Re: [OPSEC] ULAs [was WGLC for draft-ietf-opsec-v6]

[james woodyatt <[e-mail]>]

On Apr 18, 2017, at 21:02, Brian E Carpenter <[e-mail]> wrote:
> 
> ULAs are intended for scenarios where IP addresses are not globally
> reachable, despite formally having global scope. They must not appear
> in the routing system outside the administrative domain where they
> are considered valid. Therefore, packets with ULA source and/or
> destination addresses MUST be filtered at the domain boundary.


I don’t think it's quite right yet. It’s greatly improved, but I have a quibble.

ULA are intended for scenarios where IP addresses are not *publicly* reachable. Nothing about them constrains their private routing or usage over any geographic area. They may appear as source or destination in packets in transit across any private routing system, including any system organized in a private multilateral agreement between domain administrators.

Therefore, packets with ULA source and/or destination addresses MUST be filtered at the public boundary of a routing domain, and SHOULD be filtered at private boundaries to limit their reachability according to local policy.

I would amend Brian’s proposed text for §2.1.2 Use of Unique Local Addresses like so:

>> Unique Local Addresses (ULA) [RFC4193] are intended for scenarios where IP addresses are not publicly reachable, despite their global address scope. They MUST NOT appear in the default-free routing domain of the public Internet, and gateways at the boundaries of private routing domains SHOULD NOT forward packets from or to ULA addresses where multilateral transit agreements do not explicitly recognize them.
>> 
>> Routing prefixes for ULA are /48 prefixes, and contain 40-bit pseudo-random global identifiers. which are generated according to [RFC4193]. They could be useful for infrastructure hiding as described in [RFC4864]. They could also be useful for communication between hosts in private routing domains, and private groups of autonomous routing systems organized by multilateral agreement. Hosts that require connectivity to the public Internet SHOULD communicate using publicly routed general-unicast (GUA) addresses. No form of address translation is required where ULA addresses for private connectivity are used in conjunction with GUA addresses for public connectivity.
>> 
>> The usage of ULA as described here could simplify the filtering rules needed at domain boundaries, by allowing a regime in which only hosts that require communication with the public are assigned general-unicast addresses (GUA). However, this does not remove the need for careful design of filtering rules at domain boundaries.


--james woodyatt <[e-mail] <mailto:[e-mail]>>