Re: [v6ops] ULA draft revision #2 Regarding isolated networks

[Sander Steffann <[e-mail]>]

Hi Ted,

Op 27 mei 2014, om 16:08 heeft Ted Lemon <[e-mail]> het volgende geschreven:

> On May 27, 2014, at 9:56 AM, Philip Homburg <[e-mail]> wrote:
>> If you are a large entrprise, just spend the 50 euro or so (RIPE service region) it
>> costs to get your own prefix.
> 
> Yes, but do we tell them to do that?   Do we tell them how to make it work?   Do we tell them how to make source address selection do the right thing?  ULAs have a nice feature that GUAs don't: your stack won't choose a ULA as a source when the destination is a GUA.   If they get a GUA from RIPE, they lose that feature.

I know one big enterprise that uses ULA for certain networks for exactly that reason. They have networks that are by security policy not allowed to have any direct layer-3 connection to the outside world. All such communication must go through layer-7 gateways/proxies. Using ULA for such high-security-zones makes the source address selection simpler for the devices on its border, like the proxy servers. All other networks use the RIPE-assigned /48.

Cheers,
Sander