Re: [v6ops] About Req for Comments - "Transition to IPv6"

[JORDI PALET MARTINEZ <[e-mail]>]

Hi Scott,

I worked for the equivalent Spanish government network (SARA) in the IPv6 deployment, so I understand how restritive is it.

I think my responses to Owen also cover your points, to avoid repetition. I can agree that they probably knew about the "issues", but as said, I think is better the clearly say it "yes we know, we don't care, is up to you, if you want to offer services to us".

I just wrote them again, asking to read this discussion, in case they aren't already following it and considering including an explicit note about "yes, we know ... is your problem".



El 10/3/20 20:29, "v6ops en nombre de Morizot Timothy S" <[e-mail] en nombre de Timothy.S.Morizot=[e-mail]> escribió:

    
    JORDI PALET MARTINEZ wrote:
    >*** Then there is a problem. If they really want to have ALL the way thru only IPv6 in the LANs, the federal employees
    >will not be able to use *ANY* application that uses literal addresses (even a simple web page that is doing that).
    >Because there is NO transition mechanism that allows that. They are able to force all their internal apps to use only
    >IPv6, fine, but they have no control over the rest of the Internet. If they are thinking that NAT64+DNS64 resolves
    >that, they lost this “small” bit in their thinking. I’ve already reported them to the site that is asking for comments,
    >hopefully they really pay attention to the inputs.
    
    I'm intrigued that you believe that's inherently a problem. Perhaps you're not aware how restrictive
    US federal government networks often are? There are a great many things on the Internet I cannot
    access from my work computer, even for official work purposes. For example, I am the designated representative
    for my organization with ARIN. But during remote participation, I could not access jabber and
    cannot access slack from my work computer. I cannot access any conferencing platform from
    my work computer even for official, approved purposes. There are multiple levels of firewalls when
    I am connected to the enterprise network, all operating in default deny mode. My work computer
    presently has no direct access to any endpoint on the Internet. Every service allowed is proxied.
    And if things on the Internet do not work within our requirements, we don't use them.
    Now, removing even the perimeter service proxies to the public IPv4 Internet would fall
    into that last 20% that does not yet have a specifically mandated date. The emphasis,
    though, should likely be on *yet*. I know many of the people who contributed to
    the draft. I don't think they "lost" anything in their thinking.
     
    >*** I will be glad if they can send this memo to every small web site in the world,
    >because even if one of them is missing it, and need to be accessed by
    >the employees, will not work!
    
    It's published in the Federal Register. Those interested in advance warning about the
    steps the US government is planning to take on their own networks have it available.
    It will remain published by OMB when formally released. However, restricting access
    for federal employees is perfectly normal and occurs today for all sorts of
    reasons. Our networks do not operate under the premise that any system
    on our network must be able to access any arbitrary system, service,
    site, or application on the Internet. In fact, more the opposite applies.
    
    I believe Owen captured more the spirit and intent of this next step in
    the progression of the US federal government IPv6 transition. Despite
    the mandated dates, progress will almost certainly continue to be uneven across agencies.
    But the reporting requirements are something of a stick. Compliance with
    regulations and other requirements tends to be one of the drivers
    in government decision-making, especially since profit is not normally
    the factor it is in commercial decision-making.
    
    Scott
    
    _______________________________________________
    v6ops mailing list
    [e-mail]
    https://www.ietf.org/mailman/listinfo/v6ops
    



**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.theipv6company.com
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.