Re: [v6ops] ULA draft revision #2 Regarding isolated networks

[David Farmer <[e-mail]>]

On 5/28/14, 23:00 , Brian E Carpenter wrote:
> On 29/05/2014 15:44, Randy Bush wrote:
>>>> red herring.  global prefixes designed to be used in place of ula should
>>>> not be in the global routing table
>>> Indeed they shouldn't, but since everybody should be filtering ULAs
>>> (and most people will do so), ULAs won't propagate but routeable GUAs
>>> might.
>>
>> explain why the two probability distributions will differ
>
> Because I have considerable confidence that the majority of transit
> operators will know they need to filter fc00::/7, but the same cannot
> be said of arbitrary /48s from RIR space.

Here is some data supporting the idea that GUA used as ULA can and will 
be leaked, leaked a lot in some cases.

See slide 20 of the following presentation;
https://www.nanog.org/meetings/abstract?id=2289

And this is discussed in more detail in section 5.2 of the full research 
paper at;
http://www.merit.edu/research/pdf/2013/ipv6_darknet_paper_r6098.pdf

Yes, I'm sure ULA is leaked too.  However, it's a much safer assumption 
and operationally much easier to filter external ULA sourced traffic. 
Even if I'm exchanging ULA traffic with other parties, it would seem 
likely for me to know the ULA prefixes that matter to me.

Where as, if someone uses GUA as if it were ULA and it's leaked, it's 
extremely unlikely that I would know to filter it.  The only way I can 
even think of is for the other entity to publish ROAs sourced to AS0. 
However, I suspect the security guys would object to that, as I'm now 
leaking that traffic from that prefix might be interesting.  One of 
those dammed if you do, dammed if you don't kind of situations.

Those of you suggesting no one should use ULA and should get GUA and use 
it as if it's ULA need to write up some recommendations for how to do it 
safely.  It seems many people are following your recommendations but 
doing it badly.

Thanks

-- 
================================================
David Farmer               Email: [e-mail]
Office of Information Technology
University of Minnesota
2218 University Ave SE     Phone: [phone]
Minneapolis, MN 55414-3029  Cell: 1-612-812-9952
================================================