Re: [v6ops] About Req for Comments - "Transition to IPv6"

[JORDI PALET MARTINEZ <[e-mail]>]

Hi Owen,

Using +++ below …

 

 

El 10/3/20 21:49, "v6ops en nombre de Owen DeLong" <[e-mail] en nombre de [e-mail]> escribió:

 

 



On Mar 10, 2020, at 11:25 , JORDI PALET MARTINEZ <jordi.palet=[e-mail]> wrote:

 

Hi Owen,

 

Responses below with ***.

 

El 10/3/20 19:03, "v6ops en nombre de Owen DeLong" <[e-mail] en nombre de [e-mail]> escribió:

 

 




On Mar 9, 2020, at 01:42 , JORDI PALET MARTINEZ <jordi.palet=[e-mail]> wrote:

 

Hi Clark,

 

El 8/3/20 12:38, "v6ops en nombre de Clark Gaylord" <[e-mail] en nombre de [e-mail]> escribió:

 

It seems to me the context of the OMB guidance is relevant to the question of "IPv6-only". The draft memo is reasonably good at this, but succinctly something like "agency internal networks use single-stack IPv6 with any 

 

[Jordi] I don’t think is so clear. Footnote 4 “IPv6-Only refers to network environments in which use of the IPv4 protocol has been eliminated” will be much clear if it says “IPv6-Only refers to network environments in which use of the *native* IPv4 protocol has been eliminated”.

 

I don’t believe that what you propose is the intent in the memo.

 

I believe they intend to eliminate the use of ALL IPv4, not just native IPv4 on government networks.

 

*** Then there is a problem. If they really want to have ALL the way thru only IPv6 in the LANs, the federal employees will not be able to use *ANY* application that uses literal addresses (even a simple web page that is doing that). Because there is NO transition mechanism that allows that. They are able to force all their internal apps to use only IPv6, fine, but they have no control over the rest of the Internet. If they are thinking that NAT64+DNS64 resolves that, they lost this “small” bit in their thinking. I’ve already reported them to the site that is asking for comments, hopefully they really pay attention to the inputs.

 

I don’t see that as a problem… I see that as a benefit.

 

I think that the US Federal government is one of the few organizations in a position to actually put the kind of pressure that will be necessary to effectuate this change.

 

So, personally, I don’t see it so much as “they lost this in their thinking” as in they are choosing to stop supporting certain “broken by design” ways of thinking.

 

I hope that they stick to their guns and do not soften their position.

 

+++ Somehow, I agree, is not a “problem”, depending on how you see it. As moving on to a real IPv6-only world, it is good. But we are interpreting the document as they really want that. They don’t say explicitly, so we don’t know. If they want that effect, I think it will be much better message to say “we know this will create this problem for people still using literal IPv4 addresses in web sites, but they should react if they want to work with us” or whatever.

 


If a Federal office decides to have its DC with IPv6-only, then IPv4-only users will not be able to access it. In that case the DC must use, for example SIIT-DC. That will mean that the DC (internally) is IPv6-only, but the DC-to-Internet is dual-stack, in order to be able to use SIIT-DC.

 

I believe that _IS_ the intent (no support for SIIT/NAT64/etc.).

 

Remember, this is referring to the INTERNAL networks of the federal government agencies… Not the public-facing networks.

 

Unless I misread the memo, the intent is to preserve dual-stack functionality on public-facing services, but ensure that there are no remaining IPv4 dependencies in providing those services over IPv6.

 

Furthermore, footnote 5, “Note that for public Internet services, maintaining viable IPv4 interfaces and transition mechanisms at the edge of service infrastructure may be necessary for additional time, but this does not preclude operating the backend infrastructure as IPv6-only.” Is precisely saying that.

 

Correct.

 


It may happen that some of the LANs in the Federal office itself, are dual-stack still. Otherwise, employees will not be able to use Internet resources that don’t work well with NAT64+DNS64, for example, web sites or apps that use literal IPv4-addresses and are out of the control of the Federal office. So, in this case they still need to use IPv4aaS.

 

That’s not the desired outcome in this process.

 

Indeed, my impression is that the government is, through this memo, intending to put suppliers and web sites on notice that if they do not have IPv6 accessibility they are likely to lose their government customers.

 

I see that as a good thing.

 

*** I will be glad if they can send this memo to every small web site in the world, because even if one of them is missing it, and need to be accessed by the employees, will not work!

 

I’m pretty sure that the employees that encounter difficulty will make it known to the web sites in question.

 

+++ Not sure, it may get ignored, as they ignore problems in their deployment. Last time I tried to fill in the ESTA for traveling to US, it was not working in some of the final steps. I did some debugging and realized that they were dual stack, but filtering PTB, so because the MTU at some point in the network, it never worked until I disabled IPv6 to complete the form and pay the fee. I tried to tell them. I recall there was even a thread about that in NANOG (talking from the top of my head, it may be in a different list). They never responded or resolved it. I’m not sure if now the problem is still there.

 

In reality, in terms of actual job-related usage, the federal government is unlikely to need access to every small web site in the world. As a general rule, every small web site in the world has no ability to support things at the scale of US Government usage.

 

+++ Sometimes this happens even in bigger sites … so yes and not.

 

If some employe can’t surf their favorite mom-and-pop cat video site while they are supposed to be working for their taxpayer supported salary, I won’t actually be upset.

 

+++  Fully agree!

 

So from my perspective, this memo puts government contractors on notice that their network-based systems providing services to the federal government damn well better fully support IPv6 in the next few years, or they’re going to experience an increasing level of disconnect followed by a very likely contract termination. I see this as a good thing.

 

+++  Fully agree! But some text could make it more clear, so nobody believes “they didn’t though about this issue” as I did.

 

Owen

 

_______________________________________________ v6ops mailing list [e-mail] https://www.ietf.org/mailman/listinfo/v6ops 



**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.theipv6company.com
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.