Hi, On Fri, Apr 18, 2014 at 04:57:57PM +1000, Matt Palmer wrote:
On Thu, Apr 17, 2014 at 09:05:17PM -0500, Timothy Morizot wrote:
On Apr 17, 2014 7:52 PM, "Matthew Kaufman" <matthew@matthew.at> wrote:
While you're at it, the document can explain to admins who have been burned, often more than once, by the pain of re-numbering internal services at static addresses how IPv6 without NAT will magically solve this problem.
If you're worried about that issue, either get your own end user assignment(s) from ARIN or use ULA internally and employ NAT-PT (prefix translation) at the perimeter. That's not even a hard question.
Why use NAT-PT in that instance? Since IPv6 interfaces are happy running with multiple addresses, the machines can have their publically-accessable address and also their ULA address, with internal services binding to (and referring to, via DNS, et al) the ULA address
there's two problems with that approach: a) what is "an internal service"? In a world of complex data center environments running/offering all types of services to various parties ($ORG's employees, business partners, customers and closed groups from customers, "public"/Internet) you can't make that distinction any longer. And even if you could, latest trying to reflect that distinction in your DNS setup will screw you. At the end of the day you'll still end up in "address selection hell". b) from my operational experience address selection is still a "hugely unresolved problem", despite RFC 3484 and RFC 6724. As long as this (problem) persists, from our perspective there's a simple recommendation/solution: "when there's a [continued] decision problem, just don't offer a choice". Read, in IPv6 context: "go with GUAs only and only one per interface". best Enno -- Enno Rey ERNW GmbH - Carl-Bosch-Str. 4 - 69115 Heidelberg - www.ernw.de Tel. +49 6221 480390 - Fax 6221 419008 - Cell +49 173 6745902 Handelsregister Mannheim: HRB 337135 Geschaeftsfuehrer: Enno Rey ======================================================= Blog: www.insinuator.net || Conference: www.troopers.de Twitter: @Enno_Insinuator =======================================================