Re: [v6ops] Implementation Status of PREF64

[David Farmer <[e-mail]>]

On Mon, Oct 11, 2021 at 12:09 PM Owen DeLong <owen=
[e-mail]> wrote:

>
>
> On Oct 11, 2021, at 09:37 , David Farmer <farmer=[e-mail]>
> wrote:
>
>
>
> On Mon, Oct 11, 2021 at 1:13 AM Lorenzo Colitti <lorenzo=
> [e-mail]> wrote:
>
>> On Mon, Oct 11, 2021 at 1:36 PM Owen DeLong <owen=
>> [e-mail]> wrote:
>>
>>> Suppose an OS developer ships a DHCPv6 implementation that requires N
>>> addresses and does not enable the IPv6 stack unless it receives all of
>>> them. How does that do anything to address statements such as, "my network,
>>> my rules" that have been made on this thread? Any operator that wants to
>>> assign only one address per device still cannot use such hosts on their
>>> network, and can still criticise the implementation for not doing what they
>>> want.
>>>
>>> At least it provides a possible way forward for networks that don’t want
>>> to assign addresses outside of IA_NA or IA_PD to provide addressing to
>>> android devices.
>>>
>>> Surely a single IA_NA + a routed IA_PD would meet your requirements,
>>> right?
>>>
>>
>> IA_PD, even by itself without IA_NA, has none of the concerns in this
>> thread. RFC 7934 explicitly recommends it, actually. Not sure if enterprise
>> network operators can or would want to deploy IA_PD though. Is that
>> something that we can nudge the industry towards?
>>
>
> I think this is a perfectly reasonable option for the general purpose use
> case, but I will note there is no clear guidance for the use case of IA_PD
> on Hosts, and even the guidance for the use of IA_PD with routers is
> somewhat fuzzy or at least incomplete, in my opinion. Nevertheless, this
> may or may not be reasonable for special or restricted purpose use cases,
> especially when compliance regimes are required, like PCI or NIST-800-171.
> I support IA_PA on hosts, but whether or not that is an acceptable
> replacement for IA_AN and/or IA_TA for all use cases is very much an open
> question, and not entirely a technical question for that matter.
>
>
> At the point where a host solicits and/or accepts IA_PD, it has
> effectively declared itself to be a router.
>
> Since most android devices have multiple interface and the ability to
> provide a “hotspot” capability, they are, in fact, routers.
>

Yes, that is technically correct, and I expect most enterprises don't, or
at least don't want to, view Android devices as routers. Also, I expect
extending the network or "tethering" is not acceptable behavior in a PCI
or NIST-800-171 compliance contexts. So, that is part of the challenge for
this approach. and why this may not be an acceptable replacement for IA_AN
and/or IA_TA.

Thanks
-- 
===============================================
David Farmer               Email:[e-mail]
Networking & Telecommunication Services
Office of Information Technology
University of Minnesota
2218 University Ave SE        Phone: [phone]
Minneapolis, MN 55414-3029   Cell: 612-812-9952
===============================================