Subject: Re: SL deprecation draft

From: "EricLKlein" <[email-masked]>
Date: Wed, 19 Nov 2003 15:12:16 +0200

Margaret.Wasserman wrote
> > I have been speaking to different
> > companies here in Israel, and the basic answer is that if I
> > can not have site locals and NAT then I will not move to IPv6.

> If these people are happy with IPv4 NAT, why would they want
> to move to IPv6?  They couldn't need more address space (net 10
> is huge), they obviously don't care about peer-to-peer or
> end-to-end connectivity outside their organization, I can't
> imagine that they want to deploy any IPv6-only applications
> or services...

Margret, you are correct. The way that one network person put it "if there
are no local addresses then we will just stay with IPv4 for our secure
applications, until it is no longer supported."

This is not the first time that I have heard that someone was willing to
skip IPv6 because of the percieved pain and security threat that standards
compliance would entail. But then again these are all people that take
security and network administration very personal and very seriously, and
the idea of having the accounts recievable (or worse payable) computer with
a globaly reachable address scares them to heck.

To be honest I stated these concerns back in the spring, and I still haven't
seen anything that would work to convince me that this is not what we as a
WG are proposing. If someone converts their existing network to a globaly
unique address range then what is responsible for filtering all of the
critical addresses from sending or recieving packets from the network over
the network Interent router? I see this as being moved from the protocol
level to that of the network technician, who now needs to explicitly deny
individual addresses (or ranges) rather and explicityl allow the permited
ranges.

Eric

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Tim Chown <[email-masked]>
Date: Wed, 19 Nov 2003 13:32:47 +0000

> a globaly reachable address scares them to heck.

I think Margaret is spot on... there is noone forcing sites to migrate to 
use IPv6.   Stick with IPv4+NAT if you think that meets your requirements.

Tim

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 19 Nov 2003 19:46:50 +0100

Eric,

Take your argument to the people opposing the Hain/Templin draft, because
your point is clearly made in that document.

   Brian

-- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Brian E Carpenter 
Distinguished Engineer, Internet Standards & Technology, IBM 

NEW ADDRESS <[email-masked]> PLEASE UPDATE ADDRESS BOOK

---

From: Andrew White <[email-masked]>
Date: Fri, 21 Nov 2003 11:38:36 +1100

EricLKlein wrote:
> skip IPv6 because of the percieved pain and security threat that
> standards compliance would entail. But then again these are all people
> that take security and network administration very personal and very
> seriously, and the idea of having the accounts recievable (or worse
> payable) computer with a globaly reachable address scares them to heck.
> 
> To be honest I stated these concerns back in the spring, and I still
> haven't seen anything that would work to convince me that this is not
> what we as a WG are proposing. If someone converts their existing network
> to a globaly unique address range then what is responsible for filtering
> all of the critical addresses from sending or recieving packets from the
> network over the network Interent router? I see this as being moved from
> the protocol level to that of the network technician, who now needs to
> explicitly deny individual addresses (or ranges) rather and explicityl
> allow the permited ranges.

The problem with these people's arguments is that it's not the address range
that gives the security, it's the fact that you have an isolated network
connected to the global network via only a proxy (NAT) and firewall.

You can use any address range you like inside the NAT.  However, if you
don't use a 'private' range you're running two risks:

- masking a portion of the global internet
- leaking addresses that look real but are actually invalid rather than
obviously invalid ones.

The advantage of a local/private address range is that you can create one
for whatever local use you need without needing to obtain space through a
registration authority.  The advantage of 'approximately unique' local
addresses (in the style of the Hinden/Haberman draft) is that you get
addresses with all the benefits of private address AND they're not likely to
conflict if you merge.

Any 'security advantage' of local/private addresses is just that if they
leak they are LIKELY (no guarantee) to not work 'properly'.

*As I understand it*, the TRANSLATION function of the NAT doesn't gain you
any real security benefits, except for scrambling your traffic (whether this
is a benefit is up for debate).  However, the many->one nature of most
deployed NATs acts as a stateful firewall.  You get almost all the security
benefits (without the scrambling) by putting a stateful firewall in place
with a very simple rule - if I didn't send something out, don't let anything
back. If you really want isolation, add a proxy of your choice.

And if your firewall isn't passing traffic, it doesn't matter what address
range is on the inside.

-- 
Andrew White

---

From: "EricLKlein" <[email-masked]>
Date: Sun, 23 Nov 2003 11:55:41 +0200

Andrew White wrote
> - leaking addresses that look real but are actually invalid rather than

This is exactly why some of us have been trying to prevent the depriciation
of local ("private") address.

> addresses with all the benefits of private address AND they're not likely
to

This would work, and would be acceptiable to most people if there was a
simple rule that worked, and would continue to work as the network grows. My
concern is that an 'approximately unique' local address could at some point
become less than unique and could cause routing problems when the address is
eventually assigned. I mean, how many companies would use this
'approximately unique' local address option and thus "claim" portions of the
network, while the registreies are assigning addresses? Eventually there
will be legimate asigned users to some of these 'approximately unique' local
addresses and this will cause problems later.

Eric

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 24 Nov 2003 09:53:12 +0100

> of local ("private") address.

And it is why those of us unwilling to accept the major operational problems
of *ambiguous* private addresses are trying to provide an unambiguous replacement.
> eventually assigned. 

You don't seem to have read the Hinden/Haberman draft closely. The plan is that
there will be a central registry for people with this concern.

> I mean, how many companies would use this
> network, 

They aren't claiming any such thing. They own their internal networks and
this is just a quick way for them to make them useable without the overhead
of going to a registry. And I would expect every dentist's office to use this
mechanism.

> while the registreies are assigning addresses? Eventually there
> addresses 

No there won't. The Hinden/Haberman proposal makes this entirely clear. There
is no overlap between registry-assigned addresses and locally-asssigned ones.

> and this will cause problems later.

No it won't, because it isn't true.

   Brian