Re: [v6ops] Please review the No IPv4 draft

[Lorenzo Colitti <[e-mail]>]

On Thu, Apr 17, 2014 at 11:04 AM, Ted Lemon <[e-mail]> wrote:

> Yes, but Lorenzo, if you followed the conversation, you might recall that
> this very issue came up, and the authors agree that it's an issue, and will
> be updating the draft to address the issue.   After they've addressed it
> according to what we talked about, a host that implements the proposal will
> no longer be affected by rogue RAs in the way that you describe.
>

Hard to tell since we're well past 200 messages at this point, but I think
the solutions to this scenario that are being proposed are "put a
legitimate IPv6 router to your network" (i.e., enable IPv6 on it) and
"enable IPv6 RA guard + DHCPv6 guard on your network or block ethertype
0x86dd". All of those will require hardware upgrades in some networks.

And, by the way, since rogue RAs are a problem regardless, they need to be
> mitigated regardless.
>

That's a great statement in theory. However, bear in mind that on a lot of
currently-installed equipment with no RA guard / DHCPv6 guard support, that
means "block ethertype 0x86dd in the switches". As you say, if you can't or
don't do this, you already have a problem today.

However, the impact (or should I say, the "enormity" :-)) of the problem is
different:

   - Today, the situation is "block ethertype 0x86dd in the switches, and
   if you don't or can't, your hosts won't be able to reach dual-stack
   websites unless they implement happy eyeballs". A nuisance, yes, but
   survivable, since most OSes implement happy eyeballs these days.
   - If this draft is published and implemented, that will turn into "block
   ethertype 0x86dd in the switches, and if you don't or can't, kiss your
   network goodbye".

It's not OK to blind-side network operators like this.

I repeat: FOO.