[v6ops] RFC7217 and flash renumbering and IID change

[Mikael Abrahamsson <[e-mail]>]

Hi,

just wanted to share my experience.

My home has a /56 PD from my ISP. For some (unknown to me) reason my home 
was flash renumbered little over 24 hours ago. I didn't notice, generally 
everything worked. What made me discover that this happened was when I 
tried to access something that had a static entry in my /etc/hosts file. 
This is understandable, and has happened to me before in my 10+ years of 
running IPv6 in my home.

I proceeded to change the first 64 bits of the address in /etc/hosts, and 
tried again. Still nothing. Investigated further, and then I discovered 
that the last 64 bits had changed as well.

This seems to be because ubuntu 20.04 machines (and others) are using 
RFC7217 to generate the last 64 bits, and reading RFC7217 in the light of 
this, it says to generate a unique IID when it "moves". Now, my machine 
certainly didn't "move" (for some definition of move), its NIC always had 
link, default gateway was the same etc, but RFC7217 says to generate 
unique IID per Prefix, so that's what it did.

There are HGWs where the firewall allows you to configure rules that take 
the PIO Prefix first 64 bits and then a static IID, so that if the Prefix 
changes, the firewall rule but not IID changes, it'll still be correct.

With the current behavior of IID change when PIO Prefix changes, above 
functionality doesn't work.

So I guess my question is, how do we want these things to work? What's the 
guidance we want to give? I'd like people to be able to configure their 
HGW with firewall rules that keep working across renumbering, so what 
should these firewall rules be based on?

If we augment RFC7217 and say that new IID should not be generated in a 
flash renumbering event (for instance, if default gw is the same, a new 
Prefix being announced, keep the IID) that would work.

Another way might be to suggest some more advanced logic for the HGW in 
handling these firewall rules, perhaps based on MAC address or something? 
However, I don't know how the HGW would figure out what addresses are 
which from temporary privacy addresses, stable RFC7217 etc.

Thoughts?

-- 
Mikael Abrahamsson    email: [e-mail]