[v6ops] Re: Dynamic addresses

[Daryll Swer <[e-mail]>]

Marco

What do you mean by RA prefix lifetime matching PD lease time = no problems?

If ISP-side, PD lease time = 24 hours, and RA prefix lifetime = 24 hours on
CE side, and the genius ISP does what it does best, and flips the prefixes
within <24 hours of elapsed time for the session, either due to scripting
on their systems that does PPPoE or DHCP disconnect per 6-12 hours (yes,
there are many ISPs doing this globally), or as we discussed on this
thread, power issues (varies wildly by environments and economies), the
hosts on the LAN side of the CE will still have old prefixes with original
24 hour pref. lifetime value.

> A router can also extend that to avoid connection interrupts.

What do you mean by this? I have seen high number of misconfigured IPv6 in
SP networks around the world. The vast majority of ISPs (in my experience
as a consultant, across APAC, South America, South Africa, North America
and certain parts of Europe) that DO “dynamic only” ia_pd, do not maintain
the prefix to the configured lease time (we will assume 24 hours for this
discussion), upon disconnect/reconnect (for ANY reason), a new prefix is
shoved onto the CE.

I've seen even stranger IPv6 configurations in the backbone networks
(unrelated to residential wireline) that just makes no sense, from obscure
IPv4-based subnetting to NAT66 because it's a “firewall”, as per some
genius ISPs out there. I have personally discussed this issue (IPv6
malpractices) even with network software vendors (who sells to ISPs) and
they tell me:
“The customer is always right. We've been doing network programming for
decades, but nope, the customer knows networking better than we do,
apparently. So NAT66 it is.”

There's even NIRs that encourages (I hope nobody from APAC comes at me for
saying this) outside nibble-bit boundary subnetting, I recommend this
<https://packetpushers.net/podcast/ipv6-buzz-129-ipv6-architecture-and-subnetting-with-daryll-swer/>
for a listen.

As I originally said, this (dynamic prefixes) also makes it virtually
impossible for the home-user to even host basic SSH to their devices on the
LAN or even the router itself.

I thought we are trying to restore the end-to-end/peer-to-peer principle
with IPv6, not further push down NAT66/NPTv6 to combat 24/7 renumbering of
the ISP with ULAs and the like. In IPv4, changing IP /32 addresses were
masked (literally) with masquerade.

And surely, I hope, nobody is suggesting the folks who authored BCOP-690
didn't do their homework. The BCOP clearly explains WHY dynamic prefixes ==
harmful:
https://www.ripe.net/publications/docs/ripe-690/#5-2--why-non-persistent-assignments-are-considered-harmful

Even if we ignore ALL the technical issues with dynamic prefixes, dynamic
prefixes only increases costs and complexity for law enforcement compliance
on the ISP-side anyway. In short, persistent/static ia_pd is a win-win for
both sides (ISP and CE owner).

> Using non-persistent prefixes also means that it is necessary to have a
> logging system that registers which WAN and LAN prefixes are being used at
> each moment by each customer site in order to comply with legal/regulatory
> requirements.
>

*--*
Best Regards
Daryll Swer
Website: daryllswer.com
<https://mailtrack.io/l/cab64acde34f80d638af32f078a9e082803bf040?url=https%3A%2F%2Fwww.daryllswer.com&u=2153471&signature=0f894b3511eb84b3>


On Tue, 13 Aug 2024 at 10:24, Marco Moock <[e-mail]> wrote:

> Am Tue, 13 Aug 2024 06:16:22 +0530
> schrieb Daryll Swer <[e-mail]>:
>
> > Even if you change the values to N, you still have broken
> > connectivity for N time. I am of the opinion, that no, SLAAC is
> > indeed working as specified, and there are no reasons to mess with
> > the values. What needs to be changed is: for ISPs to give the user
> > options for either A. Dynamic ia_pd at the user's discretion with the
> > downsides for SLAAC operational behaviour Or B. Static ia_pd that
> > does not change (unless drastic changes occurs upstream, which also
> > applies to v4 anyway).
>
> Can someone please explain why dynamic prefixes create a problem when
> used properly?
>
> DHCPv6 has a lease time and the RA prefix has a lifetime too. If that
> lifetime is not more than the lifetime of the DHCPv6 PD.
>
> A router can also extend that to avoid connection interrupts.
>
> By the RFC, a proper operation is possible. Some hard- and software and
> some ISPs break it.
>
> _______________________________________________
> v6ops mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>