IPv6 Loopback/Point-to-Point address allocation
Job Snijders
job at ntt.net
Sun Sep 10 10:08:59 UTC 2017
Hi,
On Sun, Sep 10, 2017 at 11:53:20AM +0200, Enno Rey wrote:
> On Sun, Sep 10, 2017 at 10:47:05AM +0100, Nick Hilliard wrote:
> > Baldur Norddahl wrote:
> > > Loopback interfaces should be configured as /128. How you allocate these do
> > > not matter.
> >
> > ..so long as there are interface ACLs on your network edge which block
> > direct IP access to these IP addresses.
>
> or, maybe even more efficient, assign all loopbacks from a dedicated
> netblock which you null-route on the edge/your border devices.
Null-routing may not be sufficient, if the edge/border router has a
route to that /128; the (forwardable) /128 entry will win from the
blackholed /64 FIB entry since it is more-specific. Applying an ingress
interface ACL to each and every external facing interface will probably
work best in the most common deployment scenarios.
For router-to-router linknets I recommend to configure a linknet that is
as small as possible and is supported by all sides: /127, /126, /120,
etc. Some vendors have put in effort to mitigate the problems related to
Neighbor Discovery Protocol cache exhaustion attacks, but the fact of
the matter is that on small subnets like a /127, /126 or /120 such
attacks simply are non-existent.
Kind regards,
Job
More information about the NANOG
mailing list