Re: [v6ops] FYI: Microsoft's latest on CLAT

[Gert Doering <[e-mail]>]

Hi,

On Sat, Mar 09, 2024 at 04:12:36PM -0500, Gyan Mishra wrote:
> @Gert
> 
> AFAIK I thought dual stack was always the primary method to deploy IPv6 and
> that is where also Happy Eyeballs comes in to help in case of IPv6
> connectivity failures failover to IPv4.

HE is actually a good indicator why dual-stack is not the right answer -
if you need extra logic in the application layer because you never know
which of IPv4 or IPv6 might be broken today, there is something wrong
underneath.

If you only have single-stack - either one - you do not need HE (in the
way deployed today), because things either work, or get repaired.


>   With dual stack you have a single
> URL FQDN  with A / AAAA record instead of separate FQDNs instances for IPv4
> and IPv6.  Allows for simplicity as you migrate client and server apps to
> IPv6 and IPv4 only host community can still hit the same FQDN as IPv6 hosts
> community.
> 
> To me it seemed much more complicated to have separate FQDN instances for
> IPv4 and IPv6 applications.

"separate FQDN instances for IPv4 and IPv6" is not "not dual-stack", that's
just a very complicated way to do dual-stack.


The issue I have with dual-stack is that it needs double tending on all
layers (dual setup costs, dual monitoring to ensure that your web
application is properly behaving on v4 and v6, dual firewall rules, ...),
and it gains you... nothing, except a warm and fuzzy feeling "oh, my
DHCPv4 server broke, but I can still use IPv6, isn't that great?".


You seem to be looking at this only from the "content" side, where there
is no way to avoid dual-stack today, with too many clients still stuck on
IPv4 only.  I agree that this is a "MUST" today, but it's not a state we
want to end in.

I'm looking at dual-stack in the larger picture - operating system stacks,
application software, client networks, transport networks, server networks,
firewalls and loadbalancers (generic middleboxes), ... - doubling all the
maintenance and development effort can not be the correct way forward.

I'm still bumping into places where stuff just breaks with IPv6, because
vendors cannot be bothered(*).  After 25+ years.  Take away one of the stacks
very much ensures that the other one gets actually used and tested.


(*) most recent example: Fortigate firewalls with guest access portal
on a dual-stack wifi sgment.  Needs dual sign-in, once for v4, once for
v6...

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                      Vorstand: Sebastian v. Bomhard, Michael Emmer,
                                           Ingo Lalla, Karin Schuler
Joseph-Dollinger-Bogen 14        Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                 HRB: 136055 (AG Muenchen)
Tel: [phone]         USt-IdNr.: DE813185279