Re: [v6ops] Are we competitive?

I would century that the vast majority that say they are tracking/logging
NAT tables today are lying. Tracking all temporary addresses from the
ipv6NetToMediaTable is more transparent, more scalable, and (comparatively)
blindingly easy. Yes your netdisco (or equivalent) table will be bigger;
it's still completely manageable(*). Reasserting the end-to-end principle
should be a major objective, not replicating legacy antipatterns.

There's plenty of room for those who want to do NAT66 etc; it should not be
the recommended best practice.

--ckg

(*) I recognize most shops don't have full logging of ipv6NetToMediaTable
etc, either, but that is generally more tractable and more important from a
security perspective IMO.

On Mon, Aug 15, 2022, 06:40 Gert Doering <gert@space.net> wrote:

> Hi,
>
> On Mon, Aug 15, 2022 at 10:37:39AM +0000, Vasilenko Eduard wrote:
> > Hence, temporary addresses are needed.
>
> Temporary addresses are mostly a no-go for enterprise environments.
>
> People do not want to pay for privacy *in* the enterprise network - that
> stuff gets in the way of auditing, reverse DNS and all, and just adds
> hassles.
>
> Gert Doering
>         -- NetMaster
> --
> have you enabled IPv6 on something today...?
>
> SpaceNet AG                      Vorstand: Sebastian v. Bomhard, Michael
> Emmer
> Joseph-Dollinger-Bogen 14        Aufsichtsratsvors.: A. Grundner-Culemann
> D-80807 Muenchen                 HRB: 136055 (AG Muenchen)
> Tel: +49 (0)89/32356-444         USt-IdNr.: DE813185279
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
>