Subject: RE: (ngtrans) private networks under 6to4-04

From: "Klein, Eric" <[email-masked]>
Date: Tue, 2 May 2000 09:33:26 +0300

Brian, 

You misunderstand. I am talking about designs where there is no direct
registered IPv4 address. For example I am working on a project where it is
100 sites of all private network all using RFC 1918 addresses. These sites
may be connected to routers that have registered Ipv4 or IPv6 addresses used
on them, but I need to assure that the private traffic is always isolated
from the public net.

Using RFC 1918 on an IPv4 network this is no problem as even if the private
network connection should go down and routing tables try to use the default
route to the public network, those routers will discard this traffic because
it is a  RFC 1918 address as the destination.

Under IPv6 I can find no private network allocation. is this because it is
assumed that all addresses will be registered even to the desktop? If so
then the whole concept of private networks it thrown out the window. I don't
think that this is a valid assumption.

Eric

-----Original Message-----
From: Brian E Carpenter [mailto:[email-masked]]
Sent: Monday, May 01, 2000 11:02 PM
To: Klein, Eric
Cc: Sowmini Varadhan; [email-masked]; [email-masked]
Subject: Re: (ngtrans) draft-ietf-ngtrans-6to4-04.txt

Eric,

No, we specifically forbid the use of RFC 1918 addresses to form the 6to4
prefix,
and this will be even more clear in the next version. The whole point of
6to4
is to create global prefixes, which by definition can't be done with RFC
1918
addresses.

This isn't a problem, because even if a customer only has one globally
unique
IPv4 address, and all the rest are RFC 1918 addresses, that one is
sufficient to 
generate all the IPv6 addresses the customer is ever going to need.

IPv6 has no equivalent of RFC 1918 addresses, and doesn't need them since
there is plenty of address space for everybody. The myth that private
addresses guarantee privacy will not be propagated in IPv6.

   Brian

"Klein, Eric" wrote:
> 
> Brian,
> 
> This draft it states:
>         5.8 Usage within Intranets
> 
>            There is nothing to stop the above scenario being deployed
within
> a
>            private corporate network as part of its internal transition to
> IPv6;
>            the corporate IPv4 backbone would serve as the virtual link
layer
> for
>            individual corporate sites using 2002:: prefixes.  The V4ADDR
> MUST be
>            a duly allocated global IPv4 address, which MUST be unique
within
> the
>            private network. The Intranet thereby obtains globally unique
> IPv6
>            addresses even if it is internally using private IPv4 addresses
> [RFC
>            1918].
> 
> This may seem like a silly question, but is there an allocation of
addresses
> to be used strictly for private networks similar to what is specified in
> RFC 1918        Address Allocation for Private Internets   February 1996
> 
> 3. Private Address Space
> 
>            The Internet Assigned Numbers Authority (IANA) has reserved the
>            following three blocks of the IP address space for private
> internets:
> 
>              10.0.0.0        -   10.255.255.255  (10/8 prefix)
>              172.16.0.0      -   172.31.255.255  (172.16/12 prefix)
>              192.168.0.0     -   192.168.255.255 (192.168/16 prefix)
> 
>            We will refer to the first block as "24-bit block", the second
as
>            "20-bit block", and to the third as "16-bit" block. Note that
(in
>            pre-CIDR notation) the first block is nothing but a single
class
> A
>            network number, while the second block is a set of 16
contiguous
>            class B network numbers, and third block is a set of 256
> contiguous
>            class C network numbers.
> 
> This is a very valid need for private networks that are currently using
> these private networks, and wish them to remain private. There needs to be
> some method for both converting these on an IPv4 network that is
> transitioning to IPv6 network and in the final IPv6 network.

---

From: Stig Ven�s <[email-masked]>
Date: Tue, 2 May 2000 09:04:19 +0200

> it is a  RFC 1918 address as the destination.

There are Site-Local addresses in IPv6, I think they should fulfill your
needs. See for instance RFC 2373.

Stig

-- 
Stig Venaas
UNINETT

---

From: Greg Maxwell <[email-masked]>
Date: Tue, 2 May 2000 10:50:35 -0400 (EDT)

On Tue, 2 May 2000, Klein, Eric wrote:

[snip]
> think that this is a valid assumption.

Why? 

Before Internet access was widespread and before RFC1918, large IP based
sites used registered prefixes on their disconnected networks.

You should not confuse private addressing with disconnected networks. When
you use RFC1918 your network is no more 'private' then if you were
connecting with public addressing, public connections are just obfuscated 
by the lack of global addressing.

With IPv6 you can use a public prefix on an otherwise disconnected
network. With this, you are no less private because disconnection
provides all the privacy that you are going to get via technoligical
means. Global addressing ensures that your network will continue to
function without renumbering when you need to peer with the disconnected
(or not?) network of your vendors, friends, or companies you merge with.

The importance of globally unique addressing is a core concept of IP and
is reemphasized with IPv6. If you are willing to live in the hellish world
of NATs opon NATs opon NATs then you could just as well stay with IPv4.

---

From: Keith Moore <[email-masked]>
Date: Tue, 02 May 2000 11:03:36 -0400

> network.

sure you can, but how are you going to get a public prefix?
normally you would get a prefix from your ISP, but if you're on
a disconnected network then you might not have an ISP.

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 02 May 2000 16:47:50 -0500

> on them, but I need to assure that the private traffic is always isolated

I didn't misunderstand at all. The motivation for RFC 1918 was to allow
re-use of scarce address space re-use, and IPv6 doesn't need this, so
it is not available.

I'm quite aware of the myth that RFC 1918 addresses are necessary to ensure 
privacy. But it's a myth.

  Brian