Re: [v6ops] AWS ipv6-only features

[Nick Buraglio <[e-mail]>]

---
Nick Buraglio
Planning and Architecture
Energy Sciences Network
[phone]


On Mon, Nov 29, 2021 at 2:05 PM Owen DeLong <[e-mail]> wrote:

>
>
> On Nov 29, 2021, at 10:33 , Nick Buraglio <[e-mail]> wrote:
>
> Thank you for writing some information on ULA, it's an important part of
> IPv6 and not really discussed enough. Perhaps we should start another
> thread, but I'd like to hear more about when you see this behavior:
>
>
> We can agree to disagree on its importance.
>

It's important in that it is out there, used, and arguably poorly
understood by the general IT community. the more we know about the
real-world implications, the better. You'll get no argument from me
regarding it's overall importance/usefulness.


>
> *"ULAs are preferred over GUAs, so when a host is presented with both a
> ULA and GUA as possible ways to reach a destination, the host will select
> the ULA. Once the ULA destination address is chosen, the host will then
> choose its ULA as a source address to reach the ULA destination. This
> preference of ULA addressing over GUA addressing is the mechanism that
> provides internal network connectivity independence from concurrent
> external Internet connectivity."*
>
> In testing and in practice I have experienced that exactly the opposite of
> this is true in both day-to-day use and every single explicit test I have
> done where ULA and GUA are present on both sides with a variety of hardware
> platforms and operating systems. GUA is used in every scenario I test when
> the AAAA records are all matching (i.e. appropriately correct DNS). I'm
> happy to learn that I am incorrect, as it would make certain things easier,
> but nothing so far in my experience has shown the described behavior.
>
> The quote is from the RFCs, but implementors often do differently. It is
> not surprising that ULA is an absolute cock-up… I predicted as much when it
> was being discussed in the IETF. It’s one of the reasons I opposed ULA in
> general, but most especially the idea of ULA Coordinated.
>

What I am seeing (detailed a bit better in my next email response) is
pretty consistent.

>
> Seemingly relevant to the discussion at hand, and definitely relevant to
> enterprises and providers actively using or considering ULA.
>
>
> Yep… The moral of the story is that GUA works as intended and ULA is a bit
> of a mess.
>
> Owen
>
>
> nb
>
> On Thu, Nov 25, 2021 at 2:49 PM Mark Smith <[e-mail]> wrote:
>
>>
>>
>> On Fri, 26 Nov 2021, 07:41 Clark Gaylord, <[e-mail]> wrote:
>>
>>> Yeah AWS hold their cards close and don't seem to engage the community,
>>> but they do have decent IPv6 coverage across the services. Notwithstanding
>>> that the whole VPC concept has the whiff of ancient days about it; tonight
>>> we're gonna network like it's 1999!
>>>
>>> EC2 as part of the address is a great idea. I am so stealing that (can't
>>> believe I haven't thought of it.)
>>>
>>
>> It's a terrible idea. The "Unique" in ULA is on purpose.
>>
>> Getting IPv6 private addressing right
>> https://blog.apnic.net/2020/05/20/getting-ipv6-private-addressing-right/
>>
>>
>>>
>>> On Thu, Nov 25, 2021, 15:09 Mark Smith <[e-mail]> wrote:
>>>
>>>>
>>>>
>>>> On Thu, 25 Nov 2021, 23:51 Ca By, <[e-mail]> wrote:
>>>>
>>>>> Fyi, aws has gone beyond perfunctory ipv6 support and has released a
>>>>> series of enhancements, with a focus on ipv6-only scenarios, including
>>>>> nat64 / dns64
>>>>>
>>>>>
>>>>> https://aws.amazon.com/about-aws/whats-new/2021/11/aws-nat64-dns64-communication-ipv6-ipv4-services/
>>>>>
>>>>> AWS has lapped Google and Azure in advanced network features, which is
>>>>> really surprising given the early muscle Google developed at IPv6 launch
>>>>> and a stronger need to differentiate …
>>>>>
>>>>
>>>> AWS failed to do ULAs properly. 'ec2' could be a random global ID, but
>>>> unlikely when their service is "EC2".
>>>>
>>>> Matters more here because they're exposing that to all of their
>>>> tenants. I think GUAs would have been better for these internal all tenant
>>>> services.
>>>>
>>>> I've never seen AWS participate here in 20 years, unlike G and M.
>>>>
>>>>
>>>> _______________________________________________
>>>>> v6ops mailing list
>>>>> [e-mail]
>>>>> https://www.ietf.org/mailman/listinfo/v6ops
>>>>>
>>>> _______________________________________________
>>>> v6ops mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/v6ops
>>>>
>>> _______________________________________________
>> v6ops mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/v6ops
>>
> _______________________________________________
> v6ops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/v6ops
>
>
>