Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IPv6 address space layout best practices

networkengineering.stackexchange.com

Post reply on HN
Print view View original

11–15 of 15 posts

Re: IPv6 address space layout best practices

#11

Post by vy8vWJlco »

ghshephard wrote: post #2

We've rolled out about 12 million nodes on IPv6, over 300 customer /48 networks, and about 6,000 individual /64 subnetworks. 99% of those have been RFC 4193 Unique Local IPv6 Unicast addresses. IPv6 is like a breath of fresh air when it comes to setting up address spaces. For the past 10 years as a network engineer, three overriding issues have existed when setting up new networks. (1) Begging ARIN for a /19 or /20 w…

You've heard it before, but for the sake of balancing your comment on NAT... Sincerly and honestly: NAT does not solve anything that a firewall (6 lines of ip6tables rules) - or stopping that unecessary service - doesn't. All it does is create two classes of network devices (and netizens): those that can talk directly and those who depend on a third party. There's no reason not to have a global address anymore, even if you don't expect to use it. Even something as simple as putting a firewall appliance in the middle is the wrong approach. Logic needs to be near the edge, in the host IMHO; by putting any rules in the middle (firewall, NAT, QoS), other than the basic routing, one loses the intended ability to dial direct in unanticipated scenarios tomorrow (for example, to run a new service without touching every hop between A and B because of dozens of attempts to "make it better" at that hop). IMHO NAT really is an example of our eagerness to hang ourselves, given enough rope.

Re: IPv6 address space layout best practices

#12

Post by gizmo686 »

guelo wrote: post #10
calinet6 wrote: post #8

Fascinating... it seems easy enough, basically in that address space is abundant enough to not have to be concerned with much of anything in a local space. But it reads juuuuust slightly more complex than IPv4 does... it's just that side of difficult to comprehend. I think this is the true human factor behind the lack of adoption. It's huge, like looking at all the stars in the sky, but bigger. Just the switch from n…

I think it is just the prejudice about how "easy" things that we already know seem. But I do remember, and have seen many people, struggling to get a grasp of IPv4 subnetting, routing, security, etc. But you practice and over time it becomes second nature. If you put in half the amount of effort into IPv6 that you did when you learned IPv4 you'd probably be set.

While I am really looking forward to IPv6, I am slightly dissapointed about global addresses. Granted, globally routable adresses is the main (only) thing that is getting me exited for IPv6, but there is something nice about being able to go into a new network and only need to remember "2.10" for an IP address. (Espessial when all the IPs I care about are set to the low "0.x").

Re: IPv6 address space layout best practices

#14

Post by ghshephard »

vy8vWJlco wrote: post #11
ghshephard wrote: post #2

We've rolled out about 12 million nodes on IPv6, over 300 customer /48 networks, and about 6,000 individual /64 subnetworks. 99% of those have been RFC 4193 Unique Local IPv6 Unicast addresses. IPv6 is like a breath of fresh air when it comes to setting up address spaces. For the past 10 years as a network engineer, three overriding issues have existed when setting up new networks. (1) Begging ARIN for a /19 or /20 w…

You've heard it before, but for the sake of balancing your comment on NAT... Sincerly and honestly: NAT does not solve anything that a firewall (6 lines of ip6tables rules) - or stopping that unecessary service - doesn't . All it does is create two classes of network devices (and netizens): those that can talk directly and those who depend on a third party. There's no reason not to have a global address anymore, even…

Good balance - and certainly it's a common refrain from those who are architecting and writing RFCs. And, keep in mind, 100% of all corporate networks I've seen with NAT, also have (typically very expensive) firewalls with highly restrictive rules. But corporate IT stooges (which I've certainly played the roll of) will say: "Here is what NAT will do for you with IPv6"

#1 - You don't expose any internal hosts addresses to the external world, everything comes from a single external host.

#2 - No route back to the hosts inside the lan. If they can't route to you, they can't attack you. (Not really true, but it does make it more challenging to mount an attack from the Outside -> In. )

#3 - You can change ISPs without any internal renumbering required. Unlike with IPv4, getting provider-independent IPv6 space can be challenging.

IPv6-to-IPv6 Network Prefix Translation (NPTv6) might be a happy middle ground that solves #3, but still leaves you mostly exposed on #1 and #2.

Re: IPv6 address space layout best practices

#15

Post by vy8vWJlco »

ghshephard wrote: post #14
vy8vWJlco wrote: post #11

Earlier quoted context omitted.

You've heard it before, but for the sake of balancing your comment on NAT... Sincerly and honestly: NAT does not solve anything that a firewall (6 lines of ip6tables rules) - or stopping that unecessary service - doesn't . All it does is create two classes of network devices (and netizens): those that can talk directly and those who depend on a third party. There's no reason not to have a global address anymore, even…

Good balance - and certainly it's a common refrain from those who are architecting and writing RFCs. And, keep in mind, 100% of all corporate networks I've seen with NAT, also have (typically very expensive) firewalls with highly restrictive rules. But corporate IT stooges (which I've certainly played the roll of) will say: "Here is what NAT will do for you with IPv6" #1 - You don't expose any internal hosts addresse…

I'm still vehement that #1 & #2 are wishful thinking (security through obscurity... better to drop all packets, or simply not use a public address; ULAs are fine IMHO), but perhaps something as simple as a prefix-aliasing notation would allow easier internal referencing and address #3. For example, MY_NETWORK:1. That can be done with shell/environment variable substitutions before using them, but it would be nice to be able to count on IPv6 applications to accept something like that for networks in the routing table... (might require a prefix-naming RFC, so a name can come with a router/prefix advertisement and/or the ability to store name-to-network prefix mappings in DNS SRV, or similar, allowing internal or global users to find the right host on the right network...)

That said, truly global addresses with service registries like DNS/mDNS, etc, remove the need for immutable (staticly-assigned and hard-coded) addresses entirely, albeit at the expense of registration and lookup.

Post reply on HN