North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: The Choice: IPv4 Exhaustion or Transition to IPv6

  • From: Steven M. Bellovin
  • Date: Thu Jun 28 15:17:12 2007

On Thu, 28 Jun 2007 13:27:15 -0400
John Curran <[email protected]> wrote:

> At 10:16 AM -0700 6/28/07, Randy Bush wrote:
> > >     Interoperability is achieved by having public facing
> >>     servers reachable via IPv4 and IPv6.
> >
> >that may be what it looks like from the view of an address allocator.
> >
> >but if you actually have to deliver data from servers you need a path
> >where data from/in both protocols is supported on every link of the
> >chain that goes all the way to every bit of back end data in your
> >system.  and if one link in that chain is missing, <sound of glib
> >idea
> >imploding>.
> Randy,
>    Organizations need to have IPv6 on their DMZ servers.
>    ISP's needs to provide IPv6 to these organizations, either
>    directly or via tunnel.
>    It's actually rather simple.
Randy is right.  It's very simple from 30,000 feet; it's a lot messier
in detail if done at scale.  I'll give just example, using your
suggestion of converting DMZ: how do you keep your firewall rules
consistent between v4 and v6 addresses and prefixes?  This involves
vendor technology (the firewall box), communication with your ISP
(handling prefix changes), local technology (you do have a change
control process for firewall rules, right, and perhaps a database of
machines and addresses?), and training.  It may also involve upgrading
some of the servers because of the rapid changes in v6 support.  (I'll
cite a personal example: I upgraded the OS on a machine of mine
recently, and found that my mailing lists weren't working.  Why?
Because the version of Postfix had been changed to one with v6 support,
and I had to specify v6 loopback addresses in some mysterious place.)

That's not to say this is an excuse for delay.  Converting is going to
get harder when you acquire more gear, not easier.  Planning and
back-end conversions (i.e., ISP databases that hold customer IP
address ranges) should have been done years ago.  It's now become
urgent; I'm glad people are finally starting to take it seriously.
(Metanote:  IPv6 is far from the best possible design.  Given all of
the constraints, including the political ones, it may be, as Bjarne
Stroustrup said of C++, the best design possible.  Whatever -- it
exists as a reasonably stable design; starting over would cost us 15
more years that we just don't have.)

		--Steve Bellovin,