Subject: RE: Limiting the Use of Site-Local

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Mon, 28 Oct 2002 20:11:22 +0100

> >   > > => I certainly didn't mean to suggest that the IETF
  > >   > > has an enforcement authority. I meant that this words
  > >   > > are used in cases where: if not followed, the protocol
  > >   > > will break. Therefore people generally follow them.
  > >   >
  > >   > if SLs are used in an environment where applications 
  > communicate
  > >                                       
  > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  > >   > across scope boundaries,
  > >     ^^^^^^^^^^^^^^^^^^^^^^^
  > > => In other words, be careful how you use it. That's not
  > > a reason to deprecate the use of site-locals altogether.
  > 
  > Their use should be confined to completely isolated 
  > networks so that 
  > they don't break applications.   And yet this same 
  > constraint was imposed
  > on RFC 1918 and it didn't stop RFC 1918 addresses from 
  > being misused.
  > So yes, I think there's a compelling case for deprecating 
  > SLs entirely.
  > But I'd be happy to hear of a way to impose a 1918-like restriction
  > that would actually work this time around.

=> It has a better chance of working this time because:
- No one expects addresses to become a scarce resource in our
lifetime anyway

- I haven't seen any plans by ISPs to charge based on 
the number of addresses. 

So, I don't think it's quite the same problem as with
RFC1918.

Hesham

  > Keith
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Keith Moore <[email-masked]>
Date: Mon, 28 Oct 2002 14:17:09 -0500

> So, I don't think it's quite the same problem as with

you're still missing the point.   NAT doesn't cause this particular
problem; use of limited scope addresses causes this problem regardless
of whether NAT is used.

Keith

---

From: Brian Haberman <[email-masked]>
Date: Mon, 28 Oct 2002 14:25:15 -0500

> So, I don't think it's quite the same problem as with

I agree that scarcity is not the issue.  Rather, the end user
sees it as simpler to slap a NAT in the network and connect
rather than go through and renumber the network.

Brian

---

From: Margaret Wasserman <[email-masked]>
Date: Mon, 28 Oct 2002 14:35:39 -0500

>problem; use of limited scope addresses causes this problem regardless

I wrote the following text for a document that I never published on
the impact of IPv6 site-local addressing.  I thought it might be useful
to interject it here...

Margaret

x.x.x  Similarities to NAT

     As you read through the problems caused by the use of IPv6 site-
     local addresses in globally connected networks, you will find that
     many of these problems are similar to the issues caused by IPv4
     NAT.  This is expected, as many NAT-related problems are caused by
     the use of private address spaces.

     Some of the complexities of IPv4 NAT are avoided by the fact that
     IPv6 SBRs do not translate site-local addresses into global
     addresses.  Instead, traffic to and from site-local addresses is
     dropped at site boundaries, with an appropriate ICMP error message.
     SBRs do not modify addresses in forwarded IP headers, so the use of
     IPv6 site-local addresses does not conflict with end-to-end
     security or peer-to-peer communication at the IP layer.

     Unfortunately, dropping packets with site-local IPv6 source or
     destination addresses does not prevent site-local addresses from
     being sent outside of the local site in upper-layer protocol
     headers or data.  This causes a set of problems for upper-layer
     protocols, some of which have been resolved in IPv4 NAT by the use
     of Application Level Gateways (ALGs).  One possible solution to
     these problems would be to implement IPv6 ALGs on site-border
     routers, but this solution does not seem satisfactory, as it would
     require infrastructure updates for the deployment of new
     applications and would not work properly with end-to-end
     encryption.

     Without the deployment of IPv6 ALGs, however, IPv6 would require
     upper-layer protocols to make intelligent choices about when to
     exchange site-local addresses with other nodes and/or how to
     interpret site-local addresses that are received.  This would
     require upper-layer applications to have knowledge of the site
     topology of the network, and it is not clear where or how this
     information can be obtained.

     IPv6 site-local addressing also introduces some problems that
     are not seen in networks that use IPv4 NAT, because it is possible
     for a single interface to have both global and site-local addresses.