On Fri, 30 May 2003 bdragon@gweep.net wrote:

...

I'm tasked with coming up with an IP plan for an very large lab network. I want to maximize route table manageability and router/firewall log readability. I was thinking of building this lab with the following address space:

1.0.0.0 /8 10.0.0.0 /8 100.0.0.0 /8

I encourage my competitors to do this.

or read another way, this is fairly stupid, but as log as this stupidity doesn't affect me, I don't care. However the person tasked with cleaning tha crap up behind you may not feel the same.

Doing something right, the first time saves having to do it over again and again and again and again.

If this is a test lab or a learning/practice lab where the users will be simulating real-world scenarios and/or doing NAT and other things that involve public/private addressing issues, then it would IMHO be suitable to use a mix of reserved private space and routable space as appropriate. This would also be useful if it's being used to do a dry-run configuration of networks that will eventually be connected to the Internet. This way once the bugs are worked out, you can cut-and-paste the configurations onto the production network. As long as the people running the lab have it sufficiently firewalled that lab bogosities, BGP sessions, etc. are constrained to the lab itself, it shouldn't matter. Another caveat is that the students or persons using the lab are sufficiently well trained in the differences between routable and reserved private space. No sense in teaching even more people to use public space for private networks that later need to connect to the world but don't/won't/can't renumber. Worse yet are those who want to advertise 10/8 to the rest of us. There are enough of both out there already. As far as any need for the lab to access the Internet for software downloads, general browsing, etc., a well-implemented and firewalled proxy server might be a good idea. What the "right" answer is depends to a great extent on the purpose of the lab and the clue level of its users. -- Jay Hennigan - CCIE #7880 - Network Administration - jay@west.net WestNet: Connecting you to the planet. 805 884-6323 WB6RDV NetLojix Communications, Inc. - http://www.netlojix.com/

On Sat, 31 May 2003 bdragon@gweep.net wrote:

The only difference between routed and unrouted (note the difference between that and routable) is consensus. There is nothing inherent in the bits which prevents RFC1918 from being routed globally. There is no requirement to use RFC1918 for NAT.

Correct, an error in terminology on my part. Substitute "routed" or "public" for the first and "RFC1918" or "private" for the second. I think we all know what was meant.

Therefore, your argument doesn't hold water.

The minor error in terminology doesn't really affect what I was trying to say. There may be valid reasons where, within a closed lab environment, it could be useful to use public, routed space not assigned to the entity that is operating the lab. I listed some.

If the entity for some stupid reason can't use RFC1918, they can and should use their _own_ address space for the balance.

And if the reason isn't stupid, and proper safeguards are in place, and they're not training people to do this anywhere BUT within a closed lab environment, then it makes no difference what addresses they use. Even if the reason is stupid, no one outside the lab will know or care. If it makes it easier to debug problems with decimal or binary addresses that are easy to parse, or to paste configurations from a production system to a lab for troubleshooting, so what? -- Jay Hennigan - CCIE #7880 - Network Administration - jay@west.net WestNet: Connecting you to the planet. 805 884-6323 WB6RDV NetLojix Communications, Inc. - http://www.netlojix.com/

On Fri, 30 May 2003 Brennan_Murphy@NAI.com wrote:

RFC1918 is a set number of IP addresses. If you are working on a private network lab that will be on the internet eventually or have parts on the internet and exceeds the total number of IPV4 addressing set aside in RFC1918, and IPV6 private addressing is not an option, what can you do? (I know it's a stretch, but I think it asks specifically what Brennan wants to know and what I'm curious about now)

You request the number if IP addresses you actually need from IANA (or the relevant registry). See RFC2050, which says: In order for the Internet to scale using existing technologies, use of regional registry services should be limited to the assignment of IP addresses for organizations meeting one or more of the following conditions: a) the organization has no intention of connecting to the Internet-either now or in the future-but it still requires a globally unique IP address. The organization should consider using reserved addresses from RFC1918. If it is determined this is not possible, they can be issued unique (if not Internet routable) IP addresses. DS

On Fri, 30 May 2003, Joel Jaeggli wrote:

As a related question I guess I'd ask what sort of simulation requires more than 16.7 million discreet ipv4 adresses (1/256 of the whole) in order too simulate a reasonable subset of the whole ipv4 internet.

I don't have an answer for that one. :-) I came across the numbering for this in another lookup I was doing and it seemed relevant: 10.0.0.0/8 16,777,214 unique hosts maximum 192.168.0.0/16 65,534 unique hosts maximum 172.16.0.0/12 1,048,574 unique hosts maximum Total: 17,891,322 unique addresses (before further subnetting) What "real world" scenario would use more than almost 17.9 million hosts? That doesn't count NAT'ing within private addressing if the project is large enough and primarily using outbound traffic. RFC1884 sets aside fec0::/10 for IPV6 Private addressing. That's enough to fit all of IPV4 addressing inside of the private addressing alone. (Anyone have a total number of unique hosts on that one?) Gerald

RFC1884 sets aside fec0::/10 for IPV6 Private addressing. That's enough to fit all of IPV4 addressing inside of the private addressing alone. (Anyone have a total number of unique hosts on that one?)

2^(128-10) 332306998946228968225951765070086144 Pete

<snip blah>

Since all of the replies have been pretty close to the same (Use RFC1918 ...etc), I'd like to rephrase it to answer a curiosity of mine.

The answers seemed correct, rephrasing wont change current systems or policies to suit you!

RFC1918 is a set number of IP addresses. If you are working on a private network lab

Use anything you like, its private.

that will be on the internet eventually or have parts on the internet and exceeds the total number of IPV4 addressing set aside in

Follow the current policy for public Internet Address space, get what IPs you need, implement NAT where/if possible.

RFC1918, and IPV6 private addressing is not an option, what can you do? (I

thats the way it is, take it or leave it.. Steve

know it's a stretch, but I think it asks specifically what Brennan wants to know and what I'm curious about now)

IPV6 would seem to be the best answer overall since it has already been determined the solution for limited addressing, but there is still equipment/software and such that does not support it.

Brennan, is a mix of IPV6 and IPV4 private addressing an option for you? I do have to agree wholeheartedly that using address space not assigned to you is unprofessional, and will cause someone headaches later even if it is not you.

Gerald