Date: Fri, 14 Jun 2002 07:45:01 -0700 (PDT)
From: Michael Thomas <[EMAIL PROTECTED]>
Message-ID: <[EMAIL PROTECTED]>
| Color me clueless, but why can't you give them a
| global prefix, but just not advertise their route
| past the administrative boundary you choose (eg,
| the lab)?
That is (essentially) exactly what we do (though for obscure reasons
we can't fix this using routing, and instead use packet filtering).
You seem to have misunderstood the point of my message (perhaps I
wasn't clear), but it was just to show that it isn't (not that it
is) the existence of site local addresses (private addresses) that
defeats end to end - it is the absence of global addresses, and/or
filtering.
| And of course, if you ever decide to change your
| policy (or part of your policy), you don't need to
| renumber with global prefixes (eg, you want to
| allow part of your lab to be global visible so
| they can show the world their new cold fusion
| results).
No no - I'd never do that. My philosphy is that *everything* gets a
global address, no matter what (disconnected sites that have no ISP to
provide them being the one exception). If a site wants, its nodes also
get site local addresses, as an additional address.
Access control is done based upon filtering (at routers, and at the
nodes themselves where possible) - packet filtering &/or route filtering.
Certainly not based upon address - the occasional suggestions that private
addressing provides any kind of security or control are just ludicrous.
What they provide is internal address stability. That's why I don't want
to lose them (unless something equivalent replaces them, or we achieve address
stability some other way).
kre
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page: http://playground.sun.com/ipng
FTP archive: ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [EMAIL PROTECTED]
--------------------------------------------------------------------
