Re: [v6ops] Implementation Status of PREF64

[Lorenzo Colitti <[e-mail]>]

On Wed, Sep 29, 2021 at 1:01 AM STARK, BARBARA H <[e-mail]> wrote:

> I’m not aware of widely-deployed equipment that supports good RADIUS/RA
> integration for similar device configuration via RA.
>

ISTR building a network that did this circa 2011, but it was not enterprise
hardware, it was a Juniper BNG. It supported dynamic VLAN creation based on
first-sign-of-life (or maybe RS), and got prefix information from RADIUS:
Framed-IPv6-Prefix for the PIO in the RA, Delegated-IPv6-Prefix for
subsequent PD requests.


> <bhs> I mostly agree. Unfortunately, some governments are putting
> pressure on enterprises and government networks (which are just a type of
> enterprise network) to support IPv6. This is largely due to messaging
> coming from the IETF. Maybe IETF should produce a Best Practice
> recommendation that enterprise and government networks not support IPv6
> until all tools they need to properly secure an IPv6-enabled network are
> widely available as software updates to legacy equipment.
>

Do you actually think it's the equipment that's the issue here? Even if the
equipment isn't capable of logging neighbour table bindings via syslog
(which most vendors have for a while), scraping ND tables isn't that hard
to do. I think the issue is more around operational familiarity and the
idea that because we do things this way in IPv4 we must to do them the same
way in IPv6 as well.