Re: [v6ops] AWS ipv6-only features

["Pascal Thubert (pthubert)" <[e-mail]>]

Hello Eduard and all

There’s a neat technique that’s hinted in https://datatracker.ietf.org/doc/html/rfc4864#section-3.4 whereby:

- host in the ULA domain get their normal IPv6 addresses from the ULA space.
- MIPv6 home agents at the edge of the ULA domain expose global addresses to the world and place them on virtual links that serve as home links
- Nodes in the ULA space that need to talk outside of that space obtain a global address from the home agents and bind them using their ULA as MIPv6 CoA.
- When talking inside the ULA, Source Address selection picks a ULA as best match
- When talking to the outside, SSA picks a home address, and packets are tunneled back and forth to the HA, but only inside the domain.

The cool thing is that the outside view of the ULA domain is completely flat, would be  a single /64.
Nodes can also register to different HAs that pick their /64 from different ISPs to get multihoming. The HA can drop the tunnel when the ISP connectivity fails so the host uses only the other ISP.

Keep safe;

Pascal

Disclaimer: I believe I filed IPR on that method.

From: v6ops <[e-mail]> On Behalf Of Vasilenko Eduard
Sent: vendredi 26 novembre 2021 10:35
To: Mark Smith <[e-mail]>; Clark Gaylord <[e-mail]>
Cc: IPv6 Ops WG <[e-mail]>
Subject: Re: [v6ops] AWS ipv6-only features

It is a good attempt to push people for “U” in ULA.
Just it is not guaranteed without a Registry.
But the registry could not be for free.
Then ULA would become similar to GUA (except bloating Internet BGP table).
Deadlock.
Ed/
From: v6ops [mailto:[e-mail]] On Behalf Of Mark Smith
Sent: Thursday, November 25, 2021 11:54 PM
To: Clark Gaylord <[e-mail]<mailto:[e-mail]>>
Cc: IPv6 Ops WG <[e-mail]<mailto:[e-mail]>>
Subject: Re: [v6ops] AWS ipv6-only features


On Fri, 26 Nov 2021, 07:52 Clark Gaylord, <[e-mail]<mailto:[e-mail]>> wrote:
I'll summarize "getting IPv6 private addressing right" here:

Use global addressing.

There I fixed it for you :-)


Since I wrote that, no, that is a very wrong summary.


On Thu, Nov 25, 2021, 15:49 Mark Smith <[e-mail]<mailto:[e-mail]>> wrote:

On Fri, 26 Nov 2021, 07:41 Clark Gaylord, <[e-mail]<mailto:[e-mail]>> wrote:
Yeah AWS hold their cards close and don't seem to engage the community, but they do have decent IPv6 coverage across the services. Notwithstanding that the whole VPC concept has the whiff of ancient days about it; tonight we're gonna network like it's 1999!

EC2 as part of the address is a great idea. I am so stealing that (can't believe I haven't thought of it.)

It's a terrible idea. The "Unique" in ULA is on purpose.

Getting IPv6 private addressing right
https://blog.apnic.net/2020/05/20/getting-ipv6-private-addressing-right/



On Thu, Nov 25, 2021, 15:09 Mark Smith <[e-mail]<mailto:[e-mail]>> wrote:

On Thu, 25 Nov 2021, 23:51 Ca By, <[e-mail]<mailto:[e-mail]>> wrote:
Fyi, aws has gone beyond perfunctory ipv6 support and has released a series of enhancements, with a focus on ipv6-only scenarios, including nat64 / dns64

https://aws.amazon.com/about-aws/whats-new/2021/11/aws-nat64-dns64-communication-ipv6-ipv4-services/

AWS has lapped Google and Azure in advanced network features, which is really surprising given the early muscle Google developed at IPv6 launch and a stronger need to differentiate …

AWS failed to do ULAs properly. 'ec2' could be a random global ID, but unlikely when their service is "EC2".

Matters more here because they're exposing that to all of their tenants. I think GUAs would have been better for these internal all tenant services.

I've never seen AWS participate here in 20 years, unlike G and M.


_______________________________________________
v6ops mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/v6ops
_______________________________________________
v6ops mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/v6ops