Failover IPv6 with multiple PA prefixes (Was: IPv6 fc00::/7 - Unique local addresses)

Mon Nov 1 16:20:41 UTC 2010

On Nov 1, 2010, at 2:28 AM, Mark Smith wrote:

> On Sun, 31 Oct 2010 21:32:39 -0400
> Christopher Morrow <morrowc.lists at gmail.com> wrote:
> 
>> On Sun, Oct 31, 2010 at 3:10 PM, David Conrad <drc at virtualized.org> wrote:
>>> On Oct 31, 2010, at 6:45 AM, Christopher Morrow wrote:
>>>>>> "If Woody had gone straight to a ULA prefix, this would never have happened..."
>>>>> Or better yet, if Woody had gone straight to PI, he wouldn't have this problem, either.
>>>> ula really never should an option... except for a short lived lab, nothing permanent.
>>> 
>>> Seems to me the options are:
>>> 
>>> 1) PI, resulting in no renumbering costs, but RIR costs and routing table bloat
>>> 2) PA w/o ULA, resulting in full site renumbering cost, no routing table bloat
>>> 3) PA w/ ULA, resulting in externally visible-only renumbering cost, no routing table bloat
>>> 
>>> Folks appear to have voted with their feet that (2) isn't really viable -- they got that particular T-shirt with IPv4 and have been uniformly against getting the IPv6 version, at last as far as I can tell.
>>> 
>>> My impression (which may be wrong) is that with respect to (1), a) most folks can't justify a PI request to the RIR, b) most folks don't want to deal with the RIR administrative hassle, c) most ISPs would prefer to not have to replace their routers.
>>> 
>>> That would seem to leave (3).
>>> 
>>> Am I missing an option?
>> 
>> I don't think so, though I'd add 2 bits to your 1 and 3 options:
>> 1) we ought to make getting PI easy, easy enough that the other
>> options just don't make sense.
> 
> Surely your not saying "we ought to make getting PI easy, easy enough
> that the other options just don't make sense" so that all residential
> users get PI so that if their ISP disappears their network doesn't
> break?
> 
He may or may not be. I don't think it's such a bad idea.

> Recently we've seen somebody (on either nanog or ipv6-ops) proposing to
> set valid lifetimes of 24 hours on ISP GUA prefixes. While a 24 hour
> outage is unusual for a always connected broadband service, it isn't
> for intermittently connected nodes and networks.
> 
The upstream valid lifetime doesn't have a lot to do with what happens on
the internal network if you're smart.

> In effect people who suggest using PA GUAs or PI for all IPv6 addressing
> are saying you can't run IPv6 unless you have an available IPv6 ISP
> connection or you must be able to afford to be able to thrust upon the
> world occupation of a global route table slot. They're not realistic
> requirements for all potential users of IPv6. 
> 
No...PI does not require an available IPv6 ISP connection at all. This
is a misstatement that does not become any less false no matter how
many times you repeat it.

> For the most common and scalable case of PA, external addressing
> dependencies reduce reliability, because you can't control them.
> Completely relying on external connectivity and addressing for your
> internal networks reduces their reliability and availability.
> 
This is also false if you use any form of sanity in applying the assigned
PA prefix to your network.

> In this common case of PA, how are you going to justify that "no IPv6
> without an IPv6 ISP" view to people who are very remote, such that even
> intermittent Internet access is very occasional; to people who run IPv6
> sensor networks and don't ever want them connected to the Internet; or
> 3rd world countries where just local connectivity provides a very
> significant benefit, when global connectivity just isn't affordable?
> These and similar are cases where only ISP PA or PI aren't acceptable.
> 
Nobody is trying to. This is a fallacy of logic that you keep pushing,
but, it's still false. If I wire a PA prefix into my router, it doesn't go
away just because the ISP does. All that happens is that I can't
reach the internet from it, which is kind of true regardless of the
address space used at the point where your ISP goes away.

> Permanent connectivity to the global IPv6 Internet, while common,
> should not be essential to being able to run IPv6, and neither should
> PI. All you should need to run IPv6 reliably is stable internal
> addressing. Global connectivity should be optional, and possibly only
> occasional.
> 
Why shouldn't PI if it was easy to get? I still don't understand the
perceived advantage of ULA vs. PI other than the perception that
it is easier to get. If PI is just as easy to get, why is it a problem?

>> 2) ULA brings with it (as do any options that include multiple
>> addresses) host-stack complexity and address-selection issues... 'do I
>> use ULA here or GUA when talking to the remote host?'
>> 
> 
> There's an app for that (or rather a library routine called
> getaddrinfo() and an optional table it consults), and there's soon going
> to be a way to distribute it via DHCPv6 if the defaults don't suit -
> 
> http://tools.ietf.org/html/draft-fujisaki-dhc-addr-select-opt-09
> 
Sure, now, how many applications have been coded to actually
pay attention to what getaddrinfo is telling them about address
selection order?

Owen