Re: [v6ops] Some stats on IPv6 fragments and EH filtering on the Internet

[Jared Mauch <[e-mail]>]

On Nov 5, 2013, at 10:21 AM, Brian E Carpenter <[e-mail]> wrote:

> On 06/11/2013 02:07, Nick Hilliard wrote:
>> On 05/11/2013 12:54, Ole Troan wrote:
>>> why don't you filter out packets on the edge destined to your router's addresses?
>>> instead of what's effectively breaking IPv6 service across the network.
>> 
>> you can use infrastructure acls if they are handled carefully and don't
>> depend on implicit "deny any any" (which has special handling for the
>> "platform ipv6 acl fragment hardware").  But in order to implement this you
>> need to protect every single link network connected to your PFC3s.  If your
>> addressing plan is designed with this in mind, it's feasible.  If you have
>> a very large network or if you've not handled your link address assignments
>> very carefully, it's often not practical because it means dynamically
>> maintaining huge access lists on every single device on the network.
> 
> I think Homer Simpson has a word for this situation.
> 
> We *really* aren't going to deprecate fragmentation because of one
> model of broken kit, are we?

I think the challenge here is that Cisco doesn't care to fix the problem
inherent in their software/hardware integration issue here.  There is no
structural correction of the defects in the software and nobody there takes
ownership to correct it.

I've sadly seen this play out time and time again without anyone fixing basic
infrastructure items that need correction.  They're unable to as it impacts
too many sub-platforms/internal consumers of the code that don't see the value
as it's not adding revenue.

Many of these headers (eg: hop-by-hop) are comparable to IPv4 features that
are ignored or dropped by firewalls and routers (Eg: source-route, ecn, etc).

Without an explicit standard that says things MUST be supported that we can
cite in RFP/RFI and broad coalition of purchasers it's difficult or impossible
to change things.  Places like Cisco are too big to steer and correct the
bad behavior.  I would love to be proven wrong, but years of experience tell
me it's not going to get better.

- Jared