Re: [v6ops] ULA precedence [Thoughts about wider operational input]

Vasilenko Eduard <vasilenko.eduard@huawei.com> Mon, 25 April 2022 11:28 UTC

Return-Path: <vasilenko.eduard@huawei.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B60943A17A3; Mon, 25 Apr 2022 04:28:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.906
X-Spam-Level:
X-Spam-Status: No, score=-6.906 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s_g1TFGRr7va; Mon, 25 Apr 2022 04:28:21 -0700 (PDT)
Received: from frasgout.his.huawei.com (frasgout.his.huawei.com [185.176.79.56]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1B59D3A11D8; Mon, 25 Apr 2022 04:28:21 -0700 (PDT)
Received: from fraeml745-chm.china.huawei.com (unknown [172.18.147.201]) by frasgout.his.huawei.com (SkyGuard) with ESMTP id 4Kn2j13q9Vz67wrC; Mon, 25 Apr 2022 19:24:21 +0800 (CST)
Received: from mscpeml100002.china.huawei.com (7.188.26.75) by fraeml745-chm.china.huawei.com (10.206.15.226) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Mon, 25 Apr 2022 13:28:18 +0200
Received: from mscpeml500001.china.huawei.com (7.188.26.142) by mscpeml100002.china.huawei.com (7.188.26.75) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Mon, 25 Apr 2022 14:28:17 +0300
Received: from mscpeml500001.china.huawei.com ([7.188.26.142]) by mscpeml500001.china.huawei.com ([7.188.26.142]) with mapi id 15.01.2375.024; Mon, 25 Apr 2022 14:28:17 +0300
From: Vasilenko Eduard <vasilenko.eduard@huawei.com>
To: Philip Homburg <pch-v6ops-11@u-1.phicoh.com>, "v6ops@ietf.org" <v6ops@ietf.org>
CC: 6man list <ipv6@ietf.org>
Thread-Topic: [v6ops] ULA precedence [Thoughts about wider operational input]
Thread-Index: AQHYP7p8DxM4kB1RcEyXrx0Fjrd/n6zQoAkAgADaDHCAKqI+gIAEhpdRgAADCJCAAAS/UoAAAIQQ
Date: Mon, 25 Apr 2022 11:28:17 +0000
Message-ID: <30261c5a60594d39abea6887e3bbe95d@huawei.com>
References: <CAM5+tA8WvjvWirxqE6kQ9LQAG0NcpWyCLGVooB=G7gZ9ETb2zQ@mail.gmail.com> <20220424172743.GA218999@fg-networking.de> <CAKD1Yr1v0Tkh+pWD-ts=PL3gZf7Qj6OHW6Cuvj8iGcSSMibjew@mail.gmail.com> <0afe25f5-52b7-a438-0696-cf8b0a83c2dc@gmail.com> <m1niw9v-0000JkC@stereo.hq.phicoh.net> <81d1bfa5857d4558adaea9da2ef94bdc@huawei.com> <m1niwbi-0000JyC@stereo.hq.phicoh.net>
In-Reply-To: <m1niwbi-0000JyC@stereo.hq.phicoh.net>
Accept-Language: zh-CN, en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.81.198.161]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-CFilter-Loop: Reflected
Archived-At: <https://mailarchive.ietf.org/arch/msg/v6ops/XMmlknUAVeSr5rQyWlDXd66SS_8>
Subject: Re: [v6ops] ULA precedence [Thoughts about wider operational input]
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/v6ops/>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 25 Apr 2022 11:28:26 -0000

You imply that ULA+NPT only happens in networks that do not have GUA. A counter example would a be network that wants to use ULA+NPT for all outgoing traffic, but has GUAs on servers to receive requests.

EV: Yes, such use case is a problem for simple modification of ULA priority in RFC 6724.
Your case would probably happen not for "servers to receive requests" (because the server would need ULA+NPT resilience even more).
Your case is very probable for the migration from GUA to ULA+NPT when Carriers' redundancy has been attempted to implement.
As a work-around such site should be migrated overnight. But what if it is not 1 site?!?
In general, you are right.

I could propose more corner cases that need separate UNA space (Unicast NAT Address):
It could be 2 principally different ULAs - one for NPT and one inherited from the merged company (not leading to NPT engine).
How the host would distinguish which one ULA to use?

But how real are such corner cases? Where is the balance between the depth of IPv6 modification and the purity/robustness?
It is not 1992 year. I am not sure what is better.

PS: I still believe that the new address type would touch dozens of RFCs.
These are almost all RFCs where ULA has been mentioned.

Eduard
-----Original Message-----
From: pch-b28DE43C2@u-1.phicoh.com [mailto:pch-b28DE43C2@u-1.phicoh.com] On Behalf Of Philip Homburg
Sent: Monday, April 25, 2022 2:10 PM
To: v6ops@ietf.org
Cc: Vasilenko Eduard <vasilenko.eduard@huawei.com>; 6man list <ipv6@ietf.org>
Subject: Re: [v6ops] ULA precedence [Thoughts about wider operational input] 

In your letter dated Mon, 25 Apr 2022 11:00:20 +0000 you wrote:
>What you proposed (separate ULA prefix for NAT) is robust and solid but 
>very h eavy - it would need a big change for many RFCs (new address type).

Why would that change many RFCs? The introduction of ULA didn't touch many RFCs.

We would need an RFC that defines the new space and update the policy table (if it needs updating at all).

>Would you agree to the tradeoff: assume that GUA PIO is absent for 
>ULA+NPT cas e.
>Then I do not see a problem in the implementation: just ULA priority 
>about IPv
>4 (it is not mandatory to put it in priority above GUA) would be enough.
>This is the minimal change for RFC 6724 only.

This a good example of something that is not robust. And why we need a good description of use cases.

You imply that ULA+NPT only happens in networks that do not have GUA. A counter example would a be network that wants to use ULA+NPT for all outgoing traffic, but has GUAs on servers to receive requests.