Re: [v6ops] I-D Action: draft-ietf-v6ops-ula-usage-recommendations-02.txt

Hi Eric,

Thanks for your comments to draft itself. Please see replies below.

> -----Original Message-----
> From: v6ops [mailto:v6ops-bounces@ietf.org] On Behalf Of Eric Vyncke
> (evyncke)
> Sent: Thursday, February 20, 2014 11:42 PM
> To: Jan-Frode Myklebust; Brian E Carpenter
> Cc: V6 Ops List
> Subject: Re: [v6ops] I-D Action:
> draft-ietf-v6ops-ula-usage-recommendations-02.txt
> 
> To come back to the draft itself...
> 
> Section 2.2 'globally unique', should stress that the randomization process
> MUST be followed to the letter. Also, as discussed in the list, the 40 bits of
> entropy are for a single /48, if hundreds of /48 need to be generated, this
> will reduce the entropy to 30 bits or so... (which is still 8 billions though).

[Bing] Yes, this is a good argument. Will do in the next version. Thanks.

> Section 4.2 'limited scope', as a security person, I would really love to read it
> clearly articulated that ULA does not provide isolation per se...
> Bi-directional ACL are required + route map to avoid polluting your BGP
> neighbors. 

[Bing] This could be a good point to add in the security considerations. Thanks.

Best regards,
Bing

> Jan-Frode, I am sure that you know that strict policy routing
> (without anti-spoofing or ACL) will not prevent packets from you DC to leak
> to the Internet (to the NSA or any other 'interested' party ;-))

> -éric
> 
> On 17/02/14 12:00, "Jan-Frode Myklebust" <janfrode@tanso.net> wrote:
> 
> >On Mon, Feb 17, 2014 at 08:16:00AM +1300, Brian E Carpenter wrote:
> >> >>> Le 15/02/2014 19:16, Owen DeLong a écrit :
> >> >>>> Indeed, the situations where ULA usage is detrimental vastly
> >> >>>> outnumbers those where it is actually beneficial.
> >>
> >> That's an opinion, but it isn't an argument for abolishing ULAs. It's
> >> actually an argument for improving this draft so that it describes
> >> the cases in which ULAs are beneficial.
> >
> >> Could we have a detailed conversation about whether those cases are
> >> correctly described in the draft?
> >
> >Yes please.
> >
> >My use case is that we have a set of datacenter internal
> >services/servers that should *never* be routed out. When not using ULA
> >we've had a couple of incidents where the routes did leak out and
> >servers that shouldn't have been available on the Internet was. So
> >we've decided to use ULA for the same set of servers as we previously
> >used rfc1918-adresses for. No NAT involved. No servers should reach
> >Internet directly. Yes we could achieve the same by putting proper ACLs
> >in place on the borders, but since we've failed to do that in the past,
> >the belt and suspenders approach is attractive.
> >
> >Is this a "valid" ULA usage?
> >
> >
> >  -jf
> >
> >_______________________________________________
> >v6ops mailing list
> >v6ops@ietf.org
> >https://www.ietf.org/mailman/listinfo/v6ops
> 
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops