Re: [v6ops] comment on draft-liu-v6ops-ula-usage-analysis

Then we need more text because that is not clear enough.

Also, talking about DNS, another advise would be to to have reverse
delegations on internal DNS to avoid leaking queries.

.as

On Tue, Nov 5, 2013 at 4:25 PM, Brian E Carpenter <
brian.e.carpenter@gmail.com> wrote:

> On 06/11/2013 07:16, Arturo Servin wrote:
> > Blocking according to DNS content would be something like Deep Packet
> > Inspection, isn't it?
> >
> > Do we want to go there?
>
> No, but that's not what he means. He means split DNS, where
> the internal DNS server includes records that are not present
> in the external DNS server. That, like it or not, is standard
> practice today in many enterprise networks.
>
>    Brian
>
> >
> > /as
> >
> >
> > On Tue, Nov 5, 2013 at 3:50 PM, Jen Linkova <furry13@gmail.com> wrote:
> >
> >> Section 4.2. says that
> >> "
> >>
> >> So when using ULAs in a network, the administrators should clearly
> >>    set the scope of the ULAs and configure ACLs on relevant border
> >>    routers to block them out of the scope. And if internal DNS are
> >>    enabled, the administrators might also need to use internal-only DNS
> >>    names for ULAs.
> >> "
> >> I believe it should that that the administrator MUST configure egress
> >> ACLs on borders routers and MUST ensure that their DNS servers do not
> >> include ULAs in any responses to external clients.
> >>
> >>
> >>
> >>
> >> --
> >> SY, Jen Linkova aka Furry
> >> _______________________________________________
> >> v6ops mailing list
> >> v6ops@ietf.org
> >> https://www.ietf.org/mailman/listinfo/v6ops
> >>
> >
> >
> > ------------------------------------------------------------------------
> >
> > _______________________________________________
> > v6ops mailing list
> > v6ops@ietf.org
> > https://www.ietf.org/mailman/listinfo/v6ops
>