Subject: RE: (ngtrans) Re: pinging prefixes - IPv6 is not just for the public Internet

From: Steve Deering <[email-masked]>
Date: Fri, 15 Jun 2001 14:45:34 -0700

At 12:26 PM -0700 6/15/01, Christian Huitema wrote:
>There are a lot of examples of related companies maintaining a set of
>"direct connections" -- what Keith called VPN. We may question their
>motives; we may well believe that they would be better off just using
>the regular Internet, but well, we could just as well show some
>humility.

I think you are talking about ACTUAL private networks, not VIRTUAL
private networks.  The VPNs are the ones built by tunneling over
some part of "the regular Internet" (or at least some IP internet
not specifically built for a given enterprise or set of enterprises).
It's the tunneling that makes them "virtual" networks (like the
MBone).  I was just questioning the need for the VPN abstraction,
and its instantiation by using encapsulation, in such cases.
After all, secure communications of adequate QoS is a service
that we hope the public IPv6 internet will be able to provide for
*any* users, without the need to build virtual circuits on top
of it.  That's what IPsec, the Traffic Class field, and (perhaps,
someday) the Flow Label field are all about.

I have no problem with actual private networks, nor necessarily with
virtual private networks -- I was just humbly questioning whether
VPNs actually buy anything.

> They would not spend the huge amount they are spending if they
>did not perceive some business need. This need is not going to go away
>with IPv6.

If you are talking about VPNs and not APNs, sure there's a business
need for for high-quality, secure service within and among enterprises;
do we have to do tunneling to satisfy that need?

>Could we manage these back-door connections with global IPv6 address?
>Certainly. In fact, Keith is precisely saying that. It is a lot easier
>to interconnect globally addressed entities than to use the current
>set-up that involves double natting.

I agree wholeheartedly with that, so if my response to Keith was read
otherwise, I'm sorry for not being clearer.

> Should we mandate the use of "provider based addresses"? That is
>debatable.

I was nor advocating "mandating" anything, but had assumed (perhaps
incorrectly) that every enterprise would naturally connect to the
public Internet anyway, in addition to any private networks they might
have, and therefore would already have one or more globally-unique
prefixes that could also be used for routing across their private nets.

>I certainly see the point of opening a registry of "non
>aggregatable network ids", so that sites could acquire a unique /48.
>These numbers don't need to be advertised in BGP; but they can
>definitely be useful for the management of "back door" connections.

See my response to Keith, regarding an alternative to setting up another
registry.  Of course, another way to get a globally-unique /48 for
private use is to use the existing IPv4 registry system to get a
single, global IPv4 address and then use it with the 6to4 format
prefix.

Steve