Re: [v6ops] draIn ft-ietf-v6ops-design-choices WGLC

["Ackermann, Michael" <[e-mail]>]

Makes sense.   I can see where your BGP set up would be compelling.  

One of my questions was if the Link Local Pros and Cons would be different for End Hosts vs Middle Boxes.  
Your comments make me think that it may be good for End Hosts, but not so much Middle Boxes,  in particular large scale provider networks.  

You mention that you remove Link Locals wherever possible.    On what platforms is this possible without removing most of IPv6?    Does this cause issues with intrinsic functions such as NDP, etc.?  

Thanks. 

Mike   

-----Original Message-----
From: Nick Hilliard [mailto:[e-mail]] 
Sent: Thursday, April 09, 2015 11:32 AM
To: Ackermann, Michael; Mark ZZZ Smith; Philip Matthews; Fred Baker (fred)
Cc: v6ops list
Subject: Re: [v6ops] draIn ft-ietf-v6ops-design-choices WGLC

On 09/04/2015 15:41, Ackermann, Michael wrote:
> Documenting the pros and cons of using link locals as next hops, so 
> that informed decisions can be made (especially by those perhaps less
> knowledgeable on IPv6),  would be a great benefit.       My organization is
>  just starting to test this, so I would appreciate input on this from 
> those with more actual, practical experiences,  but  from what I have 
> seen so far,  the link local benies would include:
> 
> 1.       Omnipresence.
> 2.       Stability and unaffected by external events.   
> 3.       More Secure
>
> So pretty consistent with what you said.
> 
> What I do not know is what the drawbacks to using Link Locals for next hop
> might be?      

Large-scale provider networks would normally use a GUA as a next-hop for the bgp prefix and set it to be the address of the PE device which originated the prefix.  This allows prefix information to be carried in BGP with NH reachability handled by the IGP.  I.e. IGP is used purely for loopbacks and iBGP is used for everything else.  This avoids a large number of troublesome design and scaling problems on many networks.

As a service provider network operator, I would go some lengths to avoid using link-locals as NH addresses.  They provide no particular advantage that I'm interested in and have a bunch of serious disadvantages, of which the above is the main one.  The other main one is that they cause massive fail when it comes to debugging problems.

With regard to the features that you listed:

- link-local addresses are not omnipresent, even if they are a mandatory part of the protocol.  Personally, I prefer to disable them if there is an option to do so.  Obviously this does not work if you're running protocols which require them (e.g. ospf).

- "Stability and unaffected by external events".  The only stable address on a router is a loopback.  MAC addresses can change due to e.g. software upgrades.

- "more secure" is a statement of opinion which lacks context.  They're unreachable if you're off-link, and if there is a requirement to consider this as a security feature, infrastructure ACLs could equally be implemented to give GUA addressing an equivalent level of security.

Nick



The information contained in this communication is highly confidential and is intended solely for the use of the individual(s) to whom this communication is directed. If you are not the intended recipient, you are hereby notified that any viewing, copying, disclosure or distribution of this information is prohibited. Please notify the sender, by electronic mail or telephone, of any unintended receipt and delete the original message without making any copies.
 
 Blue Cross Blue Shield of Michigan and Blue Care Network of Michigan are nonprofit corporations and independent licensees of the Blue Cross and Blue Shield Association.