Subject: Re: ULA-C (Was: Re: IPv6 will never fly: ARIN continues to kill it)

From: [email-masked] (Noel Chiappa)
Date: Wed, 19 Sep 2007 12:50:05 -0400 (EDT)

> From: "Stephen Sprunk" <[email-masked]>

    > .. ULA-C/G leaks will not collide with each other. This means that,
    > unlike RFC1918 which is _impossible_ for ISPs to route for multiple
    > customers, ULA-C/G routes _can_ be routed publicly. Any prohibition
    > on doing so by the IETF or RIRs can (and IMHO, will) be overridden by
    > customers paying for those routes to be accepted.

Which would argue that the only realistic way to make *absolutely certain*
that IPv6 "private" addresses truly *cannot* be used out in the 'main'
internetwork is to allocate the same ranges of addresses to multiple
parties.

Anything else is just PI with a few speedbumps, and a different label.

	Noel

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Keith Moore <[email-masked]>
Date: Wed, 19 Sep 2007 13:20:20 -0400

> internetwork is to allocate the same ranges of addresses to multiple
Perhaps, but then we end up with all of the problems associated with
ambiguous addresses, and we lose all of the advantage of IPv6.
> Anything else is just PI with a few speedbumps, and a different label.
Maybe, maybe not.  In practice, today, not every IPv4 address prefix is
PI.  Today, the length of your IPv4 prefix has some influence on whether
your prefix gets advertised.  There may not be an absolute boundary, but
there is a barrier nonetheless.  So I can certainly imagine that it
would be harder to get ULA prefixes as widely advertised as PA
prefixes.  How much harder, I cannot say. 

So the speedbumps might be useful.  But people wanting to absolutely
forbid any ISP from advertising a ULA prefix will probably be
disappointed.  That doesn't bother me, because I don't think it's
necessary to have that absolute prohibition in order for networks to
push back on routing table size and routing complexity.  

Sooner or later, routing scalability will be a problem in IPv6.  When
that happens, each network will pick some means to decide which prefixes
get advertised within its network and which get filtered.   It's not
rocket science to guess that networks will favor their own customers,
the networks with which they have explicit agreements, and the networks
from which their customers derive the most value.   That probably puts
most ULAs and PIs fairly far down in the preference list.

---

From: Thomas Narten <[email-masked]>
Date: Wed, 19 Sep 2007 16:51:01 -0400

> most ULAs and PIs fairly far down in the preference list.

Actually, my read of arguments coming from those opposed to ULAs is
that a good number of folk are worried that the some, if not many,
ULAs would be pretty high up on the preference list. I.e., those
hosting content that has become popular. And owners of those services
will simply go to ISPs and say "route this, or I'll find someone else
who will". And the sales and marketing departments of many ISPs will
fall over each other to be the first to say "why certainly we'd love
your business". And then the simple notion of filtering "all ULA
space" goes out the window and we have huge mess, that involves even
more pressures to accept more routes (despite the limitations on
technology), etc.

You may disagree with that scenario, but it is one that does concern
people in the operational community and is one reason why the proposal
is currently wedged.

And when those making those arguments come from ISPs who have "been
there and done that" and have been asked in previous lifetimes to do
exactly that sort of thing, I gotta admit, it makes me a bit nervous.

Thomas

---

From: Keith Moore <[email-masked]>
Date: Wed, 19 Sep 2007 23:54:32 -0400

> people in the operational community and is one reason why the proposal

Actually I don't disagree with the scenario at all; in fact I think it's
exactly what I envision.  I just don't see why it's such a horrible thing.

What I see as happening when the owners of those services go to ISPs and
say "we'd like to have these ULAs be routed" is this:  The ISPs say
"Great, and we'd love to route them for you.  However, as we are sure
you know, routing table space is scarce, and routing updates are
expensive, and ULAs aren't aggregatable.  So it costs a lot to route
them, not just for us but for other ISPs also.  There are brokers who
lease routing table space in ISPs all over the world, and they'll
sublease a routing table slot for your ULA prefix - for a price.  But
you'll be competing with lots of services for a small number of routing
table entries, and they go to the highest bidders. "

"On the other hand, it appears the particular services that you are
offering to the general public would work just fine with PA address
space.  Furthermore,  we'll be happy to offer you our "graceful
transition" (tm) service in our contract with you, so that when the term
of our contract comes to an end, we'll continue to accept traffic at
your old PA addresses and tunnel that traffic to your new addresses for
a specified period of overlap - basically the length of your DNS TTLs
for those addresses.  You can still use ULAs for your internal traffic
and - via bilateral agreement - for traffic with other sites.  We'd be
happy to arrange tunnels to those other sites for routing traffic to and
from your ULAs.  Or if those destinations are our customers, we'll route
those ULAs natively - we just won't advertise them to other networks
that we know will filter them.  But a lot of sites prefer that their
ULAs not be advertised on the public Internet because that lessens the
exposure of their non-public services to miscreants."

Keith

---

From: Fred Baker <[email-masked]>
Date: Thu, 20 Sep 2007 01:34:34 -0700

> owners of those services will simply go to ISPs and say "route  
> this, or I'll find someone else who will".

I'm actually not as convinced of this. Yes, they can get routing from  
their ISP, and the ISP will be happy to sell it to them. Can they get  
it from their ISP's upstream, and from that ISP's downstreams? To  
make it into PI space in the usual sense of the word, I think they  
wind up writing a contract with every ISP in the world that they care  
about.

I think ULAs will exceed the bounds of a single administration, but  
they will do so on the basis of bilateral contract, not general routing.

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Thu, 20 Sep 2007 14:34:59 +0200

On 19-sep-2007, at 22:51, Thomas Narten wrote:

> And owners of those services
> your business".

I used to work at a large ISP with exactly these kinds of sales  
people. They have a hard time taking "no" for an answer from the  
engineers, but when the engineers say "sure we can do it but it isn't  
going to work" and then, lo and behold, it doesn't work, they tend to  
catch on.

I.e., you can pay YOUR ISP to route your ULAs, but that doesn't mean  
the next ISP is going to accept those advertisements.

Obviously unbelievable amounts of money will make a difference here,  
but how does it make sense to go visit all the largest ISPs handing  
out money if you can get a PI or PA block much cheaper and easier?

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Thu, 20 Sep 2007 14:34:59 +0200

---

From: Keith Moore <[email-masked]>
Date: Thu, 20 Sep 2007 08:44:54 -0400

> the next ISP is going to accept those advertisements.
my experience is that users do get smarter over time.  it just takes a
long time.   the problem is that they're being conditioned to accept
that something will work by early behavior of ISPs, when it won't work
in the long term.

here's the deal: if you get a PA block, it will fail to work if you
change ISPs or if the ISP is forced to renumber.  if you get a PI block
or ULA block, it will fail to work when the ISPs routing complexity gets
too great and you can't afford to pay them to route your prefix
anymore.  so absent some kind of indirection between what hosts see and
what ISPs route on, neither arrangement is permanent and neither avoids
the need to renumber.

> out money if you can get a PI or PA block much cheaper and easier?
when push comes to shove, I'm not convinced that it will be cheaper to
get ISPs to route PI blocks than to route ULA blocks.  unless they're
somehow aggregatable.

Keith

---

From: Thomas Narten <[email-masked]>
Date: Thu, 20 Sep 2007 08:42:59 -0400

> wind up writing a contract with every ISP in the world that they care  

Paul Wilson and Geoff Huston wrote an article a while back entitled
"Competitive Addressing"
(http://www.potaroo.net/ispcol/2005-04/compete.html) that talked about
competion on policy resulting in policy dilution. While the thrust of
the proposal they were responding to was different, there are some
parallels. I.e., that when you get people entities on policy, and the
incentives favor "increase revenue" rather than "Good of the Internet"
the bottom line, lowest common denominator tends to win - even to the
detriment of common sense.

A key point here is that when it comes to sales and marketing, it's
problematic when your competitor says "we offer X," if you yourself
don't. Given the commodity nature of ISP service, it doesn't take long
before everyone is offering similar terms, even if there are
technically bad implications (they won't kick in until next quarter
anyway). There is often a rather large disconnect between what the
operators in the trenches think is a Good Idea and what the Sales &
Marketing side of an organization think is necessary to remain
profitable (or increase market share, etc.).

And please note, I'm channeling what I have heard, from both speakers
and from hallway chatter at RIR meetings, and this is from people that
have been around a long time and have been (or still are) in the
trenches operating networks, so to speak. So this is more than just a
theoretical concern.

The concern is that pretty soon, everyone will route ULAs because they
feel like they are at a competitive disadvantage if others are doing
so and they are not. And that would a huge mess.

And what if only _some_ of the ISPs routed them? We'd still have a
mess, because now we'd have a Balkanized Internet, where univeral
connectivity wasn't the norm anymore. 

> they will do so on the basis of bilateral contract, not general routing.

I've made that argument in the past too, but there are others who just
don't think it is that simple or will end there.

Thomas

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Thu, 20 Sep 2007 14:58:46 +0200

On 20-sep-2007, at 14:42, Thomas Narten wrote:

> technically bad implications

[...]

> so and they are not. And that would a huge mess.

The point you're missing is that one ISP can't provide global  
reachability for a prefix, you only get this if everyone cooperates.  
That just isn't going to happen unless someone with a huge amount of  
clout is going to force the issue. If Google wants to be reachable  
over ULA space then people may open up their filters. If it's IBM or  
Boeing, nobody is going to care.

And to people who can get PI or PA space, there is no point in  
forcing the issue, because even if they're successful in the end,  
it's going to be painful and expensive for them, too.

But even if it happens: who cares?

> connectivity wasn't the norm anymore.

That sounds like an apt description of the current IPv6 internet. It  
works well in Europe and Asia, but North America is a wasteland:

$ ftp ftp.ietf.org
Trying 2610:a0:c779:1a::9c9a:1095...
ftp: connect to address 2610:a0:c779:1a::9c9a:1095: Operation timed out
Trying 156.154.16.149...
Connected to ftp.ietf.org.

---

From: Thomas Narten <[email-masked]>
Date: Thu, 20 Sep 2007 08:58:03 -0400

> exactly what I envision.  I just don't see why it's such a horrible

Does "Balkanization of the Internet" mean anything to you?

> table entries, and they go to the highest bidders. "

With all due respect, what ivory tower are you living in?

I really think you need to go to an RIR meeting sometime and actually
_listen_ to what is said and have a _dialog_ with some of those
operators you have been so quick to dismiss in previous postings. You
might find that some of them are actually trying to keep the Internet
working and believe as much as you do in an open Internet for all...

They whole idea that we can have a market of routing slots and that
people will pay for routability is a nice idea, except that after 10+
years of talking about it, no one has even the remotest idea of how to
make it happen in practice.  Well, not unless we have a new world
order, ISPs (and the entire DFZ) become subject to significant
regulation where policies about routing slots can be set, etc. Is that
where you think we need to go? There are certainly parties that would
be thrilled to have the Internet move in that direction... But be careful
what you wish for...

Thomas

---

From: Keith Moore <[email-masked]>
Date: Thu, 20 Sep 2007 09:19:24 -0400

> Does "Balkanization of the Internet" mean anything to you?
Yes.  But that's in nobody's interest.   People will work to make their
sites reachable by as wide an audience as they think is interested, and
they'll use the best mechanisms they can find to do so. 

And I'm not convinced that "some" ULAs or PIs being routed through the
core will result in Balkanization of the Internet.
> With all due respect, what ivory tower are you living in?
We're all standing in the dark feeling different parts of an elephant,
trying to make sense of the whole thing by talking to one another.
> working and believe as much as you do in an open Internet for all...
Of course they are.  From their own points-of-view about what works
well.  The elephant analogy applies to them also.
> be thrilled to have the Internet move in that direction... But be careful
No, it's not where I think I need to go.  The point is only that sooner
or later there will be pushback associated with routing pain, and when
that pushback happens people will look to solve their problems in other
ways.  Of course, we would like to avoid getting into a dead end where
there's no good way to solve the problem from where we've ended up.

---

From: <[email-masked]>
Date: Thu, 20 Sep 2007 14:44:17 +0100

> Does "Balkanization of the Internet" mean anything to you?

Yes.
NAT, BGP route filtering, bogon lists, firewalls, Community
of Interest extranets such as SITA, Automotive Network Exchange,
RadianzNet. And let's not forget the IP VPN services that companies
like Verizon sell as a flagship product.

It is probable that there are more hosts today in the "Balkanized"
portions of the Internet than on the public portions.

--Michael Dillon

P.S.
Not to mention sites that are more than 30 hops away from each
other. I've seen traceroutes that go up to 27 hops so I imagine
that the hopcount diameter is once again becoming an issue
as it was prior to 1995.

---

From: Fred Baker <[email-masked]>
Date: Thu, 20 Sep 2007 07:47:19 -0700

On Sep 20, 2007, at 6:44 AM, <[email-masked]> wrote:

> that the hopcount diameter is once again becoming an issue as it  
> was prior to 1995.

That was in many respects a host problem - hosts initialized TTLS to  
32, and in so doing limited themselves to that diameter. I believe  
most hosts now set the magic number to 64. Do we believe that we are  
pushing that boundary?

---

From: David Conrad <[email-masked]>
Date: Thu, 20 Sep 2007 10:11:54 -0700

Keith,

On Sep 20, 2007, at 6:19 AM, Keith Moore wrote:
> The point is only that sooner
> ways.

Yes.  The solution chosen in the past has been to deploy route  
filters.  I'm not sure why this wouldn't be the solution in the  
future. Of course, the downside of route filters is that increasing  
portions of the Internet will be unreachable.  So it goes.

Regards,
-drc

---

From: David Conrad <[email-masked]>
Date: Thu, 20 Sep 2007 10:11:54 -0700

Keith,

Regards,
-drc

---

From: Keith Moore <[email-masked]>
Date: Thu, 20 Sep 2007 13:28:45 -0400

> portions of the Internet will be unreachable.  So it goes.
Either that, or there's some fallback route to a shorter prefix which
leads to a (replicated and possibly federated) service that knows how to
tunnel the traffic to the destination.  In other words, you can minimize
routing complexity and routing table size by making routes less optimal
and eating more bandwidth for the actual traffic.

Of course that forwarding service will cost money, and be subject to
failures of various kinds.  And it's hard to build such a service that
is federated according to the preferences of those holding PI or ULA
prefixes.   They can change ISPs, but their ability to have a stable
address prefix that is generally reachable is still going to be
dependent on some specific outside party that they can't change.   This
is true no matter what scheme is used for maintaining the mapping table
and what scheme is used for mapping between the stable prefix and the
current destination - whether it be BGP extensions, DNS or whatever.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 21 Sep 2007 10:13:18 -0700

Seems to me that what you are saying amounts to the statement that PI space cannot exist by definition. If there is address space that is routable on an Internet-wide basis it is by definition routable Internet space and no PI space.

If someone needs such space they need to obtain an IP address space allocation and persuade their ISPs to route it. The question of whether this is possible is a policy issue, not a technical issue. Whatever the policy status (people disagree as to what the situation is) it is clearly not going to be solved by a technical hack that does not address the underlying political constraints. 

> -----Original Message-----
> From: Fred Baker [mailto:[email-masked]] 
> Sent: Thursday, September 20, 2007 4:35 AM
> To: IETF-Discussion
> Subject: Re: ULA-C (Was: Re: IPv6 will never fly: ARIN 
> continues to kill it)
> 
> 
> > owners of those services will simply go to ISPs and say 
> "route this, 
> > or I'll find someone else who will".
> 
> I'm actually not as convinced of this. Yes, they can get 
> routing from their ISP, and the ISP will be happy to sell it 
> to them. Can they get it from their ISP's upstream, and from 
> that ISP's downstreams? To make it into PI space in the usual 
> sense of the word, I think they wind up writing a contract 
> with every ISP in the world that they care about.
> 
> I think ULAs will exceed the bounds of a single 
> administration, but they will do so on the basis of bilateral 
> contract, not general routing.
>

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 21 Sep 2007 10:13:18 -0700

---

From: Keith Moore <[email-masked]>
Date: Fri, 21 Sep 2007 16:54:01 -0400

> Seems to me that what you are saying amounts to the statement that PI space cannot exist by definition. If there is address space that is routable on an Internet-wide basis it is by definition rout…
There can be such a thing as PI space that is treated differently than
PA space.  But anyone who thinks that having a PI prefix means that his
prefix advertisements will be accepted in perpetuity by every IPv6
network is deluded.  Sooner or later, you're going to have to pay
_somebody_ to get that prefix routed.  And the amount may well increase
over time, perhaps drastically.  And if you don't keep making those
payments you're not going to be reachable anymore. 

So you can pay your ISP for PA space (along with connectivity) or you
can pay somebody else (maybe many somebodys) for PI space in everyone's
routing table.  In either case you should design your network to be able
to renumber in case you want to change who you're doing business with,
or are forced to change your prefix.

Keith