Re: [Fwd: I-D Action: draft-carpenter-6man-why64-00.txt]

[Tim Chown <[e-mail]>]

On 10 Jan 2014, at 08:10, Ray Hunter <[e-mail]> wrote:

>> Lorenzo Colitti <mailto:[e-mail]>
>> 
>> Or - as Tim points out, SNMP scraping will do this securely for you today, and vendors are already building better and more scalable address registration notification features (syslog, etc.) into switches.
> Not everyone allows SNMP access from other management vendors in a multi vendor environment. Not everyone feeds syslog to other management vendors.
> Again, you are imposing an alien operations model. It imposes polling, It imposes inter-vendor cooperation and access to all remote devices via a management protocol.

Actually, no. It's a choice. We saw the choice of trying to lock down all address assignment for IPv6, or instead to accept that any device can pick any address and put measures in place to monitor/track which addresses are used where (should we need to trace something back).  We chose the latter approach.  If you want to take the lock-down path, that's your choice.

> Every time a switch on any one of 1000 sites changes, you're going to have to update your central poller. A central registration model avoids that overhead.

Well, yes, but there would be some provisioning for that device and you just need to make the polling configuration part of that.  It's usually as simple as an address to poll. In our case (as you guess :) most of our equipment is one vendor.

The SNMP polling approach has advantages too.  There's a lot of very useful information you glean from that, that can be very beneficial in aspects of network management other than address accountability.

We also make quite heavy use of 802.1X btw, but then many campuses do so today thanks to eduroam.

>> And if you're not doing this for the purpose of tracking, then why are you doing it? Is it just because it's what you do in IPv4? If so, then sorry, that's not a valid technical argument.
> At the risk of repeeating myself: helpdesk call correlation, problem correlation, log correlation, ability to track to /128 (for future filtering or tracking or resource protection of processes and devices within the network that rely on databases or caches keyed by IP address)
> 
> In IPv4, this protection happens automatically due to address scarcity, without doing anything else.
> 
> IPv6 /64 breaks address scarcity.

I think many sites will see there are also positive sides to this, and embrace it rather than trying to lock everything down.  But it's a choice.

Tim