Re: [v6ops] Vicious circle [ULA precedence [Thoughts about wider operational input]]

I don't think anyone is making the argument that we shouldn't bother engaging the regulatory communities to update the standards for IPv6 because it will take a decade to change the requirements. I fully support that endeavor and it should begin as soon as possible. In the intervening years, we need guidance on transition solutions and as Nick mentioned, a functional space that isn't ULA because ULA is broken. 

There is a clear and documented operational gap - it will be filled in one of two ways:

1) ULA cannot be fixed in any reasonable time frame - it will take years to update operating systems. The IETF can work towards allocating GUA space to solve the shortcomings of ULA and provide BCP on when and how this should be used.

2) If the IETF decides to punt and "wait it out", networks that have these requirements will, at best, find their own path to an IPv6 solution which will involve squatting on GUA space to bypass ULA issues. Or worse, they'll remain on IPv4 inside the data center indefinitely - which means we aren't updating applications, storage or systems for IPv6. 

And to reiterate, PCI-DSS is but one standard, we have banking, healthcare, manufacturing, energy and utilities to contend with - which isn't even an exhaustive list - they all have compliance frameworks with similar struggles. By working on transition strategies, the IETF has a chance to lower the barrier to entry for IPv6 with networks that have much tighter restrictions than those we build solely in the DFZ. 

The constraints these networks must work under are very real and legally binding regardless of whether we agree with the technical merits - the sooner this is acknowledged and we begin working on a solution, the better we'll be able to help compliant networks, systems and applications use IPv6.  :)

-----Original Message-----
From: v6ops <v6ops-bounces@ietf.org> On Behalf Of Simon
Sent: Thursday, April 28, 2022 4:14 AM
To: 6man list <ipv6@ietf.org>; v6ops list <v6ops@ietf.org>
Subject: Re: [v6ops] Vicious circle [ULA precedence [Thoughts about wider operational input]]

Nick Buraglio <buraglio@es.net> wrote:

> I also find it interesting that "keeping ipv4" is even a reasonable 
> choice to entertain. Clearly IPv6 is the long term path forward, and 
> it would behoove us to help with that simply from a protocol 
> simplification perspective. IPv4 isn't "working for them"
> it's the standard they are evaluated against

Translation (as previously mentioned):
The IPv6 community needs to engage with this other regulatory community to get them to bring their standard into the 21st century.

As long as the PCI standard effectively mandates IPv4 & NAPT then it’s going to be an uphill struggle.

On a much smaller scale I’ve been on the receiving end of this with a previous work hat on. Unknown to us in the IT dept, we would get various audits - insurers, finance auditors, parent company, blah, blah. Often the first we’d know about it would be manglement coming to us and saying “we need to do X because auditors” - no matter whether X is a sensible thing to do or not, or even if the technology we were using at the time supported it. Not running Windows servers would often confuse them !

Unfortunately, we were rarely brought in at the right stage so we could have that discussion where the auditor needs to tick a box, and we could explain “we do it this way, for these reasons - and that supports the objective you are trying to tick a box for”.

Arguing that trying to change the PCI requirements will take a decade, therefore we should bother, is simply kicking the problem down the road. The sooner “someone” starts that conversation, the sooner that 10 years will come round. Leave starting that conversation for another year means it’ll be 11 years, and so on.
As the proverb says "A journey of a thousand miles begins with a single step”.

And I guess the “someone” needs to be a person (or group) who have feet in both camps (IPv6 and PCI).

Simon

_______________________________________________
v6ops mailing list
v6ops@ietf.org
https://www.ietf.org/mailman/listinfo/v6ops