Use of unique local IPv6 addressing rfc4193
marka at isc.org
Thu Sep 8 22:26:56 UTC 2016
In message <CAEaZiRU+wgQ0GDzxcmtqKO=_SASAVsNX31Q_70Q+uDM1oeoHrQ at mail.gmail.com>, Pshem Kowalczyk writes:
> We're looking at rolling out IPv6 to our internal DC infrastructure. Those
> systems support only our internal network and in the IPv4 world they all
> live in 'private' space of 10.0.0.0/8. I was wondering if anyone uses the
> fc00::/7 space for these sort of things or do ppl use a bit of their public
> IPv6 allocation and manage the security for those ranges?
> I realise I'd have to use a proxy or NAT66 for the regular outbound
> connectivity (but we do it already for IPv4 anyway). The truth is that even
> if we do use something out of our public allocation we're likely to do the
> same thing (just to be sure that nothing spills out accidentally).
> So what do you do in this space?
> kind regards
If you have a NAT you can't prevent things spilling out. The ONLY
way to prevent things spilling out is to not connect the network
in any shape or form.
All NAT does is make it harder to run your network and increases
the cost of software development.
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: marka at isc.org
More information about the NANOG