Thomas, > Thomas Narten wrote: > What about globally unique?
This has three sides: 1. Will it appeal to the network administrators. 2. How easy can we make it for the user. 3. How many hurdles do we have to clear in order to get this going. Please allow me to develop this a little. 1. Will it appeal to the network administrators. ------------------------------------------------ > Well, there are no guarantees, but if there was a chunk > of address space reserved for "globally unique, but no > expectation that it will ever be routed on the public > internet", and it came out of a well known prefix, I'd > expect that enough ISPs would filter on them to keep > them from being usefully routable in a global sense. One of the arguments that has been used and possibly abused about this is that if it was true, we would never see 10.0.0.0/8 or 192.168.1.0/24 in the DFZ, and we do; which leads us to: > I don't follow what you mean by "ambiguous". It means everyone uses the same address, and this has a very thought property: it makes your chances of these addresses being routed properly routed over the Internet close to zero. Let's say, at a given time, 10 different sites leak 192.168.1.0 to the DFZ, including you. What are the chances of a hacker in a random location getting to "your" 192.168.1.0? Practically not much. Besides, hackers are not going to look for this. OTOH, if the private address is globally unique (not ambiguous) and it leaks to the DFZ, it immediately identifies that you screwed up your routing or have been hacked. To take the argument further, what I mentioned above is only the result of mis-configuration or hacking, and it is not the only concern, see below. > Well, there are no guarantees, but if there was a chunk > of address space reserved for "globally unique, but no > expectation that it will ever be routed on the public > internet", and it came out of a well known prefix, I'd > expect that enough ISPs would filter on them to keep > them from being usefully routable in a global sense. This can be doubted, especially in the lack of a multihoming solution. There have been ideas around about mechanisms such as embedding the ASN in the high bits of a site-local address to make it globally unique. This can of mechanism could be applied as well to this private block we are talking about. My recollection about this is that lots of people made the point that it would not take many end-sites that are lobbying for PI to pay their ISPs to leak these addresses in the defaultless table to get to a fait accompli that would have re-invented PI. Skipping the discussion about PI being bad, this would still leave us with addresses that had been intended originally to be not publicly routable but have become so, which does not fit the bill. 2. How easy can we make it for the user. ---------------------------------------- > Not immediately clear one can get uniqueness without some > sort of registration. But the registration might be fairly > painless. One has to be pragmatic and easy registration and/or low fee would not be show stoppers. At this point I do not have major concerns about this. 3. How many hurdles do we have to clear in order to get this going. ------------------------------------------------------------------- - As I mentioned before, there is a fine line between globally unique private addresses and PI, and this fine line is ISPs filtering them. Not accounting for misconfigurations, only a few end-sites paying ISPs to actively leak these as a replacement for PI might become uncontrollable and be percept as an unacceptable risk. - No matter what addressing scheme is being used, there is no way this would fit in a prefix longer than a /16, if this long. The consensual level required to get such a block allocated is high. This where I stand: With my network administrator hat on: - I do not buy the idea that a block of globally unique addresses would not be also globally routable. At least, not until I see the multihoming situation unwrap. - Even if I did, I would still prefer ambiguous addresses. - And why should I bother anyway because site-locals give me what I need today. With my IETF participant hat on: This sounds like good idea. That being said, it is going to be a long though battle no matter what, and given the fact that it is not as good as what site-locals provides to the network administrator, it is questionable if it would be worth the effort as adoption is largely unknown. Also, globally unique private addresses and ambiguous ones are not mutually incompatible, why not both? Michel. -------------------------------------------------------------------- IETF IPng Working Group Mailing List IPng Home Page: http://playground.sun.com/ipng FTP archive: ftp://playground.sun.com/pub/ipng Direct all administrative requests to [EMAIL PROTECTED] --------------------------------------------------------------------
