Thanks Joe, great post re the /48's, I was just about to. We're working on this. -M< -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan@verisign.com

-----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Joe Abley Sent: Wednesday, October 27, 2004 4:02 PM To: Daniel Roesen Cc: nanog@merit.edu Subject: Re: IPv6 support for com/net zones on October 19, 2004

On 27 Oct 2004, at 15:43, Daniel Roesen wrote:

...

On Wed, Oct 27, 2004 at 03:21:44PM -0400, Joe Abley wrote:

...

Maybe Verisign needs more (reliable) v6 transit.

Something is broken in several colors here. I'm seeing AS_PATHs like 6830 6175 109 7018 26415 (Sprint, Cisco, AT&T, Verisign) but a traceroute is going straight from 6830 to AT&T and dying there with !P.

That you have no route for A is most probably a filtering issue somewhere... I'm seeing it being propagated by Sprint.

Since I mailed that, 3557 started receiving a covering /48 for A. Maybe there's some operational/maintenance-induced stability issues for those paths.

We've had reports before of F's covering /48 (2001:500::/48) being filtered by some people, based on the conviction that /48s were always bad and should never be accepted by anybody. It's possible that this is biting Verisign, too.

For the record, ARIN assign critical-infrastructure /48s which it is important to accept:

http://www.arin.net/registration/ipv6/micro_alloc.html

Gert Döring maintains an excellent summary of current good practice for v6 filtering (including cisco and JUNOS configuration examples, and filters of various degrees of strictness) here:

http://www.space.net/~gert/RIPE/ipv6-filters.html

Operators who are currently blocking any prefix covered by 2001::/16 which is longer than 32 bits are encouraged to review that page, and fix their routers.

Joe