Re: [v6ops] ULA draft revision #2 Regarding isolated networks

[Brian E Carpenter <[e-mail]>]

On 28/05/2014 02:26, Sander Steffann wrote:
> Hi Ted,
> 
> Op 27 mei 2014, om 16:08 heeft Ted Lemon <[e-mail]> het volgende geschreven:
> 
>> On May 27, 2014, at 9:56 AM, Philip Homburg <[e-mail]> wrote:
>>> If you are a large entrprise, just spend the 50 euro or so (RIPE service region) it
>>> costs to get your own prefix.
>> Yes, but do we tell them to do that?   Do we tell them how to make it work?   Do we tell them how to make source address selection do the right thing?  ULAs have a nice feature that GUAs don't: your stack won't choose a ULA as a source when the destination is a GUA.   If they get a GUA from RIPE, they lose that feature.
> 
> I know one big enterprise that uses ULA for certain networks for exactly that reason. They have networks that are by security policy not allowed to have any direct layer-3 connection to the outside world. All such communication must go through layer-7 gateways/proxies. Using ULA for such high-security-zones makes the source address selection simpler for the devices on its border, like the proxy servers. All other networks use the RIPE-assigned /48.

Exactly. This was always one of the expected use cases for ULAs. Some
people think it's a bad idea, but some corporate security policies will
prefer this, and it isn't for the IETF ivory tower to tell them not to.

The nature of ULAs makes it easier to talk them out of NAT, though,
which is absolutely not the case for RFC 1918 addresses. (If we say
anything about NATs in this draft, it should be to say that since
ULAs are guaranteed* not to clash, and can co-exist with routeable
GUAs, NAT is always unnecessary.)

*i.e., guaranteed to very high probability if correctly generated.

    Brian