Re: RA & DHCP problem...

2013-12-28 Thread Tarko Tikan
hey, Why? What problem are you solving by changing the current behavior? We propose to decouple DHCP from RA, view them as two different autoconfiguration protocols. Today you can't deploy DHCP without RA and this forces you to support/secure two protocols that mostly overlap. Personally

Re: RA & DHCP problem...

2013-12-29 Thread Tarko Tikan
hey, 4. there is no way for RAs to deploy different gateways to different hosts: all hosts on the network must be configured in the same way. +1 for this. We are currently using multiple default gw's (backed by multiple VRRP groups). This is something we can't port to ipv6 and it'll hurt as

Re: RA & DHCP problem...

2013-12-29 Thread Tarko Tikan
hey, If you use source-based/policy routing (linux ipv6 fib subtree feature) you could segment the subnet further and let the default gateway emit redirects if the subtree has a default gateway which is on-link for the clients. In case they don't react I guess this will pollute your network wit

Re: RA & DHCP problem...

2013-12-30 Thread Tarko Tikan
hey, In other words: create undefined behaviour that breaks in new and exciting ways for every operating system (version) around. No, it's not really different from having unexpired RAs around or manually adding two IPs to an interface. These situations already happen and operating systems d

Re: RA & DHCP problem...

2013-12-30 Thread Tarko Tikan
hey, Not necessarily. There are 24 port L3 switches to be had for around 500 EUR that do IPv6 wirespeed L3 routing just fine. You can even do protocol based vlans to do one vlan per customer for IPv6 and have an aggregate vlan for IPv4 traffic. Forcing network design on people as a workaround

Re: RA & DHCP problem...

2013-12-30 Thread Tarko Tikan
hey, IA_*PD* has nothing to do whatsoever with this whole discussion. Yes it does and you can't ignore that. You will use DHCPv6+IA_PD in broadband setup and because you already have DHCP, questions arise why not use it for default gw as well and keep it simple for everyone. IA_PD is one

Re: RA & DHCP problem...

2013-12-30 Thread Tarko Tikan
hey, IA_PD is a red herring, because it's fully independent from everything else, except that it happens to use the same mechanics as IA_NA - effectively it's different enough as far as handling in devices is concerned that it could be considered a protocol in it's own. Unfortunately it's not

Re: RA & DHCP problem...

2013-12-30 Thread Tarko Tikan
hey, Many host operating systems network stacks expect to have exactly one default route. (If you have more than one, which is the default?) This is not connected to the question of how many IP addresses they have configured on whichever many interfaces. This is the question "if I have conflicti

Re: RA & DHCP problem...

2013-12-30 Thread Tarko Tikan
hey, If you have RA from more than one source on the cable you are much more likely to identify that after none too long debugging if all your IP configuration is by RA. You'll just have bignum users calling the helpdesk to complain that The Internet Is Broken (tm) or that they can't work. >

Re: RA & DHCP problem...

2013-12-30 Thread Tarko Tikan
hey, That said: I'll document a specific issue we face in a large-ish enterprise-style (UK University) network, which I think RA-less IPv6 might alleviate/solve. I think it's excellent problem statement, .1x multiple supplicant mode is widely used in enterprise networks. Typical use-case is P

Re: Residential subscribers: numbered or unnumbered?

2014-03-25 Thread Tarko Tikan
hey, So for anyone who has deployed or is planning to deploy residential IPv6, I am curious to know which way you are going, and more importantly why you selected that approach? My interest is primarily in IPoE, but I don't mind hearing about PPPoE as well. Unnumbered WAN CPE will get /56

Re: Residential subscribers: numbered or unnumbered?

2014-03-26 Thread Tarko Tikan
hey, What were your reasons for selecting this option? - one prefix per customer, don't need to track separate wan and PD prefixes - hope that we can advertise default-route (pointing to virtual link-local address) with dhcpv6 in the future and can get rid of RA on the wan - certain scali

Re: Some very nice IPv6 growth as measured by Google

2014-11-03 Thread Tarko Tikan
hey, Estonia has a VERY impressive growth approaching 5%: https://www.vyncke.org/ipv6status/plotpenetration.php?country=ee I have been driving an IPv6 project in Elion (now called Estonian Telekom) for some time now and this is the result. One of the goals I set for myself was exactly such a

Re: Some very nice broken IPv6 networks at Google and Akamai

2014-11-08 Thread Tarko Tikan
hey, I'm afraid I don't see the supporting evidence here. From my point of view, Google and Akamai IPv6 both work just fine. Concur. Both work just fine from my POV and I don't see lower than usual IPv6 traffic levels. -- tarko

Estonian IPv6 deployment report

2014-12-22 Thread Tarko Tikan
hey, Some time ago, many people noticed rapid IPv6 deployment growth in Estonia (from 0% to 5% in 4 weeks). We at 3249/Elion/Estonian Telecom were behind this, other operators don't have any serious IPv6 deployments at the moment. We rolled out v6 to everyone (both business and residential cu

Re: Some very nice IPv6 growth as measured by Google

2014-12-22 Thread Tarko Tikan
hey, That would be awesome. For consumer broadband deployments, it would be nice to know what technologies you and others have gone with for subscriber management, e.g., DHCP vs. PPPoE, ND/RA vs. DHCP IA_NA, e.t.c. I promised to do it and I have done it while it's still 2014 :) Check the "Es

Re: CPE Residential IPv6 Security Poll

2016-09-19 Thread Tarko Tikan
hey, I guess none of the users know they are using IPv6 around 75-80% of the time internal, or 20-30% on their external traffic either:-) Indeed. I've been spreading knowledge about our deployment to our customers and most of them have been amazed that they had no idea :) But they have never

Re: IPv6 on VoLTE

2018-11-08 Thread Tarko Tikan
hey, This might be confusing VoLTE with VoWiFI. The latter will use IPSEC. Correct. What probably happened is that together with activating VoLTE, VoWIFI was also activated on the device. Makes sense as VoLTE users are typically moved to IMS environment. -- tarko

Re: IPv6 on VoLTE

2018-11-08 Thread Tarko Tikan
hey, IMS 3GPP specification requires SIP integrity and confidentiality. You may see IPsec/IPsec security association on the device when it is communicating and/or registered with P-CSCF (uses SIP protocol). Correct. While IPsec might be an option, all popular terminals support SIP-TLS. Our Vo