IETF Logo Mail Archive

Re: [v6ops] Why enterprises aren't adopting IPv6 (Re: Implementation Status of PREF64)

Gert Doering <gert@space.net> Thu, 30 September 2021 17:42 UTC

Return-Path: <gert@space.net>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 089A13A0E29 for <v6ops@ietfa.amsl.com>; Thu, 30 Sep 2021 10:42:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=space.net
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gt2LAumLsAcH for <v6ops@ietfa.amsl.com>; Thu, 30 Sep 2021 10:42:06 -0700 (PDT)
Received: from gatekeeper1-relay.space.net (gatekeeper1-relay.space.net [IPv6:2001:608:3:85::38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3555A3A0E25 for <v6ops@ietf.org>; Thu, 30 Sep 2021 10:42:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=space.net; i=@space.net; q=dns/txt; s=esa; t=1633023727; x=1664559727; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=X1rCclm9xAOM+vvUf+uWBhpGKihoADgOfVh1i+MMDx0=; b=XWtxQVmWy+wEb4JBaRN0iedVflbVPgjuUZzVMIVuDPwaN+ajbUluliqG KIDMhmJpDKjhVB8qjck16jSVn9ErwkdRSMlN7h2cEgvMZk63g39iAfD9X gkuAz7QbnFnhIfeKzL+kMTSLrWTX9iLhwJ6hZV5SZsDGJCrfOXxPhBsqr XP2SiK0aWyGvG/DQtPG7uPM470R2SE32/RCr6fZHW/TDOzh7z1eud7uzc W9eGDo/wn+y1Wk87h7tms8wKgCWfxUh7GsIsUjfTm6dLu6ZXXy3fDd2zO Y/E5q8PU8GhP0/Fixwtiq5mbnbkQnru1IsTGLx1i+GsYEsYP2PrvZEprE w==;
X-SpaceNet-SBRS: None
Received: from mobil.space.net ([195.30.115.67]) by gatekeeper1-relay.space.net with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Sep 2021 19:42:04 +0200
X-Original-To: v6ops@ietf.org
Received: from mobil.space.net (localhost [IPv6:::1]) by mobil.space.net (Postfix) with ESMTP id 0F3E743D01 for <v6ops@ietf.org>; Thu, 30 Sep 2021 19:42:03 +0200 (CEST)
X-SpaceNet-Relay: true
X-SpaceNet-Relay: true
X-SpaceNet-Relay: true
X-SpaceNet-Relay: true
X-SpaceNet-Relay: true
X-SpaceNet-Relay: true
Received: from moebius4.space.net (moebius4.space.net [IPv6:2001:608:2:2::251]) by mobil.space.net (Postfix) with ESMTP id C28F94245E; Thu, 30 Sep 2021 19:42:02 +0200 (CEST)
Received: by moebius4.space.net (Postfix, from userid 1007) id B6B0011C3DB; Thu, 30 Sep 2021 19:42:02 +0200 (CEST)
Date: Thu, 30 Sep 2021 19:42:02 +0200
From: Gert Doering <gert@space.net>
To: otroan@employees.org
Cc: Gert Doering <gert@space.net>, Owen DeLong <owen=40delong.com@dmarc.ietf.org>, Lorenzo Colitti <lorenzo=40google.com@dmarc.ietf.org>, V6 Ops List <v6ops@ietf.org>, Jen Linkova <furry@google.com>
Message-ID: <YVX26sf+5SQUXxyk@Space.Net>
References: <CAKD1Yr2K3Gd3JD=NJFOoH6GYgs-8ACxRQB9-sKJ7cbF4_hxsow@mail.gmail.com> <0B533C71-5DB0-410D-A5A3-7E8FD559F214@delong.com> <CAKD1Yr3NoYfNT7+OVJoCCdgdif6AHHw29tNCPttS=-NuRZKv3w@mail.gmail.com> <DM6PR02MB692426B0EEDDC2C4D78D8EC0C3A89@DM6PR02MB6924.namprd02.prod.outlook.com> <CAKD1Yr25dtinLBeJpAuJ17NfLg7-ewM9QPvnXNuEJ8wiBQV9ig@mail.gmail.com> <CAO42Z2zqf=F6OTDK2e8cMYXdPgMZ=SgFJcn7BTKYGgcYsLT2iw@mail.gmail.com> <894BCFE9-0811-4AE6-9941-6183292E4431@delong.com> <7E8C5F52-596F-4CAB-89EB-B0D5BAF5F612@employees.org> <YVXvgS6GDX97sHOW@Space.Net> <4AF3C29B-4642-4173-A027-0AAAEE65C869@employees.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="M7mMy9O6zDOUGrBD"
Content-Disposition: inline
In-Reply-To: <4AF3C29B-4642-4173-A027-0AAAEE65C869@employees.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/v6ops/JERCth7nyrABoGhYnjT2_iYMgfA>
Subject: Re: [v6ops] Why enterprises aren't adopting IPv6 (Re: Implementation Status of PREF64)
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Sep 2021 17:42:12 -0000

Hi,

On Thu, Sep 30, 2021 at 07:21:54PM +0200, otroan@employees.org wrote:
> > [..]
> >> last time I tried going IPv6 only, that was completely unworkable.
> >> (while doing IPv4 only is perfectly fine.)
> > 
> > IPv6-only without a NAT64 gateway is not workable today.
> 
> Indeed. And if you depend on a NAT64 gateway your application has the same set of issues as if it was behind a NAT44.

That was actually a typo.  That was intended to read "is well workable today".

It works.  We've tested it on various networks.  Like, IETF wifi :-)

Some applications break, but thanks to the good work of Apple and others,
many more work nicely from an IPv6-only host today - through a NAT64 if the
other end is still IPv4-only.


> > IPv4-only is not workable either - if you need/want to access resources
> > that sit behind a DS-Lite ISP connection which has unhindered IPv6, and
> > CGNAT'ed IPv4...
> 
> The DS-lite part isn't relevant here, but yes, if there is an IPv6 only service, you can only reach that from the IPv4 only host if you go through a NAT46.
> Are you aware of any services like that today?

Most eyeball ISPs in DE do DS-Lite today.

So if I want "VPN to my home network" - located behind such an ISP - I
need to do VPN over v6.

So if I'm coming from a v4-only network (like a mobile hotspot somewhere),
I can't do what I want.

IPSEC coming from an DS-Lite network to an IPv4-only corporate VPN server
also breaks in interesting ways - sometimes it works, sometimes it only
works for a while, etc.


[..]
> The reality is unfortunately that NAT has benefits. Which would also be required in IPv6.

Of course.  NAT is a useful tool.

If I have a choice on whether I want to use NAT or not, it's beneficial.

If I am forced to use NAT due to address space constraints, it's an 
annoyance, and it makes networks more brittle than necessary (like: every
Kubernetes cluster uses the *same* RFC1918 /16 inside, and when you
report reachability problems, the first question support needs to ask
is something like "ok, so, yes, 10.2.7.27, but which instance of that?"...)

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                      Vorstand: Sebastian v. Bomhard, Michael Emmer
Joseph-Dollinger-Bogen 14        Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                 HRB: 136055 (AG Muenchen)
Tel: +49 (0)89/32356-444         USt-IdNr.: DE813185279

v2.23.0 | Report a Bug | By Email