out there.
> 
> Even if we get enough IPv6 numbers to ensure that every 
> device can have a unique number, we will still use NAT. Ok, 
> federal government and leading edge technology go together 
> like military intelligence. The use of site-local is a great 
> proposal. What I think should be done is just like in the 
> IPv4 world, reserve a block (or a couple of blocks) of 
> numbers that are non-routable. This will allow companies to 
> know what nubers they are to use when setting up site-local 
> numbers based on the number of devices.
> 
> Now, if I have misunderstood the entire context of this post, 
> please refer back to my opening sentence.
> 
> Gary Allmond
>

---

From: Keith Moore <[email-masked]>
Date: Thu, 31 Oct 2002 12:25:51 -0500

> outside of the swamp and saying 'jump over here' will never work. 

True enough.  And neither will creating an even more complex swamp 
and saying "hey, try this swamp over here!  it's even better!"

Keith