IPv6 day and tunnels

Mon Jun 4 22:27:24 UTC 2012

Jeroen Massar wrote:

> If people want to use a tunnel for the purpose of a VPN, then they will,
> be that IPv4 or IPv6 or both inside that tunnel.
>

> Instead of having a custom VPN protocol one can do IPSEC properly now as
> there is no NAT that one has to get around. Microsoft's Direct Access
> does this btw and is an excellent example of doing it correctly.

Microsoft has had this capability since win2k. I didnt see any 
enterprises use it, even those who used their globally unique and routed 
ipv4 /16 internally. NAT was not why they did not use it.

They did not use it externally, they did not use it internally.

In fact, most of them were involved in projects to switch to NAT internally.

Enterprises also happen not to be thrilled with the absence of NAT in IPv6.

Dont expect huge uptake there.

> No why should it? But note that "IPv6 tunnels" (not VPNs) are a
> transition technique from IPv4 to IPv6 and thus should not remain around
> forever, the transition will end somewhere, sometime, likely far away in
> the future with the speed that IPv6 is being deployed ;)

So VPN is the _only_ acceptable use of sub 1500 encapsulation?

>> Today, most people cant even get IPv6 without tunnels.
>
> In time that will change, that is simply transitional.

If turning it on with a tunnel breaks things, it wont make native 
transition happen sooner.

>
> 1280 is the minimum IPv6 MTU. If people allow pMTU to work, aka accept
> and process ICMPv6 Packet-Too-Big messages everything will just work.

If things break with higher mtu's then 1280 but less then 1500, there 
really is no reason at all not to use 1280, the efficiency difference is 
trivial. And on the IPv4 internet, we generally cannot control what most 
of the rest of the people on it do. Looks like we are not going to be 
doing any better on the IPv6 internet.

>
> This whole thread is about people who cannot be bothered to know what
> they are filtering and that they might just randomly block PtB as they
> are doing with IPv4 today. Yes, in that case their network breaks if the
> packets are suddenly larger than a link somewhere else, that is the same
> as in IPv4 ;)
>
> Greets,
>   Jeroen
>

This whole thread is all about how IPv6 has not improved any of the 
issues that are well known with IPv4 and in many cases makes them worse.

This whole thread is all about showcasing how IPv6 makes them worse, 
simply because it is designed with "this time they will do what we want" 
mentality.

Joe