Re: [v6ops] Why enterprises aren't adopting IPv6 (Re: Implementation Status of PREF64)

[Owen DeLong <[e-mail]>]

> On Sep 30, 2021, at 10:21 , [e-mail] wrote:
> 
> Gert,
> 
>>> typically they only use a 1/65535th of an IPv4 address ((one TCP port) although they share it at L7).
>>> it would certainly be possible to improve on that.
>> 
>> Is that our goal?
> 
> No, but our goal failed. So let's take stock.

I disagree. I think there is a subtle but important difference between “our goal failed” and “our goal hasn’t succeeded yet”.

While I agree we should take stock and consider alternatives to accelerate the deployment of IPv6, I do not
think that declaring failure and giving up on IPv6 transition is the right answer.

>> Make CGNAT44 solutions scale to amazeballs level, to avoid deploying IPv6?
> 
> The eyeball networks aren't depending on CGNAT44, they use public IPv4 addresses.

That’s only really true in North America and Europe and can’t be sustained much longer even there.

Much of Asia (especially India and China) are using varieties of CGN and NAT444, NAT4444, etc.

Much of Africa, despite their RIR still having a free pool is also deploying CGN rather than public
addresses, in part due to absurd policies that are based on the premise that protecting the free pool
somehow increases the viable longevity of IPv4 while actually hampering deployment progress in
general.

> My point was that the utilisation of those IPv4 addresses could be improved by orders of magnitude, simply by using more ports than just 443.

My point is that making it possible for consumers to use protocols beyond TCP, UDP, and ICMP
would be a good thing.


>>> last time I tried going IPv6 only, that was completely unworkable.
>>> (while doing IPv4 only is perfectly fine.)
>> 
>> IPv6-only without a NAT64 gateway is not workable today.
> 
> Indeed. And if you depend on a NAT64 gateway your application has the same set of issues as if it was behind a NAT44.

There are a couple of additional failure modes (e.g. Skype behind NAT44 has NAT traversal, last I looked, Skype
behind NAT64 was more of a complete failure).

>> IPv4-only is not workable either - if you need/want to access resources
>> that sit behind a DS-Lite ISP connection which has unhindered IPv6, and
>> CGNAT'ed IPv4...
> 
> The DS-lite part isn't relevant here, but yes, if there is an IPv6 only service, you can only reach that from the IPv4 only host if you go through a NAT46.
> Are you aware of any services like that today?

Yes, but not in the sense you are meaning:

(114) ~ % host jimtest.delong.com                                                                                                                                2021/09/30 10:35:06
jimtest.delong.com has IPv6 address 2620:0:930::dead:beef:cafe

No A record. Web server is alive on port 80 there.

>>> that's what we have been saying for 25 years.
>>> perhaps time to accept reality. ;-)
>> 
>> So what would that be?  "Sell more NAT boxes, give up on IPv6"?
>> 
>> There's certainly more money to be made, in helping panicking customers
>> sort out their NAT444 mess "we are losing millions every hour!"...
> 
> That's not my expertise, but my impression isn't that there is lot of money in selling more NAT boxes.
> Nor is anyone panicking either.

Well… yes and no. When CGN goes wrong, it often goes horribly wrong and there is a fair amount of
panic in those instances. Not to mention the call center costs and the cost in terms of customer good
will and trust, brand reputation, SLA credits, etc.

> The reality is unfortunately that NAT has benefits. Which would also be required in IPv6.

I remain unconvinced of this. Please explicate.

> And if significant deployments still would require NAT with IPv6... the gains over IPv4 are questionable.
> (For example the trend of Enterprises to tunnel their traffic to the cloud for "services". Marketing name: SASE.)

True, but I don’t accept the premise. You’re going to have to provide more than a simple allegation that
a) NAT has benefits
and
b) NAT would be the only way to achieve those benefits in IPv6

> End to end is certainly dead.

Why? Again, I remain unconvinced of this.

> So as much as I'd like the purety of the IPv6 architecture, we're not going to do networking like it's 1990 again any time soon.

Seems a lot of people would like it, so what, exactly, is preventing it?

Owen