Subject: Re: IPv6 will never fly: ARIN continues to kill it

From: [email-masked] (Noel Chiappa)
Date: Thu, 13 Sep 2007 13:39:53 -0400 (EDT)

{A few short comments rolled into one...}

    > From: Tony Li <[email-masked]>

    > As a practical matter, these things are quite doable.  

Tony, my sense is that the hard part is not places *within one's own
organization* where one's addresses are stored, but rather in *other
organizations*; e.g. entries in *their* firewalls. Can those with
experience confirm/deny this?

    > From: Jeff McAdams <[email-masked]>

    > the sentiments against PI space in IPv6 are very ISP-centric 

If the system routing (which is not, after all, the property of any one
organization) collapses, it's not just the ISP's who will suffer.

    > From: Marshall Eubanks <[email-masked]>

    > the routing tables do not care if you have PI or PA space, just
    > whether it is announced or not. If you are already announcing PA
    > space, and getting into the DFZ, it does not harm the tables if you
    > change to PI space.

Yes, but the whole point of PA space is that generally organizations using
them *don't* each have a separate entry in the DFZ; with PI space, *every*
organization *does*.

    > From: [email-masked] (Arnaud Ebalard)

    > let's just stop using the 3 letters word. It does not exist anymore.

Yes, those shelves upon shelves of 3-letter boxes at all my local
electronics stores don't exist. And all the millions of them deployed in
the network don't exist either. Speaking of "living in that dream
world".... :-)

	Noel

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: <[email-masked]>
Date: Fri, 14 Sep 2007 10:39:21 +0100

> organization* where one's addresses are stored, but rather in 
> *other organizations*; e.g. entries in *their* firewalls. Can 
> those with experience confirm/deny this?

In fact, in one of the global IPv4 networks that we operate, ACLs are
managed just as Tony describes. However, when we need to add/change
ACLs, it takes roughly 90 days to roll it out for two reasons. One is
that we cannot risk changing all routers at one time, so we spread the
work over two or more weekends. But the major piece of work is getting
the change in customer firewalls. This requires notification, planning
on their side, scheduling of their own change windows, etc. All of the
human effort involved in doing this has real costs.

At the same time, we and our customers will instantly make changes to
routing in our networks without any notification or planning or
scheduling of change windows. The difference is that routing is handled
by BGP (and OSPF) which everybody trusts to do the right thing. A lot of
smart people have put a lot of work into building routing protocols that
are reliable. The same amount of brainpower and work has not been
applied to ACL management in routers or firewalls. 

--Michael Dillon