Re: [v6ops] Implementation Status of PREF64

[Fernando Gont <[e-mail]>]

On 30/9/21 02:53, Lorenzo Colitti wrote:
> On Wed, Sep 29, 2021 at 3:40 AM Gert Doering <[e-mail]
> <mailto:[e-mail]>> wrote:
>
>     As a matter of fact, I know of at least one deployment in a "fortune
>     500"
>     company that was seriously impaired due to lack of DHCPv6 support in
>     Android.  They want control over address assignment, tracking of address
>     assignments, and DHCP is the machinery they use for it (plus NAC, making
>     sure that only assigned IPv6 addresses can be used).
>
>     But they want to support Android devices.
>
>     So, still no IPv6 today...
>
>
> Is there any other way to break this logjam than to implement DHCPv6
> IA_NA and accept one IPv6 address per device? What about DHCPv6 PD or
> /64-per-host? What about resurrecting draft-ietf-dhc-addr-registration
> <https://datatracker.ietf.org/doc/draft-ietf-dhc-addr-registration/>, so
> the device can inform the network of addresses it has created?

Part of the problem here is the assumption that in all scenarios hosts
are and/or should be free to choose.

The reality is that, in a corporate network, "my network, my rules". --
that also applies to SLAAC -- just not gracefully -- since network
devices can limit the number of addresses per device.

SLAAC can be nice ("good" or "doable") for many scenarios. But there are
certainly others where the admin or security team wants to apply policy.
And SLAAC doesn't play nice there....

--
Fernando Gont
Director of Information Security
EdgeUno
PGP Fingerprint: DFBD 63E3 B248 AE79 C598 AF23 EBAE DA03 0644 1531




“This communication is the property of EdgeUno or one of its group companies and/or affiliates. This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and if you are not the intended recipient be aware that any non-explicitly authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, and will be considered a criminal offense. Please notify [e-mail] about the unintended receipt of this electronic message and delete it.”