RE: A common problem with SLAAC in "renumbering" scenarios

["Manfredi (US), Albert E" <[e-mail]>]

-----Original Message-----
From: ipv6 <[e-mail]> On Behalf Of Sander Steffann

> - For stable address delegation the routing inside the ISP becomes a mess, especially when it can't be guaranteed that a customer consistently ends up at the same BNG.
>
> - To keep ISP networks scalable, prefixes are aggregated to (roughly) BNG level, making it impossible to keep prefix delegation stable at the customer's end
>
> With IPv4 this didn't cause massive problems because NAT disconnected the LAN addresses from the WAN side at the customer's end. With IPv6 this is no longer the case and it does cause problems.
>
> Stability at one end causes instability at the other end, and vice versa.
> And as can be seen from this discussion it's still an unsolved problem...

Right, but I would come back to my previous point. In the IID discussions, a lot of time was spent justifying why stable IIDs are not a good idea, and testing was done to see what breaks when IIDs are changed frequently. If changing the IID is doable, seems not to break many applications, and is touted as a meaningful security measure, then those same considerations should apply to the prefix. Yet, we're not seeing a push for varying prefixes, as we got for keeping IIDs unpredictable or even short-lived.

Instead, now there's a shift in thinking, where changing the IPv6 address is not so useful for security (which I too have been thinking all along).

We should be consistent. Just as stable IIDs, even EUI-64 based IIDs, should be permissible, when they make sense (such as in enterprise networks), we are no longer depending on them or suggesting to do this. They are a special case. Perhaps the same ought to apply to stable prefixes. Networks which want those can use whatever means they need, such as non-volatile memory in CPE devices. Otherwise, they should not be recommended and not be the norm? Just asking. Maybe this problem should go away.

Bert