Re: [v6ops] ULA precedence [Thoughts about wider operational input]

[Mark Andrews <[e-mail]>]

> On 6 May 2022, at 09:56, Ed Horley <[e-mail]> wrote:
> 
> 
> On Thu, May 5, 2022 at 4:45 PM Fred Baker <[e-mail]> wrote:
> 
> 
> > On May 4, 2022, at 11:02 AM, Ed Horley <[e-mail]> wrote:
> > 
> > Just for clarification - when you say "same prefix" for ULA - are you assuming in the same /48? Or do you mean within all of ULA (fc00::/7 or the useable fd00::/8)?
> 
> You might look at section 3 of RFC 4193, and specifically at the global ID mentioned in section 3.2. I'm looking at the first 48 bits of the address and calling it a routing prefix. Let me put the question back to you: starting from RFC 4193, what other prefix would be under consideration, and why would it be under consideration?
> 
> Yes, I am familiar with section 3.2 - my question is because several on this mailing list in the past have said to ignore the stated pseudo-random requirement in that section and not to follow this section which states "Specifically, these prefixes are not designed to aggregate." Obviously, if you don't follow that then the question comes back to are we still assuming a /48? Or do we mean something different when we say "same prefix"? Is that defaulting to just the overall ULA prefix itself because people are designing networks starting at fd01::/32, fd02::/32, fd03::/32... fdff::/32, etc. which I completely understand is not how 4193 says to do it, but it is happening, so we need to be thinking about it perhaps? Just curious if anyone else is seeing this behavior with their customers at all?

You can still do pseudo random and have a contiguous block. Instead of /48 you select the prefix the same way using a random number to fill in the prefix bits but use /47, /46 etc. to get your contiguous block of /48 sites.  It still has similar collision resistant properties over the combined number of sites.  You can even start with a /48 and if you need a second site or exceed the capacity of the /48 with subnets then add the neighbouring site from the /47 if you are really worried about distributing multiple internal prefixes.  Repeat as you grow.  The automatic /48 will still help with keeping traffic local to the site.

As for people using fd01::/48 then fd02::/48 etc. well they are asking for trouble if addresses / packets leak or if there are merges.  The automatic entry would be for the /48 prefix.  If their router is doing site boundaries correctly then the fd01::/64 subnet is in a different site to the fd02::/64 subnet and communication between them should be blocked by default however this may not happen.  The router should however still see this configuration as having N connected /48 sites and if it is distributing routes they are for the /48 in use.  If the administrator adds a single covering prefix to the table manually or via a distribution mechanism then they loose the protection provided by the default table from leaked addresses.  Lets hope the router is sending administrative prohibited ICMPv6 message and that they are not be blocked.

Even using fd00:0000:0000:0000::/64 then fd00:0000:0000:0001::/64 etc, would be less problematic than fd01:: and fd02:: and just as easy to remember but still not a good idea.  

For the record whenever someone has suggested using those prefixes someone else says not too.  Just choose a random prefix.  Toss the coin 40 times (heads=1, tails=0).  It’s not quite as memorable but it avoids future problems.  If you do end up with a collision when merging companies you can alway choose new prefixes and re-number into them independently.

> -- 
> Ed Horley
> [e-mail] | [phone]
> Advancing Cloud, IoT, and Security with IPv6
> https://hexabuild.io
> And check out the IPv6 Buzz Podcast at https://packetpushers.net/series/ipv6-buzz/
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]              INTERNET: [e-mail]