Re: [v6ops] Some stats on IPv6 fragments and EH filtering on the Internet

[Brian E Carpenter <[e-mail]>]

On 06/11/2013 02:07, Nick Hilliard wrote:
> On 05/11/2013 12:54, Ole Troan wrote:
>> why don't you filter out packets on the edge destined to your router's addresses?
>> instead of what's effectively breaking IPv6 service across the network.
> 
> you can use infrastructure acls if they are handled carefully and don't
> depend on implicit "deny any any" (which has special handling for the
> "platform ipv6 acl fragment hardware").  But in order to implement this you
> need to protect every single link network connected to your PFC3s.  If your
> addressing plan is designed with this in mind, it's feasible.  If you have
> a very large network or if you've not handled your link address assignments
> very carefully, it's often not practical because it means dynamically
> maintaining huge access lists on every single device on the network.

I think Homer Simpson has a word for this situation.

We *really* aren't going to deprecate fragmentation because of one
model of broken kit, are we?

   Brian