Re: [v6ops] Default IPv6 Local Only Addressing for Non-Internet Devices (Fwd: New Version Notification for draft-smith-v6ops-local-only-addressing-00.txt)

[Eliot Lear <[e-mail]>]

Hi,


> On 16 Oct 2019, at 11:19, Jen Linkova <[e-mail]> wrote:
> 
> On Wed, Oct 16, 2019 at 4:54 PM Fred Baker <[e-mail]> wrote:
>>> On Oct 15, 2019, at 1:11 AM, Jen Linkova <[e-mail]> wrote:
>>> 
>>> The draft says '...when it is clear to a device manufacturer that a
>>> device should be isolated from the Internet by default..'
>>> I'm not sure it's possible to know that.
>> 
>> It *is* possible for the device to prevent its packets from going elsewhere,
> 
> Sorry I should have clarified: I'm questioning the statement that it's
> possible (or should be done) to know at the time of manufacturing that
> this particular
> device should be isolated from the Internet.
> Let's say I'm buying a printer. Or an IoT device (a sensor). How can
> the manufacturer know if I'm going to install it at my mom's home
> network with just one subnet (the link-local address would be
> sufficient), at my place (with subnets, so GUAs are needed or at least
> ULAs - but I would mean I have to configure my routers) or at my
> office (so GUA are required for the device to work)?
> 
> Will I need to look for 'work with multiple network segments' sticker
> on a box before I buy a device (and shall I test it in the lab because
> vendors tend to be overly optimistic about their products feature
> set)?

Ted mentioned RFC 8520 and Manufacturer Usage Descriptions.  Here the manufacturer can tell you what it was designed to access.  That’s not to say that you have to grant that access, but that some functions may be lost if you don’t grant that access.

For a consumer device, this can mean different things:

Device won’t work at all (Echos, Hey Google)
Device will work perfectly without Internet access or any local access (most kitchen and home appliances)
The device will lose some functionality but otherwise operate (no firmware updates, maybe no notifications about malfunctions, status, etc).

Whether you want to grant access probably should not be made based on the IP address, but on the network access control function.

Eliot