Re: [v6ops] A common problem with SLAAC in "renumbering" scenarios

[Mark Smith <[e-mail]>]

On Fri, 22 Feb 2019 at 08:53, Manfredi (US), Albert E
<[e-mail]> wrote:
>
> From: Mark Smith <[e-mail]>
>
> > That's because applications that would be best performing, most robust and more secure with a peer-to-peer communications model are forced to adopt an absolute client-server model (where the server is a much more likely performance bottleneck, the server becomes a SPOF for all clients using it at the time, and the server is a natural interception point for a malicious server operator).
>
> Even if it's only the prefix that changes? I don’t get that. Peer to peer can be made to work there too.

"made to work" implies work arounds. The IP layer has a peer to peer
nature - any node should be able to directly send to any other node,
just by having the other node's address. If a device has to send it's
packets through a third party to reach the actual party it wishes to
communicate with, it isn't a peer of the latter party. It is now a
client of the middle relay party.

This isn't the place to rehash the NAT discussion (because IPv6 + NAT
doesn't provide any benefits over IPv4 + NAT, and that makes IPv6
pretty much pointless.)

Have a look at the following presentation on NAT from a few years ago,
where I think I did something different to other NAT presentations - I
compared NAT to what I describe as a network operator's "Network
Critical Success Factors". Any questions/comments, we can discuss
off-list.

"The Trouble with NAT (Or why I care about IPv6)"
https://www.ausnog.net/sites/default/files/ausnog-2016/presentations/1.2_Mark_Smith_AusNOG2016.pdf

(APNIC asked me to write up a few blog articles on it if you want a
longer read - https://blog.apnic.net/author/mark-smith/)


> I agree if you're talking about NAPT, though. Those basic NAT firewalls I alluded to previously support peer-peer quite nicely.
>

So I think there's commonly a big different between works and works
well. NAT may work, however compared to stateless IPv6 (and IPv4)
forwarding, it doesn't work anywhere as near as well.

Regards,
Mark.



> Bert