[v6ops] Comments on ULA draft

[Lorenzo Colitti <[e-mail]>]

Repeating the comments at the mike:

   1. As clearly shown in the presentations slides, and as said by others,
   there will continue to be is substantial opposition to any document unless
   it says that ULA+NPTv6 deployments are NOT RECOMMENDED. The current text in
   section 4.3 is very far from making such a statement.
   2. The document needs to be clear that because ULAs MUST be generated
   randomly (per RFC 4193), they are not aggregatable. Thus, developing ULA
   firewall policies is very complex because there is no way to ensure that
   /48s with similar security policies have adjacent address space. Even if
   ULA is initially deployed in a network that has only two zones ("public"
   and "private") network growth or mergers with other networks will cause
   firewall policies to become complex and have lots of holes.
   3. The document should say that even though ULAs are typically not
   announced externally, any network that is adjacent to the ULA network can
   send and receive packets from ULA addresses unless there is a firewall rule
   that blocks such packets. For well-connected networks that have lots of
   peers, that can be a large attack surface.
   4. Due to #2 and #3, it may well be simpler to use global space and just
   add a firewall.


Regards,
Lorenzo