Re: [v6ops] Are we competitive?

[Fernando Gont <[e-mail]>]

Hi, Clark,

On 15/8/22 08:58, Clark Gaylord wrote:
> I would century that the vast majority that say they are 
> tracking/logging NAT tables today are lying.

Possibly.

Although that part applies when performing network activity correlation 
with external entities.

When it comes to internal communications, you only need the 
local/private/internal_real addresses.


> Tracking all temporary 
> addresses from the ipv6NetToMediaTable is more transparent, more 
> scalable, and (comparatively) blindingly easy. Yes your netdisco (or 
> equivalent) table will be bigger; it's still completely manageable(*). 
> Reasserting the end-to-end principle should be a major objective, not 
> replicating legacy antipatterns.

There's no such a thing as "e2e principle" in most modern networks.

And it is extremely unlikely (and probably even undesirable) that we go 
back there.

Again, I'm just the messenger here.



> There's plenty of room for those who want to do NAT66 etc; it should not 
> be the recommended best practice.

I don't think anybody has argued that. The argument has been, for the 
most part, that "whether you like it or not, there's a number of 
scenarios where people might want to do NAT66. The more we accept and 
try to understand the reasons, the closer we'll probably be to reality."



> (*) I recognize most shops don't have full logging 
> of ipv6NetToMediaTable etc, either, but that is generally more tractable 
> and more important from a security perspective IMO.

Please define "tractable".

 From a security standpoint, "well understood" is usually your friend. 
"Unfortunately", the more you can solve the problem "the ipv4 way", the 
more attractive the solution is, for obvious reasons.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: F242 FF0E A804 AF81 EB10 2F07 7CA1 321D 663B B494