Re: [v6ops] Possible issue with source address selection for ULAs...

[Ted Lemon <[e-mail]>]

My comment was specifically in response to the observation that we might
want to get e.g. ICMP Packet Too Big messages back, and if the ULA gets
dropped on the way back, or gets routed incorrectly because of the source
address selection issue I raised at the beginning of this long
conversation, then PMTU discovery would fail. I don't know that that's a
huge problem, but that's what I was responding to. Possibly my response
could have used a bit more context.

On Tue, Jan 4, 2022 at 12:55 PM Fred Baker <[e-mail]> wrote:

>
>
> > On Dec 22, 2021, at 6:36 AM, [e-mail] wrote:
> >
> > Ted,
> >
> >> If you want your IPv6 transit network to work, do not number the
> interfaces of the routers with ULAs. As you say, lots of things will break
> if you violate this rule.
> >
> > This is how myths spread. Please stop.
>
> A specific example would help. I would agree that blanket statements like
> this are generally not very helpful. What specifically breaks?
>
> > Routers use the weak host model.
> > Using link-locals only on an interface works just fine according to our
> RFCs.
>
> But these are Unique Local Addresses, which is to say "global addresses".
> The only real issue I see is that they are generally advertised within a
> domain, and not beyond; it's not like routers handle them differently than
> any other GUA. Thus, the only explanations that I come up with for Ted's
> comment have to do with firewalls or routing; I seriously doubt that anyone
> else is filtering ULAs or otherwise cares about them specifically.
>
> >> I don’t think we need to fix this—there isn’t a shortage of IPv6
> addresses. The reason to use a ULA is when you need one or more prefixes
> but don’t have a way to get them from an internet connection.
>
> Or if your organization wants to limit service use by policy. An example
> from your company would be services that are only available to employees.
> IT has a policy of naming such services as "wwwin-whatever", and then
> presumably adding them to a filter, either in the firewall or in the host
> itself. Giving such hosts a ULA address and associating the address with
> the name in DNS would prevent outside hosts from accessing, or ddos'ing,
> the service.
>
> > O.
> >
> > _______________________________________________
> > v6ops mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/v6ops
>
>