Re: [v6ops] SLAAC renum: Problem Statement & Operational workarounds

[Fernando Gont <[e-mail]>]

On 27/10/19 19:52, Ole Troan wrote:
>>>> Note that we could change SLAAC to allow the lifetime of a
>>>> prefix to be set to zero, instead of having to wait for 2
>>>> hours. That might be an improvement but requires careful
>>>> analsysis.
>>> 
>>> Can you explain how operating a public service should work on
>>> this type of network?
>> 
>> Could you be more specific what you consider a 'public service' and
>> what you expect to break?
> 
> The (only) value (sic) of IPv6 to end-users is retoration of end to
> end connectivity at the network layer.

That's know how IPv6 is being deployed in many places. It's quite common
that the CPE implements a Diode firewall. And what's worse, the CPE
doesn't have the appropriate support in UPnP for punching holes in it.



> I challenge you to find in the "real world" of end-users many with
> much trust in the ad-based "you are the product" centralised services
> in the current Internet.

Isn't that how/why Google, Facebook, and others make money?



> IPv6 was meant to allow end-users to run
> decentralized services.
> 
> - hidden primary DNS - mail - web - home-automation - video
> conferencing - jabber
> 
> All of those have great open source software. To use Owen's
> paragraph: "I don’t know of a single server which operates that way
> currently. Can you point to a working example?"
> 
> Assuming all the moving parts required were updated to support flash
> renumbering (I have little proof they even support graceful
> renumbering), if the end-user cannot trust the lifetimes in the
> delegated prefix, DNS with TTL=1s is presumably the only choice?

I'm not saying you don't raise a valid question. However, in the context
of this discussion there's a difference between being able to graceully
handle the scenario when it happens, vs planning for it to happen
deterministically.

(FWIW, I have a bunch of services running behind NATs, where the
addresses get rotated. Yes, I do use small lifetimes (< 1 minute).
That's not uncommon nowadays, anyway)




>> What I described is basically what happens on IPv4 when a CPE uses
>> NAT and gets a new IPv4 address from the ISP.
> 
> If making IPv6 no better than IPv4 + NAT, then stick with IPv4 +
> NAT. IPv4 NAT scales very well as it turns out.

IPv6 could allow you to host services in a better way.

(In my example above, I just *can't* leverage IPv6 because of the
firewall and CPEs with no UPnP support for IPv6)




>> Flash renumbering is far from ideal, but a reality on the current
>> internet. Any application that is suitable for home use is expected
>> to deal with that scenario.
> 
> We don't need IPv6 to maintain the status quo.

We need IPv6 to actually work. There are networks nowadays in which it
is breaking badly. IN some cases it's preventing deployment. In others,
users are falling back to IPv4.


> 
>> Note that with automatic DNS updates, you can probably run a mail
>> server (or your personal 'cloud') on such a link. But that is not a
>> common use case at the moment.
> 
> And don't get me wrong, I'm all for making IPv6 addressing / onlink
> behaviour more robust. But not justified in this way that can be seen
> to allow for practices that removes any benefit of IPv6 over
> IPv4/NAT.

The benefits are in global addressing. As noted abouve, there are many
scenarios where "global connectivity" is worse for IPv6. Not that I like
it (but that doesn't change facts).

P.S.: I reiterate that the home network/cpe case is only *one* of the
scenarios where this problem may be faced.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492