Re: [v6ops] comment on draft-liu-v6ops-ula-usage-analysis

On Nov 5, 2013, at 10:16 AM, Arturo Servin <arturo.servin@gmail.com> wrote:

> 
> Blocking according to DNS content would be something like Deep Packet Inspection, isn't it?

implementing split horizons on your nameservers is a fairly straight-forward exercise that doesn’t involve middle-boxes looking at packets…

likewise separating internal authoritative zone resolution from external ones is well understood and widely deployed in ipv4, afterall I have practical applications for working forward and reverse for the RFC-1918 space in my datacenters. I have no need, nor is it benificial for me to expose those zones/servers to queries from the outside.

> 
> Do we want to go there?
> 
> /as
> 
> 
> On Tue, Nov 5, 2013 at 3:50 PM, Jen Linkova <furry13@gmail.com> wrote:
> Section 4.2. says that
> "
> 
> So when using ULAs in a network, the administrators should clearly
>    set the scope of the ULAs and configure ACLs on relevant border
>    routers to block them out of the scope. And if internal DNS are
>    enabled, the administrators might also need to use internal-only DNS
>    names for ULAs.
> "
> I believe it should that that the administrator MUST configure egress
> ACLs on borders routers and MUST ensure that their DNS servers do not
> include ULAs in any responses to external clients.
> 
> 
> 
> 
> --
> SY, Jen Linkova aka Furry
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
> 
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops

Re: [v6ops] comment on draft-liu-v6ops-ula-usage-analysis

Attachment: signature.asc