From michael.dillon at bt.com  Sat May  1 11:49:26 2010
From: michael.dillon at bt.com (michael.dillon at bt.com)
Date: Sat, 1 May 2010 10:49:26 +0100
Subject: Requesting feedback for a considered DNS test
In-Reply-To: <4BDB194E.8040305@ipv6canada.com>
Message-ID: <28E139F46D45AF49A31950F88C49745805EF623E@E03MVZ2-UKDY.domain1.systemhost.net>

> So, for any other Canadians out there who want v6 glue on 
> their domain, here is one known good registrar that can make it so:
> 
> http://egate.ca

Sounds like a good idea for another "list" page on
http://www.getipv6.info

--Michael Dillon

From frnkblk at iname.com  Sat May  1 13:23:38 2010
From: frnkblk at iname.com (Frank Bulk)
Date: Sat, 1 May 2010 06:23:38 -0500
Subject: Requesting feedback for a considered DNS test
In-Reply-To: <28E139F46D45AF49A31950F88C49745805EF623E@E03MVZ2-UKDY.domain1.systemhost.net>
References: <4BDB194E.8040305@ipv6canada.com>
	<28E139F46D45AF49A31950F88C49745805EF623E@E03MVZ2-UKDY.domain1.systemhost.net>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAD/buWHiJGYQ61GWlcPxbQOAQAAAAA=@iname.com>

Already here:
http://www.sixxs.net/faq/dns/?faq=ipv6glue

Frank

-----Original Message-----
From: ipv6-ops-bounces+frnkblk=iname.com at lists.cluenet.de
[mailto:ipv6-ops-bounces+frnkblk=iname.com at lists.cluenet.de] On Behalf Of
michael.dillon at bt.com
Sent: Saturday, May 01, 2010 4:49 AM
To: ipv6-ops at lists.cluenet.de
Subject: RE: Requesting feedback for a considered DNS test

> So, for any other Canadians out there who want v6 glue on 
> their domain, here is one known good registrar that can make it so:
> 
> http://egate.ca

Sounds like a good idea for another "list" page on
http://www.getipv6.info

--Michael Dillon


From frnkblk at iname.com  Sat May  1 13:23:47 2010
From: frnkblk at iname.com (Frank Bulk)
Date: Sat, 1 May 2010 06:23:47 -0500
Subject: Requesting feedback for a considered DNS test
In-Reply-To: <28E139F46D45AF49A31950F88C49745805EF623E@E03MVZ2-UKDY.domain1.systemhost.net>
References: <4BDB194E.8040305@ipv6canada.com>
	<28E139F46D45AF49A31950F88C49745805EF623E@E03MVZ2-UKDY.domain1.systemhost.net>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAD/buWHiJGYQ61GWlcPxbQOAQAAAAA=@iname.com>

Already here:
http://www.sixxs.net/faq/dns/?faq=ipv6glue

Frank

-----Original Message-----
From: ipv6-ops-bounces+frnkblk=iname.com at lists.cluenet.de
[mailto:ipv6-ops-bounces+frnkblk=iname.com at lists.cluenet.de] On Behalf Of
michael.dillon at bt.com
Sent: Saturday, May 01, 2010 4:49 AM
To: ipv6-ops at lists.cluenet.de
Subject: RE: Requesting feedback for a considered DNS test

> So, for any other Canadians out there who want v6 glue on 
> their domain, here is one known good registrar that can make it so:
> 
> http://egate.ca

Sounds like a good idea for another "list" page on
http://www.getipv6.info

--Michael Dillon



From david at sargasso.net  Sun May  2 01:40:51 2010
From: david at sargasso.net (David Croft)
Date: Sun, 2 May 2010 01:40:51 +0200
Subject: Requesting feedback for a considered DNS test
In-Reply-To: <q2r530c5af61004300301xf0e36554g5bbf4ec9ea433028@mail.gmail.com>
References: <4BDA5750.4000701@ipv6canada.com>
	<alpine.DEB.1.10.1004300633520.6768@uplift.swm.pp.se>
	<q2r530c5af61004300301xf0e36554g5bbf4ec9ea433028@mail.gmail.com>
Message-ID: <o2rc28c250d1005011640xa39773d9jbd4e0c13faa7ca9a@mail.gmail.com>

On 30 April 2010 12:01, Andrew Yourtchenko <ayourtch at gmail.com> wrote:
> Not sure if I would have been better off with the <iframe> rather than
> <img> - again any wisdom on that is also welcome.

You'd be better off with keeping the img and removing the
display:none. The way it is set up at the moment will give skewed
results as some browsers (such as Opera) will not load images with
display:none.

David

From mohacsi at niif.hu  Sun May  2 07:19:03 2010
From: mohacsi at niif.hu (Mohacsi Janos)
Date: Sun, 2 May 2010 07:19:03 +0200 (CEST)
Subject: Requesting feedback for a considered DNS test
In-Reply-To: <alpine.OSX.2.00.1004300828290.169@cust11794.lava.net>
References: <4BDA5750.4000701@ipv6canada.com>
	<20100430145752.GD60850@Space.Net>
	<alpine.OSX.2.00.1004300828290.169@cust11794.lava.net>
Message-ID: <alpine.BSF.2.00.1005020713150.73665@mignon.ki.iif.hu>




On Fri, 30 Apr 2010, Antonio Querubin wrote:

> On Fri, 30 Apr 2010, Gert Doering wrote:
>
>> I seem to remember a site that tried to do this, where you could enter
>> the address of your web site and if everything was "green", you'd get
>> an "IPv6 certified!" (or something like that) logo to put on your web site.
>> 
>> Alas, I can't find it anymore, so at least *that* page wasn't a big
>> success...
>> 
>> I like the idea :-) - especially with full-featured DNS and MX checks.
>
> Something close:
>
> http://www.mrp.net/cgi-bin/ipv6-status.cgi

This script can be a good attempt, but more inteligence shuld be put in 
it:

- for a HTTP test it reports about ipv6.$domain - for my test case it 
exists, but completly different from www.$domain

- DNS test complaining about the server not inside the domain - I think it 
should not be a problem

- for ntp we are using time(number) not ntp name.

- xmpp is also exist, but in a completly different name


Best Regards,

 	Janos Mohacsu

From ayourtch at gmail.com  Sun May  2 15:08:17 2010
From: ayourtch at gmail.com (Andrew Yourtchenko)
Date: Sun, 2 May 2010 15:08:17 +0200
Subject: Requesting feedback for a considered DNS test
In-Reply-To: <o2rc28c250d1005011640xa39773d9jbd4e0c13faa7ca9a@mail.gmail.com>
References: <4BDA5750.4000701@ipv6canada.com>
	<alpine.DEB.1.10.1004300633520.6768@uplift.swm.pp.se>
	<q2r530c5af61004300301xf0e36554g5bbf4ec9ea433028@mail.gmail.com>
	<o2rc28c250d1005011640xa39773d9jbd4e0c13faa7ca9a@mail.gmail.com>
Message-ID: <g2z530c5af61005020608z40b193abi83a8bf6be0f526ec@mail.gmail.com>

On Sun, May 2, 2010 at 1:40 AM, David Croft <david at sargasso.net> wrote:
> On 30 April 2010 12:01, Andrew Yourtchenko <ayourtch at gmail.com> wrote:
>> Not sure if I would have been better off with the <iframe> rather than
>> <img> - again any wisdom on that is also welcome.
>
> You'd be better off with keeping the img and removing the
> display:none. The way it is set up at the moment will give skewed
> results as some browsers (such as Opera) will not load images with
> display:none.

Thanks a lot for the observation! I did not know about this
"optimization". I've tested the style="width:0px;height:0px" which
appears to work in FF,Chrome,Opera - and does not give the "broken
image" icon when the test fails. As well updated the info in the
report page so the folks could tweak the invocation of the img.

cheers,
andrew

>
> David
>

From frnkblk at iname.com  Sun May  2 16:06:19 2010
From: frnkblk at iname.com (Frank Bulk)
Date: Sun, 2 May 2010 09:06:19 -0500
Subject: Requesting feedback for a considered DNS test
In-Reply-To: <alpine.BSF.2.00.1005020713150.73665@mignon.ki.iif.hu>
References: <4BDA5750.4000701@ipv6canada.com>	<20100430145752.GD60850@Space.Net>	<alpine.OSX.2.00.1004300828290.169@cust11794.lava.net>
	<alpine.BSF.2.00.1005020713150.73665@mignon.ki.iif.hu>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAD7YgXQliEaRJ8nPTZdPwVUAQAAAAA=@iname.com>

Sounds like you're suggesting that persons can specify the IP address or
FQDN for certain services?  It's not exactly clear to me that if the domain
in question is acme.com, that overriding the WWW test to www.v6.acme.net and
the xmpp to chatter.acme.org is safe and verifiable way to "confirm" IPv6
connectivity.

Frank

-----Original Message-----
From: ipv6-ops-bounces+frnkblk=iname.com at lists.cluenet.de
[mailto:ipv6-ops-bounces+frnkblk=iname.com at lists.cluenet.de] On Behalf Of
Mohacsi Janos
Sent: Sunday, May 02, 2010 12:19 AM
To: Antonio Querubin
Cc: mrp at mrp.net; ipv6-ops at lists.cluenet.de; Gert Doering; Steve Bertrand
Subject: Re: Requesting feedback for a considered DNS test


On Fri, 30 Apr 2010, Antonio Querubin wrote:

> On Fri, 30 Apr 2010, Gert Doering wrote:
>
>> I seem to remember a site that tried to do this, where you could enter
>> the address of your web site and if everything was "green", you'd get
>> an "IPv6 certified!" (or something like that) logo to put on your web
site.
>> 
>> Alas, I can't find it anymore, so at least *that* page wasn't a big
>> success...
>> 
>> I like the idea :-) - especially with full-featured DNS and MX checks.
>
> Something close:
>
> http://www.mrp.net/cgi-bin/ipv6-status.cgi

This script can be a good attempt, but more inteligence shuld be put in 
it:

- for a HTTP test it reports about ipv6.$domain - for my test case it 
exists, but completly different from www.$domain

- DNS test complaining about the server not inside the domain - I think it 
should not be a problem

- for ntp we are using time(number) not ntp name.

- xmpp is also exist, but in a completly different name


Best Regards,

    Janos Mohacsu


From frnkblk at iname.com  Sun May  2 16:06:25 2010
From: frnkblk at iname.com (Frank Bulk)
Date: Sun, 2 May 2010 09:06:25 -0500
Subject: Requesting feedback for a considered DNS test
In-Reply-To: <alpine.BSF.2.00.1005020713150.73665@mignon.ki.iif.hu>
References: <4BDA5750.4000701@ipv6canada.com>	<20100430145752.GD60850@Space.Net>	<alpine.OSX.2.00.1004300828290.169@cust11794.lava.net>
	<alpine.BSF.2.00.1005020713150.73665@mignon.ki.iif.hu>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAD7YgXQliEaRJ8nPTZdPwVUAQAAAAA=@iname.com>

Sounds like you're suggesting that persons can specify the IP address or
FQDN for certain services?  It's not exactly clear to me that if the domain
in question is acme.com, that overriding the WWW test to www.v6.acme.net and
the xmpp to chatter.acme.org is safe and verifiable way to "confirm" IPv6
connectivity.

Frank

-----Original Message-----
From: ipv6-ops-bounces+frnkblk=iname.com at lists.cluenet.de
[mailto:ipv6-ops-bounces+frnkblk=iname.com at lists.cluenet.de] On Behalf Of
Mohacsi Janos
Sent: Sunday, May 02, 2010 12:19 AM
To: Antonio Querubin
Cc: mrp at mrp.net; ipv6-ops at lists.cluenet.de; Gert Doering; Steve Bertrand
Subject: Re: Requesting feedback for a considered DNS test


On Fri, 30 Apr 2010, Antonio Querubin wrote:

> On Fri, 30 Apr 2010, Gert Doering wrote:
>
>> I seem to remember a site that tried to do this, where you could enter
>> the address of your web site and if everything was "green", you'd get
>> an "IPv6 certified!" (or something like that) logo to put on your web
site.
>> 
>> Alas, I can't find it anymore, so at least *that* page wasn't a big
>> success...
>> 
>> I like the idea :-) - especially with full-featured DNS and MX checks.
>
> Something close:
>
> http://www.mrp.net/cgi-bin/ipv6-status.cgi

This script can be a good attempt, but more inteligence shuld be put in 
it:

- for a HTTP test it reports about ipv6.$domain - for my test case it 
exists, but completly different from www.$domain

- DNS test complaining about the server not inside the domain - I think it 
should not be a problem

- for ntp we are using time(number) not ntp name.

- xmpp is also exist, but in a completly different name


Best Regards,

    Janos Mohacsu


From tony at lava.net  Sun May  2 18:16:18 2010
From: tony at lava.net (Antonio Querubin)
Date: Sun, 2 May 2010 06:16:18 -1000 (HST)
Subject: Requesting feedback for a considered DNS test
In-Reply-To: <alpine.BSF.2.00.1005020713150.73665@mignon.ki.iif.hu>
References: <4BDA5750.4000701@ipv6canada.com>
	<20100430145752.GD60850@Space.Net>
	<alpine.OSX.2.00.1004300828290.169@cust11794.lava.net>
	<alpine.BSF.2.00.1005020713150.73665@mignon.ki.iif.hu>
Message-ID: <alpine.OSX.2.00.1005020615160.145@cust11794.lava.net>

On Sun, 2 May 2010, Mohacsi Janos wrote:

>> http://www.mrp.net/cgi-bin/ipv6-status.cgi
>
> This script can be a good attempt, but more inteligence shuld be put in it:
>
> - for a HTTP test it reports about ipv6.$domain - for my test case it exists, 
> but completly different from www.$domain
>
> - DNS test complaining about the server not inside the domain - I think it 
> should not be a problem
>
> - for ntp we are using time(number) not ntp name.
>
> - xmpp is also exist, but in a completly different name

I'd agree on all but the first.  Regarding the http test, I'm not sure how 
even a technically smart user could guess what the other domain might be.

Antonio Querubin
808-545-5282 x3003
e-mail/xmpp:  tony at lava.net

From BECHA at ripe.net  Mon May  3 15:21:58 2010
From: BECHA at ripe.net (Vesna Manojlovic)
Date: Mon, 03 May 2010 15:21:58 +0200
Subject: IPv6 Ripeness
Message-ID: <4BDECDF6.2060701@ripe.net>



-------- Original Message --------
Subject: IPv6 Ripeness
Date: Mon, 03 May 2010 15:18:11 +0200
From: Vesna Manojlovic <BECHA at ripe.net>
To: nanog at nanog.org

[warning - statistics!]

Dear colleagues,

we have published an article on the RIPE Labs about the IPv6 Ripeness -
a method of rating the v6 deployment of LIRs (Local Internet Registries)
in RIPE NCC service region:

http://labs.ripe.net/content/ipv6-ripeness

In total: 8% of all (6.7K) LIRs have "4 stars", 27% have at least v6 space.
Top results are for Slovenia: 25% "4 stars", and 67% v6 space!

For now, we summarized the results per country. But, we have big plans
for the future ...

Please take a look, and tell us how useful you find it, and how can we
make it better.

Regards,
Vesna Manojlovic
RIPE NCC Trainer


ps - apologies for the duplicates; please forward to your local NOG: 
.pl, .fr, .ch, .uk ....


From jogi at mur.at  Tue May  4 19:26:27 2010
From: jogi at mur.at (Jogi =?utf-8?Q?Hofm=C3=BCller?=)
Date: Tue, 4 May 2010 19:26:27 +0200
Subject: request for help in finding a blackhole
Message-ID: <20100504172626.GE2609@pc3.office.mur.at>

dear all,

We have been trying to play this via our upstream, but they were not
successfull in bringing this matter any further.  So I hope someone here
can be of help.

There is a blackhole between us [1] and hurricane electric.  All the
usual symptoms aply:  ping6 works, larger pakets disapear.  This is the
traceroute from my office machine:

traceroute to www.he.net (2001:470:0:76::2), 30 hops max, 80 byte packets
 1  v201-fe2-r1ko.mur.at (2a02:3e0:1::1)  0.256 ms  0.278 ms  0.326 ms
 2  vlan706.wien6.aco.net (2001:628::1)  4.762 ms  5.092 ms  5.094 ms
 3  aconet.rt1.vie.at.geant2.net (2001:798:10:10dd::1)  5.104 ms  5.114 ms  6.530 ms
 4  so-7-0-0.rt1.pra.cz.geant2.net (2001:798:cc:1001:1301::1)  11.464 ms  11.876 ms  11.889 ms
 5  so-6-3-0.rt1.fra.de.geant2.net (2001:798:cc:1301:1401::2)  19.248 ms  19.443 ms  20.696 ms
 6  so-5-0-0.rt1.ams.nl.geant2.net (2001:798:cc:1401:2201::2)  27.079 ms  27.716 ms  27.680 ms
 7  so-4-0-0.rt1.lon.uk.geant2.net (2001:798:cc:2201:2801::2)  36.237 ms  34.842 ms  34.839 ms
 8  2001:450:2002:6f::1 (2001:450:2002:6f::1)  33.736 ms  34.859 ms  34.846 ms
 9  paix.ipv6.he.net (2001:504:d::10)  179.603 ms  179.117 ms  179.074 ms
10  10gigabitethernet1-2.core1.fmt1.ipv6.he.net (2001:470:0:2e::1)  190.764 ms  189.628 ms  189.589 ms
11  he.net (2001:470:0:76::2)  179.894 ms  179.970 ms  180.268 ms

There is a tunnel between hops 2 and 3 where MTU drops to 1476 (PMTUD
working correctly).  Nevertheless, the largest pakets I can get over the
wire - all the way up to he.net - have 1450 bytes.

I might add that a lot of other IPv6 things work flawless here ;)

Any help is appreciated!  If you need a pingable target, use www.mur.at
which is dual-stacked.

[1] mur.at, AS39837, 2a02:3e0::/32

Thanks in advance!
j.
-- 
j.hofm?ller                                http://users.mur.at/thesix/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
Url : http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100504/afc3d5aa/attachment.bin 

From drake at begriffli.ch  Tue May  4 19:48:24 2010
From: drake at begriffli.ch (Drake Wilson)
Date: Tue, 4 May 2010 12:48:24 -0500
Subject: request for help in finding a blackhole
In-Reply-To: <20100504172626.GE2609@pc3.office.mur.at>
References: <20100504172626.GE2609@pc3.office.mur.at>
Message-ID: <20100504174824.GA31617@drache.begriffli.ch>

Quoth Jogi Hofm?ller <jogi at mur.at>, on 2010-05-04 19:26:27 +0200:
> There is a tunnel between hops 2 and 3 where MTU drops to 1476 (PMTUD
> working correctly).  Nevertheless, the largest pakets I can get over the
> wire - all the way up to he.net - have 1450 bytes.

As a data point, I can get pings of 1410 IPv6 payload bytes between
drache.begriffli.ch (2001:470:1f0f:c9::2), which is behind an HE 6in4
tunnel, and www.mur.at (2a02:3e0::21:80).  Larger than 1410 bytes gets
no response.  Local MTU between drache and zwischenschaltung is 1472.

traceroute to www.mur.at (2a02:3e0::21:80) from 2001:470:1f0f:c9::2, 30 hops max, 60 byte packets
 1  zwischenschaltung.begriffli.ch (2001:470:1f0f:c9::1)  0.472 ms  0.468 ms  0.416 ms 
 2  begrifflich.tunnel.tserv8.dal1.ipv6.he.net (2001:470:1f0e:c9::1)  16.509 ms  16.714 ms  15.672 ms 
 3  gige-g2-14.core1.dal1.ipv6.he.net (2001:470:0:78::1)  18.130 ms  20.807 ms  22.780 ms 
 4  10gigabitethernet1-4.core1.chi1.he.net (2001:470:0:c4::1)  46.684 ms  46.217 ms  41.291 ms 
 5  ibx-chi.ip6.tiscali.net (2001:504:0:4::3257:1)  46.927 ms  43.989 ms  41.354 ms 
 6  xe-2-1-0.nyc20.ip6.tinet.net (2001:668:0:2::1:1481)  80.681 ms  79.285 ms  76.807 ms 
 7  xe-5-2-0.lon11.ip6.tinet.net (2001:668:0:2::1:1072)  159.303 ms  156.890 ms  *
 8  xe-0-3-0.lon10.ip6.tinet.net (2001:668:0:2::1:1622)  159.263 ms  156.882 ms  154.935 ms 
 9  * * *         
10  * * *         
11  Aconet.tu-637.sar1.Amsterdam1.Level3.net (2001:1900:5:2::a2)  226.214 ms  224.457 ms  222.389 ms 
12  2001:628::a089:0:1 (2001:628::a089:0:1)  230.819 ms  230.740 ms  225.948 ms 
13  www.mur.at (2a02:3e0::21:80)  231.697 ms  229.288 ms  227.128 ms 

   ---> Drake Wilson

From frnkblk at iname.com  Tue May  4 20:11:22 2010
From: frnkblk at iname.com (Frank Bulk - iName.com)
Date: Tue, 4 May 2010 13:11:22 -0500
Subject: request for help in finding a blackhole
In-Reply-To: <20100504174824.GA31617@drache.begriffli.ch>
References: <20100504172626.GE2609@pc3.office.mur.at>
	<20100504174824.GA31617@drache.begriffli.ch>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABCK2zKwsWSSKMvHIDcPufHAQAAAAA=@iname.com>

What does mturoute show?

Frank

-----Original Message-----
From: ipv6-ops-bounces+frnkblk=iname.com at lists.cluenet.de
[mailto:ipv6-ops-bounces+frnkblk=iname.com at lists.cluenet.de] On Behalf Of
Drake Wilson
Sent: Tuesday, May 04, 2010 12:48 PM
To: Jogi Hofm?ller
Cc: ipv6-ops at lists.cluenet.de
Subject: Re: request for help in finding a blackhole

Quoth Jogi Hofm?ller <jogi at mur.at>, on 2010-05-04 19:26:27 +0200:
> There is a tunnel between hops 2 and 3 where MTU drops to 1476 (PMTUD
> working correctly).  Nevertheless, the largest pakets I can get over the
> wire - all the way up to he.net - have 1450 bytes.

As a data point, I can get pings of 1410 IPv6 payload bytes between
drache.begriffli.ch (2001:470:1f0f:c9::2), which is behind an HE 6in4
tunnel, and www.mur.at (2a02:3e0::21:80).  Larger than 1410 bytes gets
no response.  Local MTU between drache and zwischenschaltung is 1472.

traceroute to www.mur.at (2a02:3e0::21:80) from 2001:470:1f0f:c9::2, 30 hops
max, 60 byte packets
 1  zwischenschaltung.begriffli.ch (2001:470:1f0f:c9::1)  0.472 ms  0.468 ms
0.416 ms 
 2  begrifflich.tunnel.tserv8.dal1.ipv6.he.net (2001:470:1f0e:c9::1)  16.509
ms  16.714 ms  15.672 ms 
 3  gige-g2-14.core1.dal1.ipv6.he.net (2001:470:0:78::1)  18.130 ms  20.807
ms  22.780 ms 
 4  10gigabitethernet1-4.core1.chi1.he.net (2001:470:0:c4::1)  46.684 ms
46.217 ms  41.291 ms 
 5  ibx-chi.ip6.tiscali.net (2001:504:0:4::3257:1)  46.927 ms  43.989 ms
41.354 ms 
 6  xe-2-1-0.nyc20.ip6.tinet.net (2001:668:0:2::1:1481)  80.681 ms  79.285
ms  76.807 ms 
 7  xe-5-2-0.lon11.ip6.tinet.net (2001:668:0:2::1:1072)  159.303 ms  156.890
ms  *
 8  xe-0-3-0.lon10.ip6.tinet.net (2001:668:0:2::1:1622)  159.263 ms  156.882
ms  154.935 ms 
 9  * * *         
10  * * *         
11  Aconet.tu-637.sar1.Amsterdam1.Level3.net (2001:1900:5:2::a2)  226.214 ms
224.457 ms  222.389 ms 
12  2001:628::a089:0:1 (2001:628::a089:0:1)  230.819 ms  230.740 ms  225.948
ms 
13  www.mur.at (2a02:3e0::21:80)  231.697 ms  229.288 ms  227.128 ms 

   ---> Drake Wilson


From drake at begriffli.ch  Tue May  4 20:54:32 2010
From: drake at begriffli.ch (Drake Wilson)
Date: Tue, 4 May 2010 13:54:32 -0500
Subject: request for help in finding a blackhole
In-Reply-To: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABCK2zKwsWSSKMvHIDcPufHAQAAAAA=@iname.com>
References: <20100504172626.GE2609@pc3.office.mur.at>
	<20100504174824.GA31617@drache.begriffli.ch>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABCK2zKwsWSSKMvHIDcPufHAQAAAAA=@iname.com>
Message-ID: <20100504185432.GA1499@drache.begriffli.ch>

Quoth "Frank Bulk - iName.com" <frnkblk at iname.com>, on 2010-05-04 13:11:22 -0500:
> What does mturoute show?

If you're asking me, I'm not familiar with that tool.  A search on the
Web suggests that it is a Windows tool; I'm running Debian GNU/Linux,
so I don't have access to that as far as I know.

   ---> Drake Wilson

From paul at timmins.net  Tue May  4 20:56:29 2010
From: paul at timmins.net (Paul Timmins)
Date: Tue, 4 May 2010 14:56:29 -0400
Subject: request for help in finding a blackhole
In-Reply-To: <20100504185432.GA1499@drache.begriffli.ch>
Message-ID: <E1O9NIH-0000Sx-Jt@ignignokt.timminstechnologies.com>

Tracepath/tracepath6 have MTU tests



-- Sent from my Palm Pre
On May 4, 2010 2:55 PM, Drake Wilson &lt;drake at begriffli.ch&gt; wrote: 

Quoth "Frank Bulk - iName.com" &lt;frnkblk at iname.com&gt;, on 2010-05-04 13:11:22 -0500:

&gt; What does mturoute show?



If you're asking me, I'm not familiar with that tool.  A search on the

Web suggests that it is a Windows tool; I'm running Debian GNU/Linux,

so I don't have access to that as far as I know.



   ---&gt; Drake Wilson




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100504/efeb560f/attachment.html 

From frnkblk at iname.com  Tue May  4 21:10:49 2010
From: frnkblk at iname.com (Frank Bulk - iName.com)
Date: Tue, 4 May 2010 14:10:49 -0500
Subject: request for help in finding a blackhole
In-Reply-To: <20100504185432.GA1499@drache.begriffli.ch>
References: <20100504172626.GE2609@pc3.office.mur.at>
	<20100504174824.GA31617@drache.begriffli.ch>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABCK2zKwsWSSKMvHIDcPufHAQAAAAA=@iname.com>
	<20100504185432.GA1499@drache.begriffli.ch>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABI9lc9ymu3SKa52HvqJ4yIAQAAAAA=@iname.com>

Yes, mturoute is the windows tool.  Closest to that in Linux is tracepath6.

Frank

-----Original Message-----
From: Drake Wilson [mailto:drake at begriffli.ch] 
Sent: Tuesday, May 04, 2010 1:55 PM
To: Frank Bulk - iName.com
Cc: ipv6-ops at lists.cluenet.de
Subject: Re: request for help in finding a blackhole

Quoth "Frank Bulk - iName.com" <frnkblk at iname.com>, on 2010-05-04 13:11:22
-0500:
> What does mturoute show?

If you're asking me, I'm not familiar with that tool.  A search on the
Web suggests that it is a Windows tool; I'm running Debian GNU/Linux,
so I don't have access to that as far as I know.

   ---> Drake Wilson


From jogi at mur.at  Tue May  4 22:35:26 2010
From: jogi at mur.at (Jogi =?utf-8?Q?Hofm=C3=BCller?=)
Date: Tue, 4 May 2010 22:35:26 +0200
Subject: request for help in finding a blackhole
In-Reply-To: <20100504174824.GA31617@drache.begriffli.ch>
References: <20100504172626.GE2609@pc3.office.mur.at>
	<20100504174824.GA31617@drache.begriffli.ch>
Message-ID: <20100504203526.GG3524@kathy>

On Tue, May 04, 2010 at 12:48:24PM -0500, Drake Wilson wrote:
> Quoth Jogi Hofm?ller <jogi at mur.at>, on 2010-05-04 19:26:27 +0200:
> > There is a tunnel between hops 2 and 3 where MTU drops to 1476 (PMTUD
> > working correctly).  Nevertheless, the largest pakets I can get over the
> > wire - all the way up to he.net - have 1450 bytes.
> 
> As a data point, I can get pings of 1410 IPv6 payload bytes between
> drache.begriffli.ch (2001:470:1f0f:c9::2), which is behind an HE 6in4
> tunnel, and www.mur.at (2a02:3e0::21:80).  Larger than 1410 bytes gets
> no response.  Local MTU between drache and zwischenschaltung is 1472.

This is quite helpfull in a certain way, thanks.  Looking at the path
from us to you and comparing it to the other way round, we have
asymmetry on the way.  My guess is this is not intented ... I send this
Cc to our upstream.

Largest ping pakets I get through to drache.begriffli.ch have 1402 bytes
payload.

traceroute to drache.begriffli.ch (2001:470:1f0f:c9::2), 30 hops max, 40 byte packets
 1  v200-fe2-r1ko.mur.at (2a02:3e0::1)  7.079 ms  7.290 ms  7.291 ms
 2  vlan706.wien6.aco.net (2001:628::1)  7.468 ms  7.695 ms  7.698 ms
 3  aconet.rt1.vie.at.geant2.net (2001:798:10:10dd::1)  8.316 ms  8.509 ms  8.512 ms
 4  so-7-0-0.rt1.pra.cz.geant2.net (2001:798:cc:1001:1301::1)  14.007 ms  14.242 ms  14.245 ms
 5  so-6-3-0.rt1.fra.de.geant2.net (2001:798:cc:1301:1401::2)  21.708 ms  21.948 ms  21.951 ms
 6  so-5-0-0.rt1.ams.nl.geant2.net (2001:798:cc:1401:2201::2)  29.288 ms  29.524 ms  29.504 ms
 7  so-4-0-0.rt1.lon.uk.geant2.net (2001:798:cc:2201:2801::2)  36.061 ms  37.635 ms  37.854 ms
 8  2001:450:2002:6f::1 (2001:450:2002:6f::1)  36.274 ms  35.621 ms  35.603 ms
 9  paix.ipv6.he.net (2001:504:d::10)  182.951 ms  190.324 ms  190.531 ms
10  10gigabitethernet1-1.core1.lax1.ipv6.he.net (2001:470:0:34::2)  198.526 ms  197.772 ms  198.050 ms
11  10gigabitethernet1-2.core1.dal1.ipv6.he.net (2001:470:0:3a::2)  205.769 ms  206.175 ms  216.346 ms
12  gige-gbge0.tserv8.dal1.ipv6.he.net (2001:470:0:78::2)  215.080 ms  214.964 ms  214.916 ms
13  zwischenschaltung.begriffli.ch (2001:470:1f0f:c9::1)  224.190 ms  228.387 ms  232.977 ms
14  drache.begriffli.ch (2001:470:1f0f:c9::2)  233.814 ms  222.013 ms  222.790 ms

> traceroute to www.mur.at (2a02:3e0::21:80) from 2001:470:1f0f:c9::2, 30 hops max, 60 byte packets
>  1  zwischenschaltung.begriffli.ch (2001:470:1f0f:c9::1)  0.472 ms  0.468 ms  0.416 ms 
>  2  begrifflich.tunnel.tserv8.dal1.ipv6.he.net (2001:470:1f0e:c9::1)  16.509 ms  16.714 ms  15.672 ms 
>  3  gige-g2-14.core1.dal1.ipv6.he.net (2001:470:0:78::1)  18.130 ms  20.807 ms  22.780 ms 
>  4  10gigabitethernet1-4.core1.chi1.he.net (2001:470:0:c4::1)  46.684 ms  46.217 ms  41.291 ms 
>  5  ibx-chi.ip6.tiscali.net (2001:504:0:4::3257:1)  46.927 ms  43.989 ms  41.354 ms 
>  6  xe-2-1-0.nyc20.ip6.tinet.net (2001:668:0:2::1:1481)  80.681 ms  79.285 ms  76.807 ms 
>  7  xe-5-2-0.lon11.ip6.tinet.net (2001:668:0:2::1:1072)  159.303 ms  156.890 ms  *
>  8  xe-0-3-0.lon10.ip6.tinet.net (2001:668:0:2::1:1622)  159.263 ms  156.882 ms  154.935 ms 
>  9  * * *         
> 10  * * *         
> 11  Aconet.tu-637.sar1.Amsterdam1.Level3.net (2001:1900:5:2::a2)  226.214 ms  224.457 ms  222.389 ms 
> 12  2001:628::a089:0:1 (2001:628::a089:0:1)  230.819 ms  230.740 ms  225.948 ms 
> 13  www.mur.at (2a02:3e0::21:80)  231.697 ms  229.288 ms  227.128 ms 
> 
>    ---> Drake Wilson

j.
-- 
j.hofm?ller                                http://users.mur.at/thesix/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url : http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100504/6250e168/attachment.bin 

From jogi at mur.at  Tue May  4 22:39:10 2010
From: jogi at mur.at (Jogi =?utf-8?Q?Hofm=C3=BCller?=)
Date: Tue, 4 May 2010 22:39:10 +0200
Subject: request for help in finding a blackhole
In-Reply-To: <E1O9NIH-0000Sx-Jt@ignignokt.timminstechnologies.com>
References: <20100504185432.GA1499@drache.begriffli.ch>
	<E1O9NIH-0000Sx-Jt@ignignokt.timminstechnologies.com>
Message-ID: <20100504203910.GH3524@kathy>

On Tue, May 04, 2010 at 02:56:29PM -0400, Paul Timmins wrote:
> Tracepath/tracepath6 have MTU tests

Thanks for clarifying.  I also was unfamiliar with mturoute.  This is
tracepath6 to www.he.net:

 1?: [LOCALHOST]                      pmtu 1500
 1:  v200-fe2-r1ko.mur.at                       2.664ms 
 1:  v200-fe2-r1ko.mur.at                       1.738ms 
 2:  vlan706.wien6.aco.net                      8.297ms 
 3:  vlan706.wien6.aco.net                     10.178ms pmtu 1476
 3:  aconet.rt1.vie.at.geant2.net               8.667ms asymm  4 
 3:  aconet.rt1.vie.at.geant2.net               8.262ms asymm  4 
 4:  so-7-0-0.rt1.pra.cz.geant2.net            15.878ms asymm  5 
 5:  so-6-3-0.rt1.fra.de.geant2.net            22.271ms asymm  6 
 6:  so-5-0-0.rt1.ams.nl.geant2.net            30.130ms asymm  7 
 7:  so-4-0-0.rt1.lon.uk.geant2.net            39.102ms asymm  8 
 8:  2001:450:2002:6f::1                       37.038ms asymm  6 
 9:  paix.ipv6.he.net                         190.797ms asymm 11 
10:  10gigabitethernet1-2.core1.fmt1.ipv6.he.net 183.297ms asymm  9 
11:  no reply
12:  no reply

Regards,
j.
-- 
j.hofm?ller                                http://users.mur.at/thesix/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url : http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100504/5780da8f/attachment-0001.bin 

From drake at begriffli.ch  Wed May  5 07:35:09 2010
From: drake at begriffli.ch (Drake Wilson)
Date: Wed, 5 May 2010 00:35:09 -0500
Subject: request for help in finding a blackhole
In-Reply-To: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABCK2zKwsWSSKMvHIDcPufHAQAAAAA=@iname.com>
References: <20100504172626.GE2609@pc3.office.mur.at>
	<20100504174824.GA31617@drache.begriffli.ch>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABCK2zKwsWSSKMvHIDcPufHAQAAAAA=@iname.com>
Message-ID: <20100505053509.GA1553@drache.begriffli.ch>

Quoth "Frank Bulk - iName.com" <frnkblk at iname.com>, on 2010-05-04 13:11:22 -0500:
> What does mturoute show?

After receiving clarifications (thanks), installed tracepath6.
tracepath6 www.mur.at from drache.begriffli.ch:

 1?: [LOCALHOST]                      pmtu 1500
 1:  zwischenschaltung.begriffli.ch             0.946ms
 1:  zwischenschaltung.begriffli.ch             0.999ms
 2:  zwischenschaltung.begriffli.ch             0.929ms pmtu 1472
 2:  begrifflich.tunnel.tserv8.dal1.ipv6.he.net  44.573ms
 2:  begrifflich.tunnel.tserv8.dal1.ipv6.he.net  44.608ms
 3:  gige-g2-14.core1.dal1.ipv6.he.net         43.319ms
 4:  10gigabitethernet1-4.core1.chi1.he.net    70.560ms
 5:  ibx-chi.ip6.tiscali.net                   69.641ms asymm  6
 6:  xe-2-1-0.nyc20.ip6.tinet.net              87.755ms asymm  8
 7:  xe-5-2-0.lon11.ip6.tinet.net             212.686ms asymm  9
 8:  xe-9-2-0.lon10.ip6.tinet.net             165.985ms
[... "no reply" thereafter]

Using the -l option to set initial packet size and doing a
quasi-binary search yields the same results down to -l 1450, at
which point more hops come into view:
 
 9:  no reply
10:  no reply
11:  Aconet.tu-637.sar1.Amsterdam1.Level3.net 233.160ms asymm 12
12:  2001:628::a089:0:1                       239.639ms asymm 13
[... "no reply" thereafter]

which matches the earlier ICMPv6 echo traceroute up to the last hop
before the final destination.

Does this suggest an MTU breakage near that point?

   ---> Drake Wilson

From sthaug at nethelp.no  Wed May  5 08:10:41 2010
From: sthaug at nethelp.no (sthaug at nethelp.no)
Date: Wed, 05 May 2010 08:10:41 +0200 (CEST)
Subject: request for help in finding a blackhole
In-Reply-To: <20100505053509.GA1553@drache.begriffli.ch>
References: <20100504174824.GA31617@drache.begriffli.ch>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABCK2zKwsWSSKMvHIDcPufHAQAAAAA=@iname.com>
	<20100505053509.GA1553@drache.begriffli.ch>
Message-ID: <20100505.081041.74656997.sthaug@nethelp.no>

> Using the -l option to set initial packet size and doing a
> quasi-binary search yields the same results down to -l 1450, at
> which point more hops come into view:
>  
>  9:  no reply
> 10:  no reply
> 11:  Aconet.tu-637.sar1.Amsterdam1.Level3.net 233.160ms asymm 12
> 12:  2001:628::a089:0:1                       239.639ms asymm 13
> [... "no reply" thereafter]
> 
> which matches the earlier ICMPv6 echo traceroute up to the last hop
> before the final destination.
> 
> Does this suggest an MTU breakage near that point?

Confirmed. I get a "packet too big" ICMPv6 message from the Level3
router:

08:07:49.873715 IP6 2001:1900:5:1::1d > 2001:8c0:9200:1::2: ICMP6, packet too big, mtu 1450, length 1240

Steinar Haug, Nethelp consulting, sthaug at nethelp.no

From jogi at mur.at  Wed May  5 08:35:17 2010
From: jogi at mur.at (Jogi =?utf-8?Q?Hofm=C3=BCller?=)
Date: Wed, 5 May 2010 08:35:17 +0200
Subject: request for help in finding a blackhole
In-Reply-To: <20100505053509.GA1553@drache.begriffli.ch>
References: <20100504172626.GE2609@pc3.office.mur.at>
	<20100504174824.GA31617@drache.begriffli.ch>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABCK2zKwsWSSKMvHIDcPufHAQAAAAA=@iname.com>
	<20100505053509.GA1553@drache.begriffli.ch>
Message-ID: <20100505063517.GN3524@kathy>

Hi Drake, all

On Wed, May 05, 2010 at 12:35:09AM -0500, Drake Wilson wrote:
> Quoth "Frank Bulk - iName.com" <frnkblk at iname.com>, on 2010-05-04 13:11:22 -0500:
> > What does mturoute show?
> 
> After receiving clarifications (thanks), installed tracepath6.
> tracepath6 www.mur.at from drache.begriffli.ch:
> 
>  1?: [LOCALHOST]                      pmtu 1500
>  1:  zwischenschaltung.begriffli.ch             0.946ms
>  1:  zwischenschaltung.begriffli.ch             0.999ms
>  2:  zwischenschaltung.begriffli.ch             0.929ms pmtu 1472
>  2:  begrifflich.tunnel.tserv8.dal1.ipv6.he.net  44.573ms
>  2:  begrifflich.tunnel.tserv8.dal1.ipv6.he.net  44.608ms
>  3:  gige-g2-14.core1.dal1.ipv6.he.net         43.319ms
>  4:  10gigabitethernet1-4.core1.chi1.he.net    70.560ms
>  5:  ibx-chi.ip6.tiscali.net                   69.641ms asymm  6
>  6:  xe-2-1-0.nyc20.ip6.tinet.net              87.755ms asymm  8
>  7:  xe-5-2-0.lon11.ip6.tinet.net             212.686ms asymm  9
>  8:  xe-9-2-0.lon10.ip6.tinet.net             165.985ms
> [... "no reply" thereafter]
> 
> Using the -l option to set initial packet size and doing a
> quasi-binary search yields the same results down to -l 1450, at
> which point more hops come into view:
>  
>  9:  no reply
> 10:  no reply
> 11:  Aconet.tu-637.sar1.Amsterdam1.Level3.net 233.160ms asymm 12
> 12:  2001:628::a089:0:1                       239.639ms asymm 13
> [... "no reply" thereafter]

After hop 12 (our border router) there is only our webserver which does
not reply to UDP pakets.  You can use birke.mur.at as an alternative
traceroute6/ping6 target since this host is less restrictive than our
webserver.  Unfortunately tracepath6 does not provide the possibility of
using ICMP pakets for its probes (like traceoute's -I flag).

> which matches the earlier ICMPv6 echo traceroute up to the last hop
> before the final destination.
> 
> Does this suggest an MTU breakage near that point?

Quite frankly I have no idea :(  I can state with almost 100% certainty
that it's not anywhere near us since we would be expecting a lot more
troubles using IPv6, which we don't.

Thanks so far!

Cheers,
j.
-- 
j.hofm?ller                                http://users.mur.at/thesix/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url : http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100505/9a3e61a5/attachment.bin 

From ayourtch at gmail.com  Wed May  5 10:02:41 2010
From: ayourtch at gmail.com (Andrew Yourtchenko)
Date: Wed, 5 May 2010 10:02:41 +0200
Subject: request for help in finding a blackhole
In-Reply-To: <20100505063517.GN3524@kathy>
References: <20100504172626.GE2609@pc3.office.mur.at>
	<20100504174824.GA31617@drache.begriffli.ch>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABCK2zKwsWSSKMvHIDcPufHAQAAAAA=@iname.com>
	<20100505053509.GA1553@drache.begriffli.ch>
	<20100505063517.GN3524@kathy>
Message-ID: <y2q530c5af61005050102hb32c0b29ibc8d5fb315838b99@mail.gmail.com>

On Wed, May 5, 2010 at 8:35 AM, Jogi Hofm?ller <jogi at mur.at> wrote:

> After hop 12 (our border router) there is only our webserver which does
> not reply to UDP pakets. ?You can use birke.mur.at as an alternative
> traceroute6/ping6 target since this host is less restrictive than our

This is a tracepath6 from my stdio.be box (systeminplace's Xen VPS, in
L.A. AFAIR), it does show a trace of MTU 1450 in there:


 1?: [LOCALHOST]                      pmtu 1500
 1:  2607:f128:42:73::1                         0.265ms
 1:  2607:f128:42:73::1                         0.273ms
 2:  2607:f128:40:400::9                        0.952ms
 3:  2607:f128:a:3::2                           0.903ms
 4:  2607:f128:a::2                             1.049ms asymm  3
 5:  te8-4-116.ar1.ord1.us.nlayer.net           1.153ms asymm  3
 6:  ae1-40g.cr2.ord1.us.nlayer.net             0.904ms asymm  7
 7:  2001:450:2002:1d9::1                     178.648ms asymm  6
 8:  2001:7f8:4::d1c:1                         90.848ms asymm  9
 9:  2001:7f8:4::d1c:1                         90.858ms pmtu 1450
 9:  tu-613.sar1.Amsterdam1.Level3.net        112.758ms asymm 12
 9:  tu-613.sar1.Amsterdam1.Level3.net        109.083ms asymm 12
10:  Aconet.tu-637.sar1.Amsterdam1.Level3.net 129.158ms asymm 13
11:  2001:628::a089:0:1                       135.536ms asymm 14
12:  birke.mur.at                             139.920ms reached
     Resume: pmtu 1450 hops 12 back 50

Pcap does confirm the 2001:7f8:4::d1c:1 sending ICMP Too Big.

Wild guess on what might be happening: one of the boxes in the
interconnect is configured with a larger MTU than everything else
(possibly - larger than the L2 MTU ?), so when you give it large
packets, it transmits them, and they are eaten at L2. The other boxes
are configured correctly and can spew ICMP Too Big just fine.

However, for this theory to be even remotely right, we'd need to
verify that dropping is in one direction only. Is that a valid
assumption (aka do we have a way to test it in the other direction) ?

cheers,
andrew

From thomas at cis.uni-muenchen.de  Wed May  5 23:09:37 2010
From: thomas at cis.uni-muenchen.de (Thomas =?utf-8?q?Sch=C3=A4fer?=)
Date: Wed, 5 May 2010 23:09:37 +0200
Subject: Imagine
Message-ID: <201005052309.37853.thomas@cis.uni-muenchen.de>

there is an ipv6-only net. All base services like smtp(s), imap(s), ntp, 
printing, ssh,  dns-resolver... and so on are ipv6 capable.
What is to do with the "old" world - specifically http(s)/ftp-services?
Ok - a proxy is good answer. But now my actual question:

Is there a possibillity to make simple proxysettings in Firefox in this way:
site has only A-Record-- > use proxy
site has AAAA-Record--> connect directly

Is this possible with a Proxy Auto-Config (pac) -file?

Regards,

Thomas 




From ryanczak at arin.net  Wed May  5 23:24:36 2010
From: ryanczak at arin.net (Matt Ryanczak)
Date: Wed, 5 May 2010 17:24:36 -0400
Subject: Imagine
In-Reply-To: <201005052309.37853.thomas@cis.uni-muenchen.de>
References: <201005052309.37853.thomas@cis.uni-muenchen.de>
Message-ID: <4BE1E214.7080502@arin.net>

On 5/5/10 5:09 PM, Thomas Sch?fer wrote:
> Is there a possibillity to make simple proxysettings in Firefox in this way:
> site has only A-Record-->  use proxy
> site has AAAA-Record-->  connect directly
>
>    
Why not proxy everything?
> Is this possible with a Proxy Auto-Config (pac) -file?
>
>    
AFAIK this is not possible. My understanding of proxy autoconfig is that 
it runs when the browser is started in order to configure proxy 
settings. The script logic in the pac file does not run in response to 
every host lookup a browser makes. I have limited experience with proxy 
auto-config though and I could very well be wrong about this.

~Matt

From simon at slimey.org  Wed May  5 23:48:37 2010
From: simon at slimey.org (Simon Lockhart)
Date: Wed, 5 May 2010 22:48:37 +0100
Subject: Imagine
In-Reply-To: <4BE1E214.7080502@arin.net>
References: <201005052309.37853.thomas@cis.uni-muenchen.de>
	<4BE1E214.7080502@arin.net>
Message-ID: <20100505214837.GV2911@virtual.bogons.net>

On Wed May 05, 2010 at 05:24:36PM -0400, Matt Ryanczak wrote:
> AFAIK this is not possible. My understanding of proxy autoconfig is that 
> it runs when the browser is started in order to configure proxy 
> settings. The script logic in the pac file does not run in response to 
> every host lookup a browser makes. I have limited experience with proxy 
> auto-config though and I could very well be wrong about this.

No - logic in the PAC file can be executed for every URL request (or, at
least that was the case when I wrote PAC files about 10 years ago). I have
no idea how much it has been updated to support IPv6.

Simon

From ipv6-ops+phil at spodhuis.org  Thu May  6 01:40:35 2010
From: ipv6-ops+phil at spodhuis.org (Phil Pennock)
Date: Wed, 5 May 2010 16:40:35 -0700
Subject: Imagine
In-Reply-To: <201005052309.37853.thomas@cis.uni-muenchen.de>
References: <201005052309.37853.thomas@cis.uni-muenchen.de>
Message-ID: <20100505234035.GA25281@redoubt.spodhuis.org>

On 2010-05-05 at 23:09 +0200, Thomas Sch?fer wrote:
> there is an ipv6-only net. All base services like smtp(s), imap(s), ntp, 
> printing, ssh,  dns-resolver... and so on are ipv6 capable.
> What is to do with the "old" world - specifically http(s)/ftp-services?
> Ok - a proxy is good answer. But now my actual question:
> 
> Is there a possibillity to make simple proxysettings in Firefox in this way:
> site has only A-Record-- > use proxy
> site has AAAA-Record--> connect directly
> 
> Is this possible with a Proxy Auto-Config (pac) -file?

Yes.

What I wrote a couple of weeks ago was "if there's only an IPv6 record,
go direct, else use proxy", because of some proxies that aren't IPv6
capable.  This should give you the general idea of what to do, though.

function FindProxyForURL(url, host)
{
  // ... other stuff ...

  // IPv6-only
  if (isResolvableEx(host) && !isResolveable(host))
    return "DIRECT";

  // ...  more stuff ...

  return "PROXY my.proxy.host.example.net:3128";
}

You probably want this:
  http://blogs.msdn.com/wndp/archive/2006/07/18/IPV6-WPAD-for-WinHttp-and-WinInet.aspx
which I believe the other browsers are supporting now; I didn't try
Firefox, only Chrome/Linux, which I can confirm does support the IPv6
extensions.

You'd probably want to use dnsResolve() and dnsResolveEx(), sort the
results and compare those lists; if they're equal, there were no AAAA
records.

-Phil

From ryanczak at arin.net  Thu May  6 01:42:05 2010
From: ryanczak at arin.net (Matt Ryanczak)
Date: Wed, 5 May 2010 19:42:05 -0400
Subject: Imagine
In-Reply-To: <20100505214837.GV2911@virtual.bogons.net>
References: <201005052309.37853.thomas@cis.uni-muenchen.de>	<4BE1E214.7080502@arin.net>
	<20100505214837.GV2911@virtual.bogons.net>
Message-ID: <4BE2024D.7000301@arin.net>

On 5/5/10 5:48 PM, Simon Lockhart wrote:
> No - logic in the PAC file can be executed for every URL request (or, at
> least that was the case when I wrote PAC files about 10 years ago). I have
> no idea how much it has been updated to support IPv6.
>    
You are correct. I did some reading up on this and it looks like you can 
use the dnsResolve function to find the IP address for a host and then 
do regex matching to determine if it an IPv4 or IPv6 address.

hostip = dnsResolve(host);
if (shExpMatch(hostip, "/^\d+\.\d+\.\d+\.\d+$/g")) {
     return "PROXY proxyserver:8080;
}
else {
     return "DIRECT";
}
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100505/648d728d/attachment.html 

From thomas at cis.uni-muenchen.de  Thu May  6 08:00:40 2010
From: thomas at cis.uni-muenchen.de (Thomas =?utf-8?q?Sch=C3=A4fer?=)
Date: Thu, 6 May 2010 08:00:40 +0200
Subject: Imagine
In-Reply-To: <4BE1E214.7080502@arin.net>
References: <201005052309.37853.thomas@cis.uni-muenchen.de>
	<4BE1E214.7080502@arin.net>
Message-ID: <201005060800.41436.thomas@cis.uni-muenchen.de>

Am Mittwoch 05 Mai 2010 schrieb Matt Ryanczak:
> On 5/5/10 5:09 PM, Thomas Sch?fer wrote:
> > Is there a possibillity to make simple proxysettings in Firefox in this
> > way: site has only A-Record-->  use proxy
> > site has AAAA-Record-->  connect directly
>
> Why not proxy everything?

Because I don't want proxying, but it seems easier than dualstack in some 
cases.


And, if the dnsResolve-regex-skript works, then the proxy has less to do the 
more ipv6-sites are available. 

Thanks for your answers. 

And at the end (ipv6 is running everythere) - the proxy is needless and may be 
simply switched off.

Regards,


From marcelo at it.uc3m.es  Thu May  6 08:07:25 2010
From: marcelo at it.uc3m.es (marcelo bagnulo braun)
Date: Thu, 06 May 2010 08:07:25 +0200
Subject: Imagine
In-Reply-To: <201005052309.37853.thomas@cis.uni-muenchen.de>
References: <201005052309.37853.thomas@cis.uni-muenchen.de>
Message-ID: <4BE25C9D.9010704@it.uc3m.es>

El 05/05/10 23:09, Thomas Sch?fer escribi?:
> there is an ipv6-only net. All base services like smtp(s), imap(s), ntp,
> printing, ssh,  dns-resolver... and so on are ipv6 capable.
> What is to do with the "old" world - specifically http(s)/ftp-services?
> Ok - a proxy is good answer. But now my actual question:
>
> Is there a possibillity to make simple proxysettings in Firefox in this way:
> site has only A-Record-->  use proxy
> site has AAAA-Record-->  connect directly
>    

this is kind of what the dns64 does, but making it transparent for the 
end host
regards, marcelo

> Is this possible with a Proxy Auto-Config (pac) -file?
>
> Regards,
>
> Thomas
>
>
>
>
>    


From olivier.tharan at gmail.com  Thu May  6 08:27:52 2010
From: olivier.tharan at gmail.com (Olivier Tharan)
Date: Thu, 6 May 2010 08:27:52 +0200
Subject: Imagine
In-Reply-To: <4BE2024D.7000301@arin.net>
References: <201005052309.37853.thomas@cis.uni-muenchen.de>
	<4BE1E214.7080502@arin.net> <20100505214837.GV2911@virtual.bogons.net>
	<4BE2024D.7000301@arin.net>
Message-ID: <i2hda7386e51005052327v590a646eve1406b43b1bea13b@mail.gmail.com>

Be careful that this check is performed for every single URL your
browser encounters, before you even know you want to hit a proxy
server or not, let alone initiate the HTTP connection. regexp and
resolver checks are quite expensive and ultimately can lead to slower
browsing for your users. This combined with broken resolvers w/ IPv6
vs. IPv4 will give you frustrated users :) "the network is slow"

I would say that the PAC file and proxy support in your browser
probably doesn't care too much about IPv6 since most URLs are
hostnames anyway and name to IP resolution is mostly done on the proxy
server (or on the local machine resolver). Of course, having a raw
IPv6 address in your URL is always interesting.

On Thu, May 6, 2010 at 1:42 AM, Matt Ryanczak <ryanczak at arin.net> wrote:
> On 5/5/10 5:48 PM, Simon Lockhart wrote:
>
> No - logic in the PAC file can be executed for every URL request (or, at
> least that was the case when I wrote PAC files about 10 years ago). I have
> no idea how much it has been updated to support IPv6.
>
>
> You are correct. I did some reading up on this and it looks like you can use
> the dnsResolve function to find the IP address for a host and then do regex
> matching to determine if it an IPv4 or IPv6 address.
>
> hostip = dnsResolve(host);
> if (shExpMatch(hostip, "/^\d+\.\d+\.\d+\.\d+$/g")) {
> ??? return "PROXY proxyserver:8080;
> }
> else {
> ??? return "DIRECT";
> }
>



-- 
olive

From thomas at cis.uni-muenchen.de  Thu May  6 23:25:17 2010
From: thomas at cis.uni-muenchen.de (Thomas =?utf-8?q?Sch=C3=A4fer?=)
Date: Thu, 6 May 2010 23:25:17 +0200
Subject: Imagine
In-Reply-To: <i2hda7386e51005052327v590a646eve1406b43b1bea13b@mail.gmail.com>
References: <201005052309.37853.thomas@cis.uni-muenchen.de>
	<4BE2024D.7000301@arin.net>
	<i2hda7386e51005052327v590a646eve1406b43b1bea13b@mail.gmail.com>
Message-ID: <201005062325.17606.thomas@cis.uni-muenchen.de>

Am Donnerstag 06 Mai 2010 schrieb Olivier Tharan:
> Be careful that this check is performed for every single URL your
> browser encounters, before you even know you want to hit a proxy
> server or not, let alone initiate the HTTP connection. regexp and
> resolver checks are quite expensive and ultimately can lead to slower
> browsing for your users. This combined with broken resolvers w/ IPv6
> vs. IPv4 will give you frustrated users :) "the network is slow"

I tested it only on the user thomas - an I cannot frustrate myself :-)
I took the proposal with dnsResolve function - it works. 
Only the flashplay-plugin (other plugins not tested) didn't work. 

I like this solution more than DNS-manipulation and/or transparent proxys - I 
am very frustrated by transparent proxys (http://1.2.3.9/bmi...   by t-mobile 
and vodafone) in the past. 

Regards,
Thomas






From steve at ipv6canada.com  Fri May  7 21:22:16 2010
From: steve at ipv6canada.com (Steve Bertrand)
Date: Fri, 07 May 2010 15:22:16 -0400
Subject: Requesting feedback for a considered DNS test
In-Reply-To: <4BDA5750.4000701@ipv6canada.com>
References: <4BDA5750.4000701@ipv6canada.com>
Message-ID: <4BE46868.4070304@ipv6canada.com>

On 2010.04.30 00:06, Steve Bertrand wrote:

> The brief that I put up for a description does not come close to
> describing what my complete thinking is, but it is enough for you to
> tell me whether there is another project that you know about that I
> could throw my efforts at instead, or continue on...
> 
> http://ipv6canada.com/?p=110

Hi all,

I'm looking for a bit more feedback. The majority of the backend work is
now done, and before I begin finalizing the code, I'd like to get an
idea of whether my strategy for data storage is sane.

Each test will have an entry in the database, containing the first date
the test was successful, and then a second entry for when the last
successful check was run. The entries ending with 'f' are for first
find. A data snip is below.

I'm thinking that keeping the dates like this will allow for easy
statistical analysis and comparison, as well as for when I begin writing
the GUI/graphing engine.

I'm looking for feedback on:

- is this approach reasonable, and could it be done better
- other tests/functions that would be handy to have included

Thanks!

Steve

*************************** 3. row ***************************
           id: 5
       domain: onlyv6.com
       v4glue: NULL
      v4gluef: NULL
       v6glue: 2010-05-07
      v6gluef: 2010-05-07
   v6_ns_conn: 2010-05-07
  v6_ns_connf: 2010-05-07
 v6_http_aaaa: 2010-05-07
v6_http_aaaaf: 2010-05-07
 v6_http_conn: 2010-05-07
v6_http_connf: 2010-05-07
   v6_mx_aaaa: 2010-05-07
  v6_mx_aaaaf: 2010-05-07
   v6_mx_conn: 2010-05-07
  v6_mx_connf: 2010-05-07
      started: 2010-05-07
      checked: 2010-05-07
*************************** 4. row ***************************
           id: 6
       domain: microsoft.com
       v4glue: 2010-05-07
      v4gluef: 2010-05-07
       v6glue: NULL
      v6gluef: NULL
   v6_ns_conn: NULL
  v6_ns_connf: NULL
 v6_http_aaaa: NULL
v6_http_aaaaf: NULL
 v6_http_conn: NULL
v6_http_connf: NULL
   v6_mx_aaaa: NULL
  v6_mx_aaaaf: NULL
   v6_mx_conn: NULL
  v6_mx_connf: NULL
      started: 2010-05-07
      checked: 2010-05-07

From steve at ipv6canada.com  Sat May  8 02:59:52 2010
From: steve at ipv6canada.com (Steve Bertrand)
Date: Fri, 07 May 2010 20:59:52 -0400
Subject: Browsers that surf to v6 addrs
Message-ID: <4BE4B788.7040102@ipv6canada.com>

I have been working all day with Perl code in order to identify the
cleanest, easiest way to make connections to numerous different
protocols (ie. services that run on specific known ports).

There are a few that I'm going to provide the author with patches, but
others are just too complex for me to get into with the time I have.

One thing I noticed during my testing, is that I don't have a web
browser on my system(s) that allows me to surf directly to an IPv6
address. I tried all manner of quoting, but still, no go.

Firefox at least attempts to go to '2607' if my url string is
"http://2607:f118::b6", IE immediately dumps "page can not be displayed".

I even tried the v6 enabled lynx on my v6 only server, but it too fails
miserably.

Is there a web browser that knows what a v6 address is, when processing
it via the ``address bar''? AFAIC, this is a problem when it comes to
troubleshooting. Perhaps my software is out of date.

Steve

From wmaton at ryouko.imsb.nrc.ca  Sat May  8 03:02:31 2010
From: wmaton at ryouko.imsb.nrc.ca (William F. Maton Sotomayor)
Date: Fri, 7 May 2010 21:02:31 -0400 (EDT)
Subject: Browsers that surf to v6 addrs
In-Reply-To: <4BE4B788.7040102@ipv6canada.com>
References: <4BE4B788.7040102@ipv6canada.com>
Message-ID: <Pine.LNX.4.64.1005072101360.8934@ryouko.imsb.nrc.ca>

On Fri, 7 May 2010, Steve Bertrand wrote:

> Firefox at least attempts to go to '2607' if my url string is
> "http://2607:f118::b6", IE immediately dumps "page can not be displayed".

http://[::1]/

Worked for me under firefox.  Presumably http://[2607:f118::b6]/ will 
work.

wfms

From steve at ipv6canada.com  Sat May  8 03:04:36 2010
From: steve at ipv6canada.com (Steve Bertrand)
Date: Fri, 07 May 2010 21:04:36 -0400
Subject: Browsers that surf to v6 addrs
In-Reply-To: <Pine.LNX.4.64.1005072101360.8934@ryouko.imsb.nrc.ca>
References: <4BE4B788.7040102@ipv6canada.com>
	<Pine.LNX.4.64.1005072101360.8934@ryouko.imsb.nrc.ca>
Message-ID: <4BE4B8A4.5080109@ipv6canada.com>

On 2010.05.07 21:02, William F. Maton Sotomayor wrote:
> On Fri, 7 May 2010, Steve Bertrand wrote:
> 
>> Firefox at least attempts to go to '2607' if my url string is
>> "http://2607:f118::b6", IE immediately dumps "page can not be displayed".
> 
> http://[::1]/

ok. That is something that I should have clearly known from having to do
it elsewhere.

Sorry for the noise. I was just thinking about the problem too hard.

Steve

From s.ewing at aussiehq.com.au  Sat May  8 03:05:45 2010
From: s.ewing at aussiehq.com.au (Shaun Ewing)
Date: Sat, 8 May 2010 11:05:45 +1000
Subject: Browsers that surf to v6 addrs
In-Reply-To: <4BE4B788.7040102@ipv6canada.com>
References: <4BE4B788.7040102@ipv6canada.com>
Message-ID: <DB1B82BD-380A-4E38-8C3D-7334C573164A@aussiehq.com.au>


On 08/05/2010, at 10:59 AM, Steve Bertrand wrote:

One thing I noticed during my testing, is that I don't have a web
browser on my system(s) that allows me to surf directly to an IPv6
address. I tried all manner of quoting, but still, no go.

Firefox at least attempts to go to '2607' if my url string is
"http://2607:f118::b6", IE immediately dumps "page can not be displayed".

I even tried the v6 enabled lynx on my v6 only server, but it too fails
miserably.

Is there a web browser that knows what a v6 address is, when processing
it via the ``address bar''? AFAIC, this is a problem when it comes to
troubleshooting. Perhaps my software is out of date.

The usual method for quoting is to enclose it in square brackets, eg:
http://[2607:f118::b6]/

I'm yet to find a modern browser that this doesn't work with.

-Shaun
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100508/4fd30bdf/attachment.html 

From mksmith at adhost.com  Sat May  8 03:07:23 2010
From: mksmith at adhost.com (Michael K. Smith)
Date: Fri, 07 May 2010 18:07:23 -0700
Subject: Browsers that surf to v6 addrs
In-Reply-To: <4BE4B788.7040102@ipv6canada.com>
Message-ID: <C80A075B.12235F%mksmith@adhost.com>

Hi Steve:


On 5/7/10 5:59 PM, "Steve Bertrand" <steve at ipv6canada.com> wrote:

> I have been working all day with Perl code in order to identify the
> cleanest, easiest way to make connections to numerous different
> protocols (ie. services that run on specific known ports).
> 
> There are a few that I'm going to provide the author with patches, but
> others are just too complex for me to get into with the time I have.
> 
> One thing I noticed during my testing, is that I don't have a web
> browser on my system(s) that allows me to surf directly to an IPv6
> address. I tried all manner of quoting, but still, no go.
> 
> Firefox at least attempts to go to '2607' if my url string is
> "http://2607:f118::b6", IE immediately dumps "page can not be displayed".
> 
> I even tried the v6 enabled lynx on my v6 only server, but it too fails
> miserably.
> 
> Is there a web browser that knows what a v6 address is, when processing
> it via the ``address bar''? AFAIC, this is a problem when it comes to
> troubleshooting. Perhaps my software is out of date.
> 
> Steve
> 

I think the syntax is http://[2607:f118::b6]/.  That works in Firefox but
I'm not sure about IE (sorry, I'm sitting on my mac at home).

Regards,

Mike


From steve at ipv6canada.com  Sat May  8 03:14:58 2010
From: steve at ipv6canada.com (Steve Bertrand)
Date: Fri, 07 May 2010 21:14:58 -0400
Subject: Browsers that surf to v6 addrs
In-Reply-To: <C80A075B.12235F%mksmith@adhost.com>
References: <C80A075B.12235F%mksmith@adhost.com>
Message-ID: <4BE4BB12.8040209@ipv6canada.com>

On 2010.05.07 21:07, Michael K. Smith wrote:

> On 5/7/10 5:59 PM, "Steve Bertrand" <steve at ipv6canada.com> wrote:

>> Is there a web browser that knows what a v6 address is, when processing
>> it via the ``address bar''? AFAIC, this is a problem when it comes to
>> troubleshooting. Perhaps my software is out of date.

> I think the syntax is http://[2607:f118::b6]/.  That works in Firefox but
> I'm not sure about IE (sorry, I'm sitting on my mac at home).

Thanks Mike...

As I said in an earlier post... the [] syntax completely slipped my mind :)

Here's what I've found (note...I *never* use IE, so it still sits at
6.whatever on the workstation I'm sitting at):

- lynx, had to escape the brackets:

lynx http://\[2607:f118::b6\]/

- Firefox, works across two versions of 3.x series with the suggested syntax

- IE6, not at all, and I don't have the capability to test beyond that.

Thanks for the kick everyone.

Steve

From mksmith at adhost.com  Sat May  8 03:16:24 2010
From: mksmith at adhost.com (Michael K. Smith)
Date: Fri, 07 May 2010 18:16:24 -0700
Subject: Browsers that surf to v6 addrs
In-Reply-To: <4BE4BB12.8040209@ipv6canada.com>
Message-ID: <C80A0978.122367%mksmith@adhost.com>




On 5/7/10 6:14 PM, "Steve Bertrand" <steve at ipv6canada.com> wrote:

> On 2010.05.07 21:07, Michael K. Smith wrote:
> 
>> On 5/7/10 5:59 PM, "Steve Bertrand" <steve at ipv6canada.com> wrote:
> 
>>> Is there a web browser that knows what a v6 address is, when processing
>>> it via the ``address bar''? AFAIC, this is a problem when it comes to
>>> troubleshooting. Perhaps my software is out of date.
> 
>> I think the syntax is http://[2607:f118::b6]/.  That works in Firefox but
>> I'm not sure about IE (sorry, I'm sitting on my mac at home).
> 
> Thanks Mike...
> 
> As I said in an earlier post... the [] syntax completely slipped my mind :)
> 
> Here's what I've found (note...I *never* use IE, so it still sits at
> 6.whatever on the workstation I'm sitting at):
> 
> - lynx, had to escape the brackets:
> 
> lynx http://\[2607:f118::b6\]/
> 
> - Firefox, works across two versions of 3.x series with the suggested syntax
> 
> - IE6, not at all, and I don't have the capability to test beyond that.
> 
> Thanks for the kick everyone.
> 
> Steve

I don't think that IE6 has or will ever have v6 support.  That browser was
deprecated before v6 was a default installation in Windows.

Mike


From sesse at google.com  Sat May  8 14:21:11 2010
From: sesse at google.com (Steinar H. Gunderson)
Date: Sat, 8 May 2010 14:21:11 +0200
Subject: Browsers that surf to v6 addrs
In-Reply-To: <4BE4BB12.8040209@ipv6canada.com>
References: <C80A075B.12235F%mksmith@adhost.com>
	<4BE4BB12.8040209@ipv6canada.com>
Message-ID: <AANLkTimOhBHJ2lyU9PSAaYb4---Gbg8gJPGZQ6Sb74Gm@mail.gmail.com>

Den 8. mai 2010 03.14 skrev Steve Bertrand <steve at ipv6canada.com> f?lgende:
> - lynx, had to escape the brackets:
>
> lynx http://\[2607:f118::b6\]/

That's because your shell would eat them otherwise. It's got nothing
to do with lynx.

/* Steinar */
-- 
Software Engineer, Google Switzerland

From sesse at google.com  Sat May  8 14:22:01 2010
From: sesse at google.com (Steinar H. Gunderson)
Date: Sat, 8 May 2010 14:22:01 +0200
Subject: Browsers that surf to v6 addrs
In-Reply-To: <C80A0978.122367%mksmith@adhost.com>
References: <4BE4BB12.8040209@ipv6canada.com>
	<C80A0978.122367%mksmith@adhost.com>
Message-ID: <AANLkTinj8HbspeYAEGUpFa_fj6u7mHl53Lc-emIeuOEf@mail.gmail.com>

Den 8. mai 2010 03.16 skrev Michael K. Smith <mksmith at adhost.com> f?lgende:
> I don't think that IE6 has or will ever have v6 support. ?That browser was
> deprecated before v6 was a default installation in Windows.

IE6 certainly has IPv6 support, if it's enabled in Windows. (I don't
know about IPv6 literal support, but you can certainly make the kame
dance.)

/* Steinar */
-- 
Software Engineer, Google Switzerland

From antoine.musso at laposte.fr  Mon May 10 14:30:25 2010
From: antoine.musso at laposte.fr (Antoine Musso)
Date: Mon, 10 May 2010 14:30:25 +0200
Subject: Browsers that surf to v6 addrs
In-Reply-To: <4BE4BB12.8040209@ipv6canada.com>
References: <C80A075B.12235F%mksmith@adhost.com>
	<4BE4BB12.8040209@ipv6canada.com>
Message-ID: <4BE7FC61.2030108@laposte.fr>

Le 08/05/2010 03:14, Steve Bertrand a ?crit :
> - lynx, had to escape the brackets:
>
> lynx http://\[2607:f118::b6\]/

This is related to your shell. You might want to single quote the URL.

  $ lynx 'http://[2607:f118::b6]'

-- 
Antoine MUSSO
Architecture et s?curit? des infrastructures r?seaux & t?l?coms
Groupe La Poste - Centre des services partag?s
T?l. 02 44 76 77 27

Post-scriptum La Poste

Ce message est confidentiel. Sous reserve de tout accord conclu par
ecrit entre vous et La Poste, son contenu ne represente en aucun cas un
engagement de la part de La Poste. Toute publication, utilisation ou
diffusion, meme partielle, doit etre autorisee prealablement. Si vous
n'etes pas destinataire de ce message, merci d'en avertir immediatement
l'expediteur.


From pnl at ielo.net  Mon May 10 18:09:15 2010
From: pnl at ielo.net (Bertrand Yvain)
Date: Mon, 10 May 2010 18:09:15 +0200
Subject: Imagine
In-Reply-To: <201005052309.37853.thomas@cis.uni-muenchen.de>
References: <201005052309.37853.thomas@cis.uni-muenchen.de>
Message-ID: <20100510160915.GB3531@nexus6.adm.ielo.net>

Hi,

On Wed, May 05, 2010 at 11:09:37PM +0200, Thomas Sch?fer wrote:
> there is an ipv6-only net.
> [...]
> Is there a possibillity to make simple proxysettings in Firefox in this way:
> site has only A-Record-- > use proxy
> site has AAAA-Record--> connect directly

If your network is IPv6 only, hosts should not receive A records.  IMHO,
there should be some DNS rewriting in your recursive resolvers?:

	A record -> AAAA of your proxy

Cheers,
-- 
Bertrand Yvain
http://www.IELO.net/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
Url : http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100510/3b5d44c5/attachment.bin 

From ayourtch at gmail.com  Mon May 10 19:58:12 2010
From: ayourtch at gmail.com (Andrew Yourtchenko)
Date: Mon, 10 May 2010 19:58:12 +0200
Subject: Imagine
In-Reply-To: <20100510160915.GB3531@nexus6.adm.ielo.net>
References: <201005052309.37853.thomas@cis.uni-muenchen.de>
	<20100510160915.GB3531@nexus6.adm.ielo.net>
Message-ID: <AANLkTikSDgqMUj9S5Ii_3GH8gYuLYy7J73ctVVRc81mZ@mail.gmail.com>

Hi,

On Mon, May 10, 2010 at 6:09 PM, Bertrand Yvain <pnl at ielo.net> wrote:
> Hi,
>
> On Wed, May 05, 2010 at 11:09:37PM +0200, Thomas Sch?fer wrote:
>> there is an ipv6-only net.
>> [...]
>> Is there a possibillity to make simple proxysettings in Firefox in this way:
>> site has only A-Record-- > use proxy
>> site has AAAA-Record--> connect directly
>
> If your network is IPv6 only, hosts should not receive A records. ?IMHO,
> there should be some DNS rewriting in your recursive resolvers?:
>
> ? ? ? ?A record -> AAAA of your proxy
>

Or something like this ?  http://ecdysis.viagenie.ca/

cheers,
andrew



> Cheers,
> --
> Bertrand Yvain
> http://www.IELO.net/
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
>
> iEYEARECAAYFAkvoL6sACgkQNI1aOIFDK/I9SgCfaGo1Op6H9a5m7KuV94s1Im5a
> ObwAnAmE0k6ULetTfq9mXLBNyXuLZ5lT
> =+vYy
> -----END PGP SIGNATURE-----
>
>

From thomas at cis.uni-muenchen.de  Mon May 10 21:52:20 2010
From: thomas at cis.uni-muenchen.de (Thomas =?utf-8?q?Sch=C3=A4fer?=)
Date: Mon, 10 May 2010 21:52:20 +0200
Subject: Imagine
In-Reply-To: <20100510160915.GB3531@nexus6.adm.ielo.net>
References: <201005052309.37853.thomas@cis.uni-muenchen.de>
	<20100510160915.GB3531@nexus6.adm.ielo.net>
Message-ID: <201005102152.21124.thomas@cis.uni-muenchen.de>

Am Montag 10 Mai 2010 schrieb Bertrand Yvain:
> Hi,
>
> On Wed, May 05, 2010 at 11:09:37PM +0200, Thomas Sch?fer wrote:
> > there is an ipv6-only net.
> > [...]
> > Is there a possibillity to make simple proxysettings in Firefox in this
> > way: site has only A-Record-- > use proxy
> > site has AAAA-Record--> connect directly
>
> If your network is IPv6 only, hosts should not receive A records.  IMHO,
> there should be some DNS rewriting in your recursive resolvers?:

Does somebody filter AAAA-Records in ipv4-only-networks?
(except the white lists by google &co)
It  is nice to hear different solutions.
But  IMHO DNS-rewriting/manipulating is ugly, but I am afraid it will be done 
massive scale.

Regards,
Thomas






From Sean.Siler at microsoft.com  Mon May 10 23:43:27 2010
From: Sean.Siler at microsoft.com (Sean Siler)
Date: Mon, 10 May 2010 21:43:27 +0000
Subject: Browsers that surf to v6 addrs
In-Reply-To: <AANLkTinj8HbspeYAEGUpFa_fj6u7mHl53Lc-emIeuOEf@mail.gmail.com>
References: <4BE4BB12.8040209@ipv6canada.com>
	<C80A0978.122367%mksmith@adhost.com>
	<AANLkTinj8HbspeYAEGUpFa_fj6u7mHl53Lc-emIeuOEf@mail.gmail.com>
Message-ID: <726B24CA0C7F494795894989DCF1FE01366AF585@TK5EX14MBXC130.redmond.corp.microsoft.com>

IE6 only supports IPv6 connections if the DNS name resolves to an IPv6 address.
IE7 and later support IPv6 literals.  See http://msdn.microsoft.com/en-us/library/aa385325.aspx for more info.


Sean Siler
IPv6 Program Manager
Microsoft

-----Original Message-----
From: ipv6-ops-bounces+sean.siler=microsoft.com at lists.cluenet.de [mailto:ipv6-ops-bounces+sean.siler=microsoft.com at lists.cluenet.de] On Behalf Of Steinar H. Gunderson
Sent: Saturday, May 08, 2010 5:22 AM
To: Michael K. Smith
Cc: ipv6-ops at lists.cluenet.de; Steve Bertrand
Subject: Re: Browsers that surf to v6 addrs

Den 8. mai 2010 03.16 skrev Michael K. Smith <mksmith at adhost.com> f?lgende:
> I don't think that IE6 has or will ever have v6 support. ?That browser 
> was deprecated before v6 was a default installation in Windows.

IE6 certainly has IPv6 support, if it's enabled in Windows. (I don't know about IPv6 literal support, but you can certainly make the kame
dance.)

/* Steinar */
--
Software Engineer, Google Switzerland


From lists at quux.de  Tue May 11 12:51:42 2010
From: lists at quux.de (Jens Link)
Date: Tue, 11 May 2010 12:51:42 +0200
Subject: Imagine
In-Reply-To: <201005102152.21124.thomas@cis.uni-muenchen.de> ("Thomas
	=?utf-8?Q?Sch=C3=A4fer=22's?= message of "Mon,
	10 May 2010 21:52:20 +0200")
References: <201005052309.37853.thomas@cis.uni-muenchen.de>
	<20100510160915.GB3531@nexus6.adm.ielo.net>
	<201005102152.21124.thomas@cis.uni-muenchen.de>
Message-ID: <87tyqeemo1.fsf@bowmore.quux.de>

Thomas Sch?fer <thomas at cis.uni-muenchen.de> writes:

> Does somebody filter AAAA-Records in ipv4-only-networks?  

Well there are some "security" appliances which filter AAAA. A customer
of mine is using one for WLAN access. Never found out if they do it on
purpose or by accident. 

Jens
-- 
-------------------------------------------------------------------------
| Foelderichstr. 40   | 13595 Berlin, Germany    | +49-151-18721264     |
| http://blog.quux.de | jabber: jenslink at guug.de | -------------------  | 
-------------------------------------------------------------------------

From ayourtch at gmail.com  Thu May 13 23:59:11 2010
From: ayourtch at gmail.com (Andrew Yourtchenko)
Date: Thu, 13 May 2010 23:59:11 +0200
Subject: Imagine #2 (musings on the topic of proxies)
Message-ID: <AANLkTinH34CC45ayBZng25bLLCJOlQmbfKCC7qB3WC2T@mail.gmail.com>

Folks,

Yesterday I had this odd idea, which today due to the bank holiday in
Belgium and the unsunny weather resulted in something very very
experimental that you can toy around with
(http://github.com/ayourtch/sxxis - I flipped the name of a wonderful
service that is typically used in reverse way), and I thought to ask
what's your opinion:

The use case scenario of it is as follows:

1) Joe Sixpack hosts hosts the website www.foobar.example.com at
FooHosters. He would like to experiment with making it available via
IPv6, but FooHosters do not provide the IPv6 yet.

2) The progressive thinkers of this world have installed a bunch of L7
proxies, that listen on IPv6 and can go back to IPv4 world (that's the
sxxis toy in the git url above).

3) These proxies are listening on the same IPv6 address, which is
anycasted similar to 6to4 one into the internet.Let's call this
address <AP>

4) Joe Sixpack creates a DNS record which points the
ipv6.foobar.example.com towards <AP>, and
real-target.ipv6.foobar.example.com which points to the address as
www.foobar.example.com [ alternatlively, ipv6.foobar.example.com can
also have an A-record that points to the real host]

5) the users around the world, when they point their browser
ipv6.foobar.example.com, would normally hit their closest proxy -
therefore the impact of the two-legged topology is decreased.

The second use case is the one from the "Imagine" thread - put this
kind of device onto an IPv6-only network and give it an IPv4 address,
and mangle all the empty AAAA responses from the internet into the
ones that point to the proxy. Everything besides the HTTP will be
indeed broken, but this would be better than everything *and* HTTP
broken...

Of course all of this has its problems:

1) Same story as open proxies that allow CONNECT, this is quite a bit
of a pain from the security/auditing point of view. How big of a pain
is it ?
Does the logging help solve it ?

2) TCP with anycast address is, yes, thoroughly impure from the
theoretical standpoint - however, my understanding is in practice i'd
be hitting the same physical box at least on a 5 minute interval.
Which is almost enough from the practical point of view.

3) Heavy - maintaining 2 TCP states per one client connection. This
might be solvable by using not just one <AP> but multiple, and using
DNS to distribute the load.

Thoughts ?

cheers,
andrew

From frnkblk at iname.com  Fri May 14 03:47:12 2010
From: frnkblk at iname.com (Frank Bulk)
Date: Thu, 13 May 2010 20:47:12 -0500
Subject: How does one obtain an IPv6 DNS server when VPNing to an ASA?
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAClcoInqmrNTZWmk2hrE6RJAQAAAAA=@iname.com>

How does one go about obtaining an IPv6 DNS server when VPNing to an ASA?
I've read the configuration docs, played with the CLI, and googled around,
and there seems to be no way to set up stateless DHCPv6 on an ASA to hand
out a DNS server, or domain name, for that matter.

Frank


From frnkblk at iname.com  Fri May 14 03:47:34 2010
From: frnkblk at iname.com (Frank Bulk)
Date: Thu, 13 May 2010 20:47:34 -0500
Subject: How does one obtain an IPv6 DNS server when VPNing to an ASA?
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAClcoInqmrNTZWmk2hrE6RJAQAAAAA=@iname.com>

How does one go about obtaining an IPv6 DNS server when VPNing to an ASA?
I've read the configuration docs, played with the CLI, and googled around,
and there seems to be no way to set up stateless DHCPv6 on an ASA to hand
out a DNS server, or domain name, for that matter.

Frank



From shane at time-travellers.org  Fri May 14 06:59:46 2010
From: shane at time-travellers.org (Shane Kerr)
Date: Fri, 14 May 2010 12:59:46 +0800
Subject: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAClcoInqmrNTZWmk2hrE6RJAQAAAAA=@iname.com>
References: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAClcoInqmrNTZWmk2hrE6RJAQAAAAA=@iname.com>
Message-ID: <1273813186.14998.8476.camel@shane-asus-laptop>

Frank,

On Thu, 2010-05-13 at 20:47 -0500, Frank Bulk wrote:
> How does one go about obtaining an IPv6 DNS server when VPNing to an ASA?
> I've read the configuration docs, played with the CLI, and googled around,
> and there seems to be no way to set up stateless DHCPv6 on an ASA to hand
> out a DNS server, or domain name, for that matter.

Sorry if this is a stupid question, but what is an ASA?

--
Shane


From s.ewing at aussiehq.com.au  Fri May 14 07:02:14 2010
From: s.ewing at aussiehq.com.au (Shaun Ewing)
Date: Fri, 14 May 2010 15:02:14 +1000
Subject: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <1273813186.14998.8476.camel@shane-asus-laptop>
Message-ID: <C8131676.1B1D9%s.ewing@aussiehq.com.au>


On 14/05/10 2:59 PM, "Shane Kerr" <shane at time-travellers.org> wrote:

> Sorry if this is a stupid question, but what is an ASA?

Cisco ASA - adaptive security appliance, ie: firewall.

Can't help Frank though. We have a lot of ASAs, but they're all in HA - and
anybody who has tried to do IPv6 on them knows (or should know) that IPv6
support is presently non-existent when in a HA config.

-Shaun
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3285 bytes
Desc: not available
Url : http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100514/2cd8416c/attachment.bin 

From merike at doubleshotsecurity.com  Fri May 14 07:06:11 2010
From: merike at doubleshotsecurity.com (Merike Kaeo)
Date: Thu, 13 May 2010 22:06:11 -0700
Subject: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <1273813186.14998.8476.camel@shane-asus-laptop>
References: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAAClcoInqmrNTZWmk2hrE6RJAQAAAAA=@iname.com>
	<1273813186.14998.8476.camel@shane-asus-laptop>
Message-ID: <ED46AF82-FCE3-43FD-B28D-1A1128A0A067@doubleshotsecurity.com>

Cisco Firewall appliance........don't worry, with all these acronyms  
flying around everywhere it's hard to keep up with all of them :)

haven't played with one for a while so sorry, no help to give on the  
actual DNS question...

- merike

On May 13, 2010, at 9:59 PM, Shane Kerr wrote:

> Frank,
>
> On Thu, 2010-05-13 at 20:47 -0500, Frank Bulk wrote:
>> How does one go about obtaining an IPv6 DNS server when VPNing to  
>> an ASA?
>> I've read the configuration docs, played with the CLI, and googled  
>> around,
>> and there seems to be no way to set up stateless DHCPv6 on an ASA  
>> to hand
>> out a DNS server, or domain name, for that matter.
>
> Sorry if this is a stupid question, but what is an ASA?
>
> --
> Shane
>


From frnkblk at iname.com  Fri May 14 07:11:29 2010
From: frnkblk at iname.com (Frank Bulk)
Date: Fri, 14 May 2010 00:11:29 -0500
Subject: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <C8131676.1B1D9%s.ewing@aussiehq.com.au>
References: <1273813186.14998.8476.camel@shane-asus-laptop>
	<C8131676.1B1D9%s.ewing@aussiehq.com.au>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABN1Vzy0JMPT57tl6Hh9eiCAQAAAAA=@iname.com>

I don't believe that's the case in a 8.2.x, look for "IPv6 Support in
Failover Configurations" in the following:
http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.htm
l#wp337399

Frank

-----Original Message-----
From: Shaun Ewing [mailto:s.ewing at aussiehq.com.au] 
Sent: Friday, May 14, 2010 12:02 AM
To: Shane Kerr; frnkblk at iname.com
Cc: ipv6-ops at lists.cluenet.de
Subject: Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?

<snip>

We have a lot of ASAs, but they're all in HA - and
anybody who has tried to do IPv6 on them knows (or should know) that IPv6
support is presently non-existent when in a HA config.

-Shaun


From ben at bjencks.net  Fri May 14 07:53:04 2010
From: ben at bjencks.net (Ben Jencks)
Date: Fri, 14 May 2010 01:53:04 -0400
Subject: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABN1Vzy0JMPT57tl6Hh9eiCAQAAAAA=@iname.com>
References: <1273813186.14998.8476.camel@shane-asus-laptop>
	<C8131676.1B1D9%s.ewing@aussiehq.com.au>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABN1Vzy0JMPT57tl6Hh9eiCAQAAAAA=@iname.com>
Message-ID: <AANLkTilqI94T9ILkGqStp3Nw2xa-oxHI_GHU3ZQjoH2e@mail.gmail.com>

It's officially supported in 8.2.x, but there's apparently a nasty bug
in at least the early versions where the "inactive" appliance still
sends RAs despite not forwarding traffic. Be careful and test
carefully. (I didn't experience this bug, we're still on 8.0, but I
know someone who did)

WRT the original question: I assume you're using AnyConnect? If so, I
can't help you, but if you've managed to get anything IPv6 to work
with IPsec on the ASA, I'd like to hear about it.

-Ben

On Fri, May 14, 2010 at 01:11, Frank Bulk <frnkblk at iname.com> wrote:
> I don't believe that's the case in a 8.2.x, look for "IPv6 Support in
> Failover Configurations" in the following:
> http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.htm
> l#wp337399
>
> Frank
>
> -----Original Message-----
> From: Shaun Ewing [mailto:s.ewing at aussiehq.com.au]
> Sent: Friday, May 14, 2010 12:02 AM
> To: Shane Kerr; frnkblk at iname.com
> Cc: ipv6-ops at lists.cluenet.de
> Subject: Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
>
> <snip>
>
> We have a lot of ASAs, but they're all in HA - and
> anybody who has tried to do IPv6 on them knows (or should know) that IPv6
> support is presently non-existent when in a HA config.
>
> -Shaun
>
>

From frnkblk at iname.com  Fri May 14 07:58:35 2010
From: frnkblk at iname.com (Frank Bulk)
Date: Fri, 14 May 2010 00:58:35 -0500
Subject: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <AANLkTilqI94T9ILkGqStp3Nw2xa-oxHI_GHU3ZQjoH2e@mail.gmail.com>
References: <1273813186.14998.8476.camel@shane-asus-laptop>	
	<C8131676.1B1D9%s.ewing@aussiehq.com.au>	
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABN1Vzy0JMPT57tl6Hh9eiCAQAAAAA=@iname.com>
	<AANLkTilqI94T9ILkGqStp3Nw2xa-oxHI_GHU3ZQjoH2e@mail.gmail.com>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAADCZjbjds4JSZWarycMQe2iAQAAAAA=@iname.com>

Thanks for the warning regarding HA with IPv6 on the 8.2

It took me a few hours to figure out it, so hopefully these code snippets help:

interface Vlan1
 nameif outside
 security-level 0
 ip address a.b.c.d 255.255.255.0
 ipv6 address 2607:fe28:11:1000::1/64
 ipv6 enable
 ipv6 nd prefix default no-advertise
!
interface Vlan2
 nameif inside
 security-level 100
 ip address e.f.g.h 255.255.255.0
 ipv6 address 2607:fe28:11:1001::2/64
 ipv6 enable
 ipv6 nd prefix default no-advertise
!

ipv6 icmp permit any outside
ipv6 icmp permit any inside
ipv6 local pool dvpn-ipv6-pool 2607:fe28:11:1001::5/64 100
ipv6 route inside 2607:fe28:11:4000::/50 2607:fe28:11:1001::1
ipv6 route outside ::/0 2607:fe28:11:1000::2
ipv6 access-list outside_access_in_ipv6 permit icmp6 any any

access-group outside_access_in_ipv6 in interface outside

tunnel-group premier_sslvpn general-attributes
 address-pool dvpn_pool
 ipv6-address-pool dvpn-ipv6-pool
 authentication-server-group RADIUS LOCAL
 default-group-policy premier_sslvpn

Frank

-----Original Message-----
From: Ben Jencks [mailto:ben at bjencks.net] 
Sent: Friday, May 14, 2010 12:53 AM
To: frnkblk at iname.com
Cc: Shaun Ewing; Shane Kerr; ipv6-ops at lists.cluenet.de
Subject: Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?

It's officially supported in 8.2.x, but there's apparently a nasty bug
in at least the early versions where the "inactive" appliance still
sends RAs despite not forwarding traffic. Be careful and test
carefully. (I didn't experience this bug, we're still on 8.0, but I
know someone who did)

WRT the original question: I assume you're using AnyConnect? If so, I
can't help you, but if you've managed to get anything IPv6 to work
with IPsec on the ASA, I'd like to hear about it.

-Ben

On Fri, May 14, 2010 at 01:11, Frank Bulk <frnkblk at iname.com> wrote:
> I don't believe that's the case in a 8.2.x, look for "IPv6 Support in
> Failover Configurations" in the following:
> http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.htm
> l#wp337399
>
> Frank
>
> -----Original Message-----
> From: Shaun Ewing [mailto:s.ewing at aussiehq.com.au]
> Sent: Friday, May 14, 2010 12:02 AM
> To: Shane Kerr; frnkblk at iname.com
> Cc: ipv6-ops at lists.cluenet.de
> Subject: Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
>
> <snip>
>
> We have a lot of ASAs, but they're all in HA - and
> anybody who has tried to do IPv6 on them knows (or should know) that IPv6
> support is presently non-existent when in a HA config.
>
> -Shaun
>
>


From ayourtch at gmail.com  Fri May 14 10:53:16 2010
From: ayourtch at gmail.com (Andrew Yourtchenko)
Date: Fri, 14 May 2010 10:53:16 +0200
Subject: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <AANLkTilqI94T9ILkGqStp3Nw2xa-oxHI_GHU3ZQjoH2e@mail.gmail.com>
References: <1273813186.14998.8476.camel@shane-asus-laptop>
	<C8131676.1B1D9%s.ewing@aussiehq.com.au>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABN1Vzy0JMPT57tl6Hh9eiCAQAAAAA=@iname.com>
	<AANLkTilqI94T9ILkGqStp3Nw2xa-oxHI_GHU3ZQjoH2e@mail.gmail.com>
Message-ID: <AANLkTimVN2X2FVx2s3G2h5-gTDej2lMKn1VScvUkelTS@mail.gmail.com>

On Fri, May 14, 2010 at 7:53 AM, Ben Jencks <ben at bjencks.net> wrote:
> It's officially supported in 8.2.x, but there's apparently a nasty bug
> in at least the early versions where the "inactive" appliance still
> sends RAs despite not forwarding traffic. Be careful and test
> carefully. (I didn't experience this bug, we're still on 8.0, but I
> know someone who did)

That bug was before 8.2.2 - where it started to be "officially"
supported (because of the necessary changes to the infrastructure that
alleviated this behaviour. It was more than just a bugfix, yes -
starting from 8.2.2 the stateful failover is possible)

I did test it in 8.2.2, it worked all right. Don't use anything earlier.

As for the original question - no; there's no DHCPv6.

>From the config - since you give out both IPv4 and IPv6 - just
dual-stack the recursive DNS server, and use IPv4 towards the clients
?

Or you plan to get rid of IPv4 completely for those clients ?

cheers,
andrew

>
> WRT the original question: I assume you're using AnyConnect? If so, I
> can't help you, but if you've managed to get anything IPv6 to work
> with IPsec on the ASA, I'd like to hear about it.
>
> -Ben
>
> On Fri, May 14, 2010 at 01:11, Frank Bulk <frnkblk at iname.com> wrote:
>> I don't believe that's the case in a 8.2.x, look for "IPv6 Support in
>> Failover Configurations" in the following:
>> http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.htm
>> l#wp337399
>>
>> Frank
>>
>> -----Original Message-----
>> From: Shaun Ewing [mailto:s.ewing at aussiehq.com.au]
>> Sent: Friday, May 14, 2010 12:02 AM
>> To: Shane Kerr; frnkblk at iname.com
>> Cc: ipv6-ops at lists.cluenet.de
>> Subject: Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
>>
>> <snip>
>>
>> We have a lot of ASAs, but they're all in HA - and
>> anybody who has tried to do IPv6 on them knows (or should know) that IPv6
>> support is presently non-existent when in a HA config.
>>
>> -Shaun
>>
>>
>

From evyncke at cisco.com  Fri May 14 12:12:28 2010
From: evyncke at cisco.com (Eric Vyncke (evyncke))
Date: Fri, 14 May 2010 12:12:28 +0200
Subject: Imagine #2 (musings on the topic of proxies)
In-Reply-To: <AANLkTinH34CC45ayBZng25bLLCJOlQmbfKCC7qB3WC2T@mail.gmail.com>
References: <AANLkTinH34CC45ayBZng25bLLCJOlQmbfKCC7qB3WC2T@mail.gmail.com>
Message-ID: <317616CE96204D49B5A1811098BA895001EF7B8D@XMB-AMS-110.cisco.com>

Andrew

The addition of anycast to a known & proven approach of the reverse proxy, is a nice addition.

I would be a little worried about having a anycast server for a stateful service though (just a feeling, no data point. 

Less concern about your other points.

-?ric

> -----Original Message-----
> From: ipv6-ops-bounces+evyncke=cisco.com at lists.cluenet.de [mailto:ipv6-ops-
> bounces+evyncke=cisco.com at lists.cluenet.de] On Behalf Of Andrew Yourtchenko
> Sent: jeudi 13 mai 2010 23:59
> To: ipv6-ops at lists.cluenet.de
> Subject: Imagine #2 (musings on the topic of proxies)
> 
> Folks,
> 
> Yesterday I had this odd idea, which today due to the bank holiday in
> Belgium and the unsunny weather resulted in something very very
> experimental that you can toy around with
> (http://github.com/ayourtch/sxxis - I flipped the name of a wonderful
> service that is typically used in reverse way), and I thought to ask
> what's your opinion:
> 
> The use case scenario of it is as follows:
> 
> 1) Joe Sixpack hosts hosts the website www.foobar.example.com at
> FooHosters. He would like to experiment with making it available via
> IPv6, but FooHosters do not provide the IPv6 yet.
> 
> 2) The progressive thinkers of this world have installed a bunch of L7
> proxies, that listen on IPv6 and can go back to IPv4 world (that's the
> sxxis toy in the git url above).
> 
> 3) These proxies are listening on the same IPv6 address, which is
> anycasted similar to 6to4 one into the internet.Let's call this
> address <AP>
> 
> 4) Joe Sixpack creates a DNS record which points the
> ipv6.foobar.example.com towards <AP>, and
> real-target.ipv6.foobar.example.com which points to the address as
> www.foobar.example.com [ alternatlively, ipv6.foobar.example.com can
> also have an A-record that points to the real host]
> 
> 5) the users around the world, when they point their browser
> ipv6.foobar.example.com, would normally hit their closest proxy -
> therefore the impact of the two-legged topology is decreased.
> 
> The second use case is the one from the "Imagine" thread - put this
> kind of device onto an IPv6-only network and give it an IPv4 address,
> and mangle all the empty AAAA responses from the internet into the
> ones that point to the proxy. Everything besides the HTTP will be
> indeed broken, but this would be better than everything *and* HTTP
> broken...
> 
> Of course all of this has its problems:
> 
> 1) Same story as open proxies that allow CONNECT, this is quite a bit
> of a pain from the security/auditing point of view. How big of a pain
> is it ?
> Does the logging help solve it ?
> 
> 2) TCP with anycast address is, yes, thoroughly impure from the
> theoretical standpoint - however, my understanding is in practice i'd
> be hitting the same physical box at least on a 5 minute interval.
> Which is almost enough from the practical point of view.
> 
> 3) Heavy - maintaining 2 TCP states per one client connection. This
> might be solvable by using not just one <AP> but multiple, and using
> DNS to distribute the load.
> 
> Thoughts ?
> 
> cheers,
> andrew

From gert at space.net  Fri May 14 13:02:51 2010
From: gert at space.net (Gert Doering)
Date: Fri, 14 May 2010 13:02:51 +0200
Subject: Imagine #2 (musings on the topic of proxies)
In-Reply-To: <AANLkTinH34CC45ayBZng25bLLCJOlQmbfKCC7qB3WC2T@mail.gmail.com>
References: <AANLkTinH34CC45ayBZng25bLLCJOlQmbfKCC7qB3WC2T@mail.gmail.com>
Message-ID: <20100514110251.GG60850@Space.Net>

Hi,

On Thu, May 13, 2010 at 11:59:11PM +0200, Andrew Yourtchenko wrote:
> 1) Joe Sixpack hosts hosts the website www.foobar.example.com at
> FooHosters. He would like to experiment with making it available via
> IPv6, but FooHosters do not provide the IPv6 yet.

I'm actually a bit sceptical about the political message of something
like this.  It sends the message to FooHosters "well, you don't need
to bother with IPv6, we'll work around your lazyness".

I think the right message to send to FooHosters is "either you provide
IPv6 to my server in the next 6 weeks, or I move to BarHosters, who
already have IPv6 in their product offerings!"

Much better political message, and much less trying to fix broken business
processes with technical measures (inevitably leading to broken business
processes *and* broken networks).

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  150584

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

From jeroen at unfix.org  Fri May 14 13:25:34 2010
From: jeroen at unfix.org (Jeroen Massar)
Date: Fri, 14 May 2010 13:25:34 +0200
Subject: Imagine #2 (musings on the topic of proxies)
In-Reply-To: <20100514110251.GG60850@Space.Net>
References: <AANLkTinH34CC45ayBZng25bLLCJOlQmbfKCC7qB3WC2T@mail.gmail.com>
	<20100514110251.GG60850@Space.Net>
Message-ID: <4BED332E.3090500@unfix.org>

On 2010-05-14 13:02, Gert Doering wrote:
> Hi,
>
> On Thu, May 13, 2010 at 11:59:11PM +0200, Andrew Yourtchenko wrote:
>> 1) Joe Sixpack hosts hosts the website www.foobar.example.com at
>> FooHosters. He would like to experiment with making it available via
>> IPv6, but FooHosters do not provide the IPv6 yet.
>
> I'm actually a bit sceptical about the political message of something
> like this.  It sends the message to FooHosters "well, you don't need
> to bother with IPv6, we'll work around your lazyness".
>
> I think the right message to send to FooHosters is "either you provide
> IPv6 to my server in the next 6 weeks, or I move to BarHosters, who
> already have IPv6 in their product offerings!"
>
> Much better political message, and much less trying to fix broken business
> processes with technical measures (inevitably leading to broken business
> processes *and* broken networks).

I agree. Heck for that matter, which might sounds strange coming from 
me, but I am against folks setting up tunnels to their hosted machines 
and then putting their website etc online that way.

Yes, it solves the problem that you want to experiment with IPv6 at the 
moment, but unless you annoy the ISP you are really hosting at regularly 
they will not be moving to get you IPv6 service any time soon.

Also, as Gert mentions, depending on external hosts for your 
connectivity is a rather bad idea, which is so for tunnels to a static 
host, but more in the case of anycast, as you do not know who is going 
to be sitting at the end of the tunnel and if they can resolve things, 
heck if you can contact them. At least in the case of non-anycasted 
endpoints you know who to contact for any problems it might give.

Thus: keep on complaining to your el-cheapo hosters and move to another 
if you really want, voting with your money is the way to go.

Greets,
  Jeroen


From marcoh at marcoh.net  Fri May 14 13:53:04 2010
From: marcoh at marcoh.net (Marco Hogewoning)
Date: Fri, 14 May 2010 13:53:04 +0200
Subject: Imagine #2 (musings on the topic of proxies)
In-Reply-To: <4BED332E.3090500@unfix.org>
References: <AANLkTinH34CC45ayBZng25bLLCJOlQmbfKCC7qB3WC2T@mail.gmail.com>
	<20100514110251.GG60850@Space.Net> <4BED332E.3090500@unfix.org>
Message-ID: <A289BEA8-F6F3-4A7C-9984-A92C84840B6A@marcoh.net>

> Thus: keep on complaining to your el-cheapo hosters and move to another if you really want, voting with your money is the way to go.


Hear hear!! (Tell my sales ppl :)

MarcoH


From frnkblk at iname.com  Fri May 14 14:33:40 2010
From: frnkblk at iname.com (Frank Bulk)
Date: Fri, 14 May 2010 07:33:40 -0500
Subject: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <AANLkTimVN2X2FVx2s3G2h5-gTDej2lMKn1VScvUkelTS@mail.gmail.com>
References: <1273813186.14998.8476.camel@shane-asus-laptop>	
	<C8131676.1B1D9%s.ewing@aussiehq.com.au>	
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABN1Vzy0JMPT57tl6Hh9eiCAQAAAAA=@iname.com>	
	<AANLkTilqI94T9ILkGqStp3Nw2xa-oxHI_GHU3ZQjoH2e@mail.gmail.com>
	<AANLkTimVN2X2FVx2s3G2h5-gTDej2lMKn1VScvUkelTS@mail.gmail.com>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABoh5VD8VypSLqcY/KCKOCvAQAAAAA=@iname.com>

No, I don't plan to get rid of our IPv4 DNS server, but if it's not there,
it's a gap in a full feature set.

I will open a TAC case on this.

Frank

-----Original Message-----
From: Andrew Yourtchenko [mailto:ayourtch at gmail.com] 
Sent: Friday, May 14, 2010 3:53 AM
To: Ben Jencks
Cc: frnkblk at iname.com; Shaun Ewing; Shane Kerr; ipv6-ops at lists.cluenet.de
Subject: Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?

<snip>

>From the config - since you give out both IPv4 and IPv6 - just
dual-stack the recursive DNS server, and use IPv4 towards the clients
?

Or you plan to get rid of IPv4 completely for those clients ?

cheers,
andrew


From ayourtch at gmail.com  Fri May 14 21:35:42 2010
From: ayourtch at gmail.com (Andrew Yourtchenko)
Date: Fri, 14 May 2010 21:35:42 +0200
Subject: Imagine #2 (musings on the topic of proxies)
In-Reply-To: <A289BEA8-F6F3-4A7C-9984-A92C84840B6A@marcoh.net>
References: <AANLkTinH34CC45ayBZng25bLLCJOlQmbfKCC7qB3WC2T@mail.gmail.com>
	<20100514110251.GG60850@Space.Net> <4BED332E.3090500@unfix.org>
	<A289BEA8-F6F3-4A7C-9984-A92C84840B6A@marcoh.net>
Message-ID: <AANLkTin_QGnypE_Ml0sG2473eM2Wm3sKe4mn0SOwqyZ-@mail.gmail.com>

On Fri, May 14, 2010 at 1:53 PM, Marco Hogewoning <marcoh at marcoh.net> wrote:
>> Thus: keep on complaining to your el-cheapo hosters and move to another if you really want, voting with your money is the way to go.
>
> Hear hear!! (Tell my sales ppl :)
>

Maybe point them to http://www.fix6.net/ipv6-webhosting/  (or maybe
there are other lists of IPv6-capable hosters?)

I switched the hoster in the past 6 months because they were
v6-ignorant; and switched the access ISP, because the one I switched
to has promised the v6 beta sometime this year, and the other one
(whom I left) was dragging their feet. (Of course, being an early
adopter, I am only a leading indicator...)

Meantime thanks to SixXS & HE I get very reasonable ipv6 with tunnels.

Eric/Jeroen/Gert: thanks a lot for the comments, by majority vote case
closed I think.

cheers,
andrew

From bmanning at vacation.karoshi.com  Sat May 15 02:35:56 2010
From: bmanning at vacation.karoshi.com (bmanning at vacation.karoshi.com)
Date: Sat, 15 May 2010 00:35:56 +0000
Subject: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <AANLkTimVN2X2FVx2s3G2h5-gTDej2lMKn1VScvUkelTS@mail.gmail.com>
References: <1273813186.14998.8476.camel@shane-asus-laptop>
	<C8131676.1B1D9%s.ewing@aussiehq.com.au>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABN1Vzy0JMPT57tl6Hh9eiCAQAAAAA=@iname.com>
	<AANLkTilqI94T9ILkGqStp3Nw2xa-oxHI_GHU3ZQjoH2e@mail.gmail.com>
	<AANLkTimVN2X2FVx2s3G2h5-gTDej2lMKn1VScvUkelTS@mail.gmail.com>
Message-ID: <20100515003556.GA4206@vacation.karoshi.com.>

 many months ago, I asked for this DHCP feature to be supported in
the IPv6 varient and was told that the IETF refused - hence ISC didn't build
it into their product.  Phaugh on them - its open source!  So I built a
server and client that talk IPv6 and support the usual/customary DHCP
options over IPv6...  it has the unfortunate side effect of not being compatable
with other DHCP servers or clients but does the job for me and my little 
piece of hell.  Should work anywhere DHCPv4 does though.

--bill


On Fri, May 14, 2010 at 10:53:16AM +0200, Andrew Yourtchenko wrote:
> On Fri, May 14, 2010 at 7:53 AM, Ben Jencks <ben at bjencks.net> wrote:
> > It's officially supported in 8.2.x, but there's apparently a nasty bug
> > in at least the early versions where the "inactive" appliance still
> > sends RAs despite not forwarding traffic. Be careful and test
> > carefully. (I didn't experience this bug, we're still on 8.0, but I
> > know someone who did)
> 
> That bug was before 8.2.2 - where it started to be "officially"
> supported (because of the necessary changes to the infrastructure that
> alleviated this behaviour. It was more than just a bugfix, yes -
> starting from 8.2.2 the stateful failover is possible)
> 
> I did test it in 8.2.2, it worked all right. Don't use anything earlier.
> 
> As for the original question - no; there's no DHCPv6.
> 
> >From the config - since you give out both IPv4 and IPv6 - just
> dual-stack the recursive DNS server, and use IPv4 towards the clients
> ?
> 
> Or you plan to get rid of IPv4 completely for those clients ?
> 
> cheers,
> andrew
> 
> >
> > WRT the original question: I assume you're using AnyConnect? If so, I
> > can't help you, but if you've managed to get anything IPv6 to work
> > with IPsec on the ASA, I'd like to hear about it.
> >
> > -Ben
> >
> > On Fri, May 14, 2010 at 01:11, Frank Bulk <frnkblk at iname.com> wrote:
> >> I don't believe that's the case in a 8.2.x, look for "IPv6 Support in
> >> Failover Configurations" in the following:
> >> http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.htm
> >> l#wp337399
> >>
> >> Frank
> >>
> >> -----Original Message-----
> >> From: Shaun Ewing [mailto:s.ewing at aussiehq.com.au]
> >> Sent: Friday, May 14, 2010 12:02 AM
> >> To: Shane Kerr; frnkblk at iname.com
> >> Cc: ipv6-ops at lists.cluenet.de
> >> Subject: Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
> >>
> >> <snip>
> >>
> >> We have a lot of ASAs, but they're all in HA - and
> >> anybody who has tried to do IPv6 on them knows (or should know) that IPv6
> >> support is presently non-existent when in a HA config.
> >>
> >> -Shaun
> >>
> >>
> >

From nanog at 85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org  Sat May 15 02:54:12 2010
From: nanog at 85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org (Mark Smith)
Date: Sat, 15 May 2010 10:24:12 +0930
Subject: Imagine #2 (musings on the topic of proxies)
In-Reply-To: <AANLkTinH34CC45ayBZng25bLLCJOlQmbfKCC7qB3WC2T@mail.gmail.com>
References: <AANLkTinH34CC45ayBZng25bLLCJOlQmbfKCC7qB3WC2T@mail.gmail.com>
Message-ID: <20100515102412.331dfd83@opy.nosense.org>

On Thu, 13 May 2010 23:59:11 +0200
Andrew Yourtchenko <ayourtch at gmail.com> wrote:

> Folks,
> 
> Yesterday I had this odd idea, which today due to the bank holiday in
> Belgium and the unsunny weather resulted in something very very
> experimental that you can toy around with
> (http://github.com/ayourtch/sxxis - I flipped the name of a wonderful
> service that is typically used in reverse way), and I thought to ask
> what's your opinion:
> 
> The use case scenario of it is as follows:
> 
> 1) Joe Sixpack hosts hosts the website www.foobar.example.com at
> FooHosters. He would like to experiment with making it available via
> IPv6, but FooHosters do not provide the IPv6 yet.
> 
> 2) The progressive thinkers of this world have installed a bunch of L7
> proxies, that listen on IPv6 and can go back to IPv4 world (that's the
> sxxis toy in the git url above).
> 
> 3) These proxies are listening on the same IPv6 address, which is
> anycasted similar to 6to4 one into the internet.Let's call this
> address <AP>
> 
> 4) Joe Sixpack creates a DNS record which points the
> ipv6.foobar.example.com towards <AP>, and
> real-target.ipv6.foobar.example.com which points to the address as
> www.foobar.example.com [ alternatlively, ipv6.foobar.example.com can
> also have an A-record that points to the real host]
> 
> 5) the users around the world, when they point their browser
> ipv6.foobar.example.com, would normally hit their closest proxy -
> therefore the impact of the two-legged topology is decreased.
> 
> The second use case is the one from the "Imagine" thread - put this
> kind of device onto an IPv6-only network and give it an IPv4 address,
> and mangle all the empty AAAA responses from the internet into the
> ones that point to the proxy. Everything besides the HTTP will be
> indeed broken, but this would be better than everything *and* HTTP
> broken...
> 
> Of course all of this has its problems:
> 
> 1) Same story as open proxies that allow CONNECT, this is quite a bit
> of a pain from the security/auditing point of view. How big of a pain
> is it ?
> Does the logging help solve it ?
> 
> 2) TCP with anycast address is, yes, thoroughly impure from the
> theoretical standpoint - however, my understanding is in practice i'd
> be hitting the same physical box at least on a 5 minute interval.
> Which is almost enough from the practical point of view.
> 
> 3) Heavy - maintaining 2 TCP states per one client connection. This
> might be solvable by using not just one <AP> but multiple, and using
> DNS to distribute the load.
> 
> Thoughts ?
> 

I think fundamentally what that is doing is shifting the IPv6
deployment costs onto the IPv6 proxy provider, away from the cheap
hoster. While IPv6 traffic load is negligible enough, some people are
willing to wear that cost. However, there is a threshold where the
costs will become too high and they'll switch off their IPv6 proxy
service, resulting in the website now not being available over IPv6. I
think that ultimately would defeat the primary motivation of this idea,
which is to make IPv4 content available over IPv6. We want IPv6 websites
to continue to be available, not available for a short time until they
become popular, and then disappear because of that popularity.

I find what I'm about to suggest quite distasteful, although there
might be a saving grace at the end of it.

To cover the IPv6 costs, and even make a profit, the IPv6 proxy
service could intercept the requests and insert/replace advertising in
them.

However, here might be the saving grace. At the end of the week/month
etc., the IPv6 proxy service sends an email to the cheap IPv4 only
host/website, saying "we made this much money off of you not supporting
IPv6". ... I'm sure people can work out what will rapidly happen
next ;-)


Regards,
Mark.




> cheers,
> andrew

From ayourtch at gmail.com  Sat May 15 04:20:43 2010
From: ayourtch at gmail.com (Andrew Yourtchenko)
Date: Sat, 15 May 2010 04:20:43 +0200
Subject: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100515003556.GA4206@vacation.karoshi.com.>
References: <1273813186.14998.8476.camel@shane-asus-laptop>
	<C8131676.1B1D9%s.ewing@aussiehq.com.au>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABN1Vzy0JMPT57tl6Hh9eiCAQAAAAA=@iname.com>
	<AANLkTilqI94T9ILkGqStp3Nw2xa-oxHI_GHU3ZQjoH2e@mail.gmail.com>
	<AANLkTimVN2X2FVx2s3G2h5-gTDej2lMKn1VScvUkelTS@mail.gmail.com>
	<20100515003556.GA4206@vacation.karoshi.com.>
Message-ID: <AANLkTilPlTcaGrW5EDMoWPQS9YO-eBVTtyTKHJzPWUen@mail.gmail.com>

On Sat, May 15, 2010 at 2:35 AM,  <bmanning at vacation.karoshi.com> wrote:
> ?many months ago, I asked for this DHCP feature to be supported in
> the IPv6 varient and was told that the IETF refused - hence ISC didn't build
> it into their product. ?Phaugh on them - its open source! ?So I built a
> server and client that talk IPv6 and support the usual/customary DHCP
> options over IPv6... ?it has the unfortunate side effect of not being compatable
> with other DHCP servers or clients but does the job for me and my little
> piece of hell. ?Should work anywhere DHCPv4 does though.

wget $ISC_TARBALL_URL
git init
git add .
git commit -m "initial commit"
[edit the files to add the magic]
git commit -m "cool things added"
[...add a repo on github...]
git remote add origin git at github.com:bmanning/mydhcpstuff.git
git push origin master

and post the url to the repo. Or something like that ?

Or is it too specific to your setup/$(L9_issues) to post it ?

cheers,
andrew

>
> --bill
>
>
> On Fri, May 14, 2010 at 10:53:16AM +0200, Andrew Yourtchenko wrote:
>> On Fri, May 14, 2010 at 7:53 AM, Ben Jencks <ben at bjencks.net> wrote:
>> > It's officially supported in 8.2.x, but there's apparently a nasty bug
>> > in at least the early versions where the "inactive" appliance still
>> > sends RAs despite not forwarding traffic. Be careful and test
>> > carefully. (I didn't experience this bug, we're still on 8.0, but I
>> > know someone who did)
>>
>> That bug was before 8.2.2 - where it started to be "officially"
>> supported (because of the necessary changes to the infrastructure that
>> alleviated this behaviour. It was more than just a bugfix, yes -
>> starting from 8.2.2 the stateful failover is possible)
>>
>> I did test it in 8.2.2, it worked all right. Don't use anything earlier.
>>
>> As for the original question - no; there's no DHCPv6.
>>
>> >From the config - since you give out both IPv4 and IPv6 - just
>> dual-stack the recursive DNS server, and use IPv4 towards the clients
>> ?
>>
>> Or you plan to get rid of IPv4 completely for those clients ?
>>
>> cheers,
>> andrew
>>
>> >
>> > WRT the original question: I assume you're using AnyConnect? If so, I
>> > can't help you, but if you've managed to get anything IPv6 to work
>> > with IPsec on the ASA, I'd like to hear about it.
>> >
>> > -Ben
>> >
>> > On Fri, May 14, 2010 at 01:11, Frank Bulk <frnkblk at iname.com> wrote:
>> >> I don't believe that's the case in a 8.2.x, look for "IPv6 Support in
>> >> Failover Configurations" in the following:
>> >> http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.htm
>> >> l#wp337399
>> >>
>> >> Frank
>> >>
>> >> -----Original Message-----
>> >> From: Shaun Ewing [mailto:s.ewing at aussiehq.com.au]
>> >> Sent: Friday, May 14, 2010 12:02 AM
>> >> To: Shane Kerr; frnkblk at iname.com
>> >> Cc: ipv6-ops at lists.cluenet.de
>> >> Subject: Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
>> >>
>> >> <snip>
>> >>
>> >> We have a lot of ASAs, but they're all in HA - and
>> >> anybody who has tried to do IPv6 on them knows (or should know) that IPv6
>> >> support is presently non-existent when in a HA config.
>> >>
>> >> -Shaun
>> >>
>> >>
>> >
>

From gert at space.net  Sat May 15 10:59:29 2010
From: gert at space.net (Gert Doering)
Date: Sat, 15 May 2010 10:59:29 +0200
Subject: Imagine #2 (musings on the topic of proxies)
In-Reply-To: <20100515102412.331dfd83@opy.nosense.org>
References: <AANLkTinH34CC45ayBZng25bLLCJOlQmbfKCC7qB3WC2T@mail.gmail.com>
	<20100515102412.331dfd83@opy.nosense.org>
Message-ID: <20100515085929.GR60850@Space.Net>

Hi,

On Sat, May 15, 2010 at 10:24:12AM +0930, Mark Smith wrote:
> I'm sure people can work out what will rapidly happen next ;-)

Lawsuits?  *duck*

gert
-- 
Total number of prefixes smaller than registry allocations:  150584

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

From andy at nosignal.org  Sun May 16 22:12:17 2010
From: andy at nosignal.org (Andy Davidson)
Date: Sun, 16 May 2010 21:12:17 +0100
Subject: Cisco 1801W, v6 on wireless, bvi argh.
Message-ID: <24D585B4-F4CD-4CC6-AE98-46C1A3BEE4C7@nosignal.org>

Hi,

Please help me get ipv6 working on my Cisco 1801W test router.  I have working v6 on my wired vlan, but not wireless.

Cisco Bug CSCej50923
Symptom : BVI Routing does not work for IPV6 addressing.

This bug is marked 'fixed' as at February 2010, providing I use one of the fixed versions of IOS.  I installed 15.1(1)XB in February on my Cisco 1801, which is one of the ones which has this bug fixed, however I could not route IPv6 over the bridged/BVI interface.  I lost interest for a little while, earlier I installed 15.1(1)T, but v6 still does not work over the v6 interface.

By 'work', I mean pass v6 frames, act as a gateway, do ND, do router advertisement.

If the bug *is* fixed, then is it my config which is wrong, surely.. This is what I am doing - if someone has suggestions, I am all ears.  There are two attached methods :


=========================================================
Method 1 - BVI

ipv6 unicast-routing
ipv6 cef
ipv6 multicast-routing
!
bridge irb
!
interface Dot11Radio0
 description Wireless Network / vlan 2
 no ip address
 no ip redirects
 ip local-proxy-arp
 ip virtual-reassembly
 ip tcp adjust-mss 1400
 !
 encryption mode ciphers tkip 
 !
 encryption vlan 2 mode ciphers tkip 
 !
 ssid rustykettle
 !
 speed basic-1.0 basic-2.0 basic-5.5 basic-6.0 basic-9.0 basic-11.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0
 channel 2442
 station-role root
 world-mode dot11d country US indoor
 hold-queue 100 out
!
interface Dot11Radio0.2
 encapsulation dot1Q 2
 no ip redirects
 ip local-proxy-arp
 ip tcp adjust-mss 1400
 no cdp enable
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Vlan2
 description Wireless network VLAN
 no ip address
 ip pim sparse-dense-mode
 ip virtual-reassembly
 ip tcp adjust-mss 1400
 ip ospf 10 area 0
 ipv6 enable
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
!
interface BVI1
 ip vrf forwarding vrf_Tunnel
 ip address 91.194.69.65 255.255.255.192
 ip nat inside
 ip virtual-reassembly
 ip tcp adjust-mss 1400
 ipv6 address 2A02:C30:100:2::1/64
 ipv6 enable


Issue :  connected ipv6 route for 2a02:c30:100:2::/64 is not installed in the routing table.  devices on this lan do not discover the router via RA, router does not learn any neighbors in this subnet.


=========================================================

Method 2: Address on radio interface

As above, but ..

no int bvi1
interface Dot11Radio0.2
 no bridge-group 1
 ip address 91.194.69.65 255.255.255.192
 ip vrf forwarding vrf_Tunnel
 ipv6 address 2A02:C30:100:2::1/64
 ipv6 enable


Issue :  IPv4 configuration is accepted, and routes properly.  ipv6 config is not 'taken' by the router - it barfs at the 'v' on each of the ipv6 lines..

=========================================================

Any ideas ?

Kind regards, thanks and adoration in advance,
Andy

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100516/79a20967/attachment.html 

From nick-lists at netability.ie  Sun May 16 22:20:29 2010
From: nick-lists at netability.ie (Nick Hilliard)
Date: Sun, 16 May 2010 21:20:29 +0100
Subject: Cisco 1801W, v6 on wireless, bvi argh.
In-Reply-To: <24D585B4-F4CD-4CC6-AE98-46C1A3BEE4C7@nosignal.org>
References: <24D585B4-F4CD-4CC6-AE98-46C1A3BEE4C7@nosignal.org>
Message-ID: <4BF0538D.2000005@netability.ie>

On 16/05/2010 21:12, Andy Davidson wrote:
> By 'work', I mean pass v6 frames, act as a gateway, do ND, do router
> advertisement.
> 
> If the bug *is* fixed, then is it my config which is wrong, surely..
> This is what I am doing - if someone has suggestions, I am all ears.
>  There are two attached methods :

You didn't try 12.4(22)T, did you?  This bug was fixed in that version, and
I seem to remember some level of success with it when it came out.  I
wouldn't be surprised if it were broken in subsequent versions.

FWIW, I have my bvi100 interface wired up to F0.100 (obviously vlan100),
with ipv4 on the bvi interface and ipv6 on F0.100.  However, the radio is
currently disabled, as there is someone's head situated about 15-20cm away
from the antennae.  But I seem to remember some level of success.  Or was
that with another installation other than my office?  Eh. Mmmm. Can't remember.

Must poke at it again, even if it means giving my cow-orkers horrible
carcinomas.  I'm running 12.4(22)T1.

Nick

From shane at time-travellers.org  Mon May 17 04:38:52 2010
From: shane at time-travellers.org (Shane Kerr)
Date: Mon, 17 May 2010 10:38:52 +0800
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain an
	IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100515003556.GA4206@vacation.karoshi.com.>
References: <1273813186.14998.8476.camel@shane-asus-laptop>
	<C8131676.1B1D9%s.ewing@aussiehq.com.au>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABN1Vzy0JMPT57tl6Hh9eiCAQAAAAA=@iname.com>
	<AANLkTilqI94T9ILkGqStp3Nw2xa-oxHI_GHU3ZQjoH2e@mail.gmail.com>
	<AANLkTimVN2X2FVx2s3G2h5-gTDej2lMKn1VScvUkelTS@mail.gmail.com>
	<20100515003556.GA4206@vacation.karoshi.com.>
Message-ID: <1274063932.14998.22742.camel@shane-asus-laptop>

Bill,

It's not clear to me which DHCP feature you are referring to. Perhaps it
is the mix of interleaved style and top-posting, or maybe my ignorance
with Cisco technologies, but I honestly can't figure it out.

Please write it very clearly, in a non-funny way. Try to use a minimum
of acronyms (sort of the opposite of the first post in this thread).
Ideally sprinkle a few URLs explaining what you mean.

Even if we don't ultimately ship it in ISC DHCP, it is probably better
to define this as a dhcpd.conf/dhclient.conf recipe, perhaps using
vendor-specific options, rather than shipping custom code. But I can't
say since I don't know what you mean.

--
Shane

On Sat, 2010-05-15 at 00:35 +0000, bmanning at vacation.karoshi.com wrote:
> many months ago, I asked for this DHCP feature to be supported in
> the IPv6 varient and was told that the IETF refused - hence ISC didn't build
> it into their product.  Phaugh on them - its open source!  So I built a
> server and client that talk IPv6 and support the usual/customary DHCP
> options over IPv6...  it has the unfortunate side effect of not being compatable
> with other DHCP servers or clients but does the job for me and my little 
> piece of hell.  Should work anywhere DHCPv4 does though.
> 
> --bill
> 
> 
> On Fri, May 14, 2010 at 10:53:16AM +0200, Andrew Yourtchenko wrote:
> > On Fri, May 14, 2010 at 7:53 AM, Ben Jencks <ben at bjencks.net> wrote:
> > > It's officially supported in 8.2.x, but there's apparently a nasty bug
> > > in at least the early versions where the "inactive" appliance still
> > > sends RAs despite not forwarding traffic. Be careful and test
> > > carefully. (I didn't experience this bug, we're still on 8.0, but I
> > > know someone who did)
> > 
> > That bug was before 8.2.2 - where it started to be "officially"
> > supported (because of the necessary changes to the infrastructure that
> > alleviated this behaviour. It was more than just a bugfix, yes -
> > starting from 8.2.2 the stateful failover is possible)
> > 
> > I did test it in 8.2.2, it worked all right. Don't use anything earlier.
> > 
> > As for the original question - no; there's no DHCPv6.
> > 
> > >From the config - since you give out both IPv4 and IPv6 - just
> > dual-stack the recursive DNS server, and use IPv4 towards the clients
> > ?
> > 
> > Or you plan to get rid of IPv4 completely for those clients ?
> > 
> > cheers,
> > andrew
> > 
> > >
> > > WRT the original question: I assume you're using AnyConnect? If so, I
> > > can't help you, but if you've managed to get anything IPv6 to work
> > > with IPsec on the ASA, I'd like to hear about it.
> > >
> > > -Ben
> > >
> > > On Fri, May 14, 2010 at 01:11, Frank Bulk <frnkblk at iname.com> wrote:
> > >> I don't believe that's the case in a 8.2.x, look for "IPv6 Support in
> > >> Failover Configurations" in the following:
> > >> http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.htm
> > >> l#wp337399
> > >>
> > >> Frank
> > >>
> > >> -----Original Message-----
> > >> From: Shaun Ewing [mailto:s.ewing at aussiehq.com.au]
> > >> Sent: Friday, May 14, 2010 12:02 AM
> > >> To: Shane Kerr; frnkblk at iname.com
> > >> Cc: ipv6-ops at lists.cluenet.de
> > >> Subject: Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
> > >>
> > >> <snip>
> > >>
> > >> We have a lot of ASAs, but they're all in HA - and
> > >> anybody who has tried to do IPv6 on them knows (or should know) that IPv6
> > >> support is presently non-existent when in a HA config.
> > >>
> > >> -Shaun
> > >>
> > >>
> > >
> 



From bmanning at vacation.karoshi.com  Mon May 17 06:16:15 2010
From: bmanning at vacation.karoshi.com (bmanning at vacation.karoshi.com)
Date: Mon, 17 May 2010 04:16:15 +0000
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <1274063932.14998.22742.camel@shane-asus-laptop>
References: <1273813186.14998.8476.camel@shane-asus-laptop>
	<C8131676.1B1D9%s.ewing@aussiehq.com.au>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABN1Vzy0JMPT57tl6Hh9eiCAQAAAAA=@iname.com>
	<AANLkTilqI94T9ILkGqStp3Nw2xa-oxHI_GHU3ZQjoH2e@mail.gmail.com>
	<AANLkTimVN2X2FVx2s3G2h5-gTDej2lMKn1VScvUkelTS@mail.gmail.com>
	<20100515003556.GA4206@vacation.karoshi.com.>
	<1274063932.14998.22742.camel@shane-asus-laptop>
Message-ID: <20100517041615.GA22939@vacation.karoshi.com.>


 Hi Shane,

	First off, I write the way I write - not tryng to be funny.
	Acronyms:  
	
	DHCP - Dynamic Host Control Protocol
	DNS -  Domain Name Service
	NTP -  Network Time Protocol
	RA  - Router Adverstisement
	ND  - Neighboor Discovery
	IPv6 - The sixth version of the IP protocol
	MAC - Media Access Control
	IPv4 - the fourth version of the IP protocol
	IVI - The CERNET IPv4-IPv6 translator code

	DHCP documentation is not up to tht level of the DNS docs,
	so will use snippets from my homegrown version.

	This is what I wanted DHCP to do, regardless of family
	and not running -two- DHCP services, one per family.

	DHCP to hand out DNS servers, NTP servers on request, and do 
	dynamic update for the forward and reverse DNS maps.
	in an ipv6 network without RA,ND, or any other "helpful" IPv6
	features enabled. The ipv6 network in question is running in
	a single /96, so the subnetting needs to work properly.

	like this:

    subnet FD00:4555:6::cafe/96  {
    range FD00:4555:6::cafe:d0 FD00:4555:6::cafe:ff;


    # options
    option domain-name "ep.net";
    option domain-name-servers FD00:4554:6:0:230:48ff:fe22:6a29;
    option routers  FD00:4554:6::1;

    option ntp-servers FD00:4554:6::123;


	To get those options to work with those values requires a bit
	of a willingness to toss the spec in the trash and start over.
	I started by creating new option code points for IPv6 address family
	stuff .. this was problematic at best.

	So I borrowed a little logic from the ()getaddress API and 
	re-wrote the existing option codes to -mostly- be address family
	agnostic.  (It hangs when I mix addresses inside an option for example
	I can't get this to work:

	option routers FD00:4554:6::1, 192.0.2.1;

	yet...)


	No cisco stuff in the middle - and we had to tweek this to 
	get IVI to work well - handing out IPv4 addresses based on
	the IPv6 address, not the MAC.
	
	And I have -most- of this working.  My kludgey patches to 
	the v3 tree of DHCP ended up requiring both server and client
	side, so its not really interoperable w/ anything else - 
	when I am at home, one library gets used - on the road - stock
	v4DHCP.  For v6, whatever works.  Looking forward to having to port 
	my crap to the v4DHCP tree.

	I am -not- looking for ISC to do anything here.   I don't expect
	ISC to ship anything based on this, nor do I expect "vendor"
	specific options - since Im not a vendor.  THis is fullbore custom
	code - its mine, I'm not sharing (mostly 'cause my code is ugly
	and no doubt bug-ridden) .. My point was/is, if folks
	don't like what they are getting, they have the source and should
	use it.

--bill



On Mon, May 17, 2010 at 10:38:52AM +0800, Shane Kerr wrote:
> Bill,
> 
> It's not clear to me which DHCP feature you are referring to. Perhaps it
> is the mix of interleaved style and top-posting, or maybe my ignorance
> with Cisco technologies, but I honestly can't figure it out.
> 
> Please write it very clearly, in a non-funny way. Try to use a minimum
> of acronyms (sort of the opposite of the first post in this thread).
> Ideally sprinkle a few URLs explaining what you mean.
> 
> Even if we don't ultimately ship it in ISC DHCP, it is probably better
> to define this as a dhcpd.conf/dhclient.conf recipe, perhaps using
> vendor-specific options, rather than shipping custom code. But I can't
> say since I don't know what you mean.
> 
> --
> Shane
> 
> On Sat, 2010-05-15 at 00:35 +0000, bmanning at vacation.karoshi.com wrote:
> > many months ago, I asked for this DHCP feature to be supported in
> > the IPv6 varient and was told that the IETF refused - hence ISC didn't build
> > it into their product.  Phaugh on them - its open source!  So I built a
> > server and client that talk IPv6 and support the usual/customary DHCP
> > options over IPv6...  it has the unfortunate side effect of not being compatable
> > with other DHCP servers or clients but does the job for me and my little 
> > piece of hell.  Should work anywhere DHCPv4 does though.
> > 
> > --bill
> > 
> > 
> > On Fri, May 14, 2010 at 10:53:16AM +0200, Andrew Yourtchenko wrote:
> > > On Fri, May 14, 2010 at 7:53 AM, Ben Jencks <ben at bjencks.net> wrote:
> > > > It's officially supported in 8.2.x, but there's apparently a nasty bug
> > > > in at least the early versions where the "inactive" appliance still
> > > > sends RAs despite not forwarding traffic. Be careful and test
> > > > carefully. (I didn't experience this bug, we're still on 8.0, but I
> > > > know someone who did)
> > > 
> > > That bug was before 8.2.2 - where it started to be "officially"
> > > supported (because of the necessary changes to the infrastructure that
> > > alleviated this behaviour. It was more than just a bugfix, yes -
> > > starting from 8.2.2 the stateful failover is possible)
> > > 
> > > I did test it in 8.2.2, it worked all right. Don't use anything earlier.
> > > 
> > > As for the original question - no; there's no DHCPv6.
> > > 
> > > >From the config - since you give out both IPv4 and IPv6 - just
> > > dual-stack the recursive DNS server, and use IPv4 towards the clients
> > > ?
> > > 
> > > Or you plan to get rid of IPv4 completely for those clients ?
> > > 
> > > cheers,
> > > andrew
> > > 
> > > >
> > > > WRT the original question: I assume you're using AnyConnect? If so, I
> > > > can't help you, but if you've managed to get anything IPv6 to work
> > > > with IPsec on the ASA, I'd like to hear about it.
> > > >
> > > > -Ben
> > > >
> > > > On Fri, May 14, 2010 at 01:11, Frank Bulk <frnkblk at iname.com> wrote:
> > > >> I don't believe that's the case in a 8.2.x, look for "IPv6 Support in
> > > >> Failover Configurations" in the following:
> > > >> http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.htm
> > > >> l#wp337399
> > > >>
> > > >> Frank
> > > >>
> > > >> -----Original Message-----
> > > >> From: Shaun Ewing [mailto:s.ewing at aussiehq.com.au]
> > > >> Sent: Friday, May 14, 2010 12:02 AM
> > > >> To: Shane Kerr; frnkblk at iname.com
> > > >> Cc: ipv6-ops at lists.cluenet.de
> > > >> Subject: Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
> > > >>
> > > >> <snip>
> > > >>
> > > >> We have a lot of ASAs, but they're all in HA - and
> > > >> anybody who has tried to do IPv6 on them knows (or should know) that IPv6
> > > >> support is presently non-existent when in a HA config.
> > > >>
> > > >> -Shaun
> > > >>
> > > >>
> > > >
> > 
> 

From swmike at swm.pp.se  Mon May 17 08:05:00 2010
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Mon, 17 May 2010 08:05:00 +0200 (CEST)
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100517041615.GA22939@vacation.karoshi.com.>
References: <1273813186.14998.8476.camel@shane-asus-laptop>
	<C8131676.1B1D9%s.ewing@aussiehq.com.au>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABN1Vzy0JMPT57tl6Hh9eiCAQAAAAA=@iname.com>
	<AANLkTilqI94T9ILkGqStp3Nw2xa-oxHI_GHU3ZQjoH2e@mail.gmail.com>
	<AANLkTimVN2X2FVx2s3G2h5-gTDej2lMKn1VScvUkelTS@mail.gmail.com>
	<20100515003556.GA4206@vacation.karoshi.com.>
	<1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
Message-ID: <alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>

On Mon, 17 May 2010, bmanning at vacation.karoshi.com wrote:

> 	DHCP to hand out DNS servers, NTP servers on request, and do
> 	dynamic update for the forward and reverse DNS maps.

And the new feature you were looking for was to hand out a default-gw, 
right? That's the "this" feature you were referring to and IETF didn't 
want to do?

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From bmanning at vacation.karoshi.com  Mon May 17 08:32:04 2010
From: bmanning at vacation.karoshi.com (bmanning at vacation.karoshi.com)
Date: Mon, 17 May 2010 06:32:04 +0000
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
References: <1273813186.14998.8476.camel@shane-asus-laptop>
	<C8131676.1B1D9%s.ewing@aussiehq.com.au>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABN1Vzy0JMPT57tl6Hh9eiCAQAAAAA=@iname.com>
	<AANLkTilqI94T9ILkGqStp3Nw2xa-oxHI_GHU3ZQjoH2e@mail.gmail.com>
	<AANLkTimVN2X2FVx2s3G2h5-gTDej2lMKn1VScvUkelTS@mail.gmail.com>
	<20100515003556.GA4206@vacation.karoshi.com.>
	<1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
Message-ID: <20100517063204.GC23584@vacation.karoshi.com.>

On Mon, May 17, 2010 at 08:05:00AM +0200, Mikael Abrahamsson wrote:
> On Mon, 17 May 2010, bmanning at vacation.karoshi.com wrote:
> 
> >	DHCP to hand out DNS servers, NTP servers on request, and do
> >	dynamic update for the forward and reverse DNS maps.
> 
> And the new feature you were looking for was to hand out a default-gw, 
> right? That's the "this" feature you were referring to and IETF didn't 
> want to do?

	-and- hand out DNS servers and NTP servers w/o pulling new
	option codes - basically rework DHCP internals to remove the
	IPv4 specific formats and use an adressing abstraction to 
	allow the existing options (that code addresses) to become
	address agnostic. For me, it was the more intuitive way to 
	slice the DHCP problem - now we have -two- things called 
	DHCP, one for IPv4 and one for IPv6 - and they are functionally
	different.  This seemed nutz to me, we don't have a DNS for 
	IPv4 and a slightly different and incompatible DNS for IPv6. **

	
	But what do I know.  I'm just a code hobbiest - no corporate
	or vendor backing here.  I am not going to try and change the
	vectors on this code/base/spec - the inertia is just too large.

	but inside -MY- walled garden, mutations have occured.

** ok, so this is almost true - my DNS supports bitstrings and A6 rr types
still. And the DISCOVER op-code and the beginings of a hack to do regular
expression matching w/in lables... you really don't want to jump over the
wall... :)

> -- 
> Mikael Abrahamsson    email: swmike at swm.pp.se

--bill

From sthaug at nethelp.no  Mon May 17 08:44:30 2010
From: sthaug at nethelp.no (sthaug at nethelp.no)
Date: Mon, 17 May 2010 08:44:30 +0200 (CEST)
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
Message-ID: <20100517.084430.78711679.sthaug@nethelp.no>

> > 	DHCP to hand out DNS servers, NTP servers on request, and do
> > 	dynamic update for the forward and reverse DNS maps.
> 
> And the new feature you were looking for was to hand out a default-gw, 
> right? That's the "this" feature you were referring to and IETF didn't 
> want to do?

I'm glad to see such patches (I'm tempted to say "about time").

I would of course be even happier to see a *standardized* solution to
let DHCPv6 hand out a default gateway. The lack of such a feature (and
the strong religious opposition to it in certain circles), despite clear
statements from several big operators that they need it, is one of the
significant factors hampering IPv6 deployment.

Steinar Haug, Nethelp consulting, sthaug at nethelp.no

From gbonser at seven.com  Mon May 17 08:52:56 2010
From: gbonser at seven.com (George Bonser)
Date: Sun, 16 May 2010 23:52:56 -0700
Subject: Decent IPv6 firewall with failover?
Message-ID: <5A6D953473350C4B9995546AFE9939EE09EA440B@RWC-EX1.corp.seven.com>

I notice the Cisco ASA series still doesn't do failover for IPv6 as of
8.3

Does anyone have any recommendations for a medium sized firewall (say
something in the ASA5550 class) that can do failover?

George


From bmanning at vacation.karoshi.com  Mon May 17 08:58:04 2010
From: bmanning at vacation.karoshi.com (bmanning at vacation.karoshi.com)
Date: Mon, 17 May 2010 06:58:04 +0000
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100517.084430.78711679.sthaug@nethelp.no>
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
Message-ID: <20100517065804.GE23584@vacation.karoshi.com.>

On Mon, May 17, 2010 at 08:44:30AM +0200, sthaug at nethelp.no wrote:
> > > 	DHCP to hand out DNS servers, NTP servers on request, and do
> > > 	dynamic update for the forward and reverse DNS maps.
> > 
> > And the new feature you were looking for was to hand out a default-gw, 
> > right? That's the "this" feature you were referring to and IETF didn't 
> > want to do?
> 
> I'm glad to see such patches (I'm tempted to say "about time").
> 
> I would of course be even happier to see a *standardized* solution to
> let DHCPv6 hand out a default gateway. The lack of such a feature (and
> the strong religious opposition to it in certain circles), despite clear
> statements from several big operators that they need it, is one of the
> significant factors hampering IPv6 deployment.

	
	actually the Default Gateway option was - for me - a side effect.
	I wanted DNS servers.  having ripped off the covers,  finding 
	the code being driven the way it was, I tossed in the proverbial 
	towel and re-wrote it the way I wanted it.  One DHCP, address agnostic.
	All defined DHCP options (should) work with anything that is suported
	by the newer APIs.  If some brave/foolhardy souls want to take up
	the torch and get such an idea standardised, go for it.


--bill

> 
> Steinar Haug, Nethelp consulting, sthaug at nethelp.no

From swmike at swm.pp.se  Mon May 17 09:04:48 2010
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Mon, 17 May 2010 09:04:48 +0200 (CEST)
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100517065804.GE23584@vacation.karoshi.com.>
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<20100517065804.GE23584@vacation.karoshi.com.>
Message-ID: <alpine.DEB.1.10.1005170902090.28457@uplift.swm.pp.se>

On Mon, 17 May 2010, bmanning at vacation.karoshi.com wrote:

> 	actually the Default Gateway option was - for me - a side effect.
> 	I wanted DNS servers.  having ripped off the covers,  finding
> 	the code being driven the way it was, I tossed in the proverbial
> 	towel and re-wrote it the way I wanted it.  One DHCP, address agnostic.
> 	All defined DHCP options (should) work with anything that is suported
> 	by the newer APIs.  If some brave/foolhardy souls want to take up
> 	the torch and get such an idea standardised, go for it.

Why do you want a single protocol? Should the transport for this be either 
IPv4 or IPv6? I kind of see the logic that DHCP for v4 is carried over 
IPv4, and DHCPv6 is carried over IPv6, and keep them separate. I'm not 
really a fan of mixing things too much, sounds like a complication?

Should IPv4 information be obtained using an IPv6 transport also?

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From hlk at kramse.org  Mon May 17 09:07:49 2010
From: hlk at kramse.org (=?iso-8859-1?Q?Henrik_Lund_Kramsh=F8j?=)
Date: Mon, 17 May 2010 09:07:49 +0200
Subject: Decent IPv6 firewall with failover?
In-Reply-To: <5A6D953473350C4B9995546AFE9939EE09EA440B@RWC-EX1.corp.seven.com>
References: <5A6D953473350C4B9995546AFE9939EE09EA440B@RWC-EX1.corp.seven.com>
Message-ID: <C8E8E014-B1F7-4D2A-AE69-74421F54CDEA@kramse.org>


On 17/05/2010, at 08.52, George Bonser wrote:

> I notice the Cisco ASA series still doesn't do failover for IPv6 as of
> 8.3
> 
> Does anyone have any recommendations for a medium sized firewall (say
> something in the ASA5550 class) that can do failover?

I would look into the Juniper SRX range which are supposed to do IPv6 flow filtering
in Junos 10.2. YMMV, so check and double check support for the model you consider.

or if you don't feel adventurous with this new platform then the older SSG line, which 
are still pretty nice and has excellent support of IPv6. We run SSG in active/standby with IPv6.



Best regards

Henrik

--
Henrik Lund Kramsh?j, Follower of the Great Way of Unix
hlk at kramse.dk hlk at security6.net, +45 2026 6000 cand.scient CISSP CEH
http://solidonetworks.com/ Network Security is a business enabler
http://www.security6.net - IPv6, sikkerhed, netv?rk
http://www.portscan.dk - gratis portscan







From shane at time-travellers.org  Mon May 17 09:15:37 2010
From: shane at time-travellers.org (Shane Kerr)
Date: Mon, 17 May 2010 15:15:37 +0800
Subject: DHCPv6 for IPv6 routing information, was Re: Mysterious missing
	DHCPv6 feature
In-Reply-To: <20100517.084430.78711679.sthaug@nethelp.no>
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
Message-ID: <1274080537.14998.23721.camel@shane-asus-laptop>

Steinar,

On Mon, 2010-05-17 at 08:44 +0200, sthaug at nethelp.no wrote:
> > > 	DHCP to hand out DNS servers, NTP servers on request, and do
> > > 	dynamic update for the forward and reverse DNS maps.
> > 
> > And the new feature you were looking for was to hand out a default-gw, 
> > right? That's the "this" feature you were referring to and IETF didn't 
> > want to do?
> 
> I'm glad to see such patches (I'm tempted to say "about time").
> 
> I would of course be even happier to see a *standardized* solution to
> let DHCPv6 hand out a default gateway. The lack of such a feature (and
> the strong religious opposition to it in certain circles), despite clear
> statements from several big operators that they need it, is one of the
> significant factors hampering IPv6 deployment.

I used to be a DHCPv6 guy, although not so much any more. (I was part of
the three-man team that coded ISC's first DHCPv6 release a few years
back.)

As I understand it, there was a persistent and insistent group of people
within the IETF that really, really, REALLY wanted DHCP to not exist on
IPv6 at all. I wasn't involved at all during those times, but I am led
to believe this was largely a "zeroconf" push.

Remember the idea that IPv6 was going to autoconfigure everything, and
no management would be necessary?

                    HAHAHAHAHAHAHAHAHAHAHAHAHAHA!!!

Honestly. Some people. I'm reminded of people who told me in 1990 that
programing would go away because it would be so easy to make software do
what you wanted it to.

Anyway, whatever the reason, there is a group of DHCP-haters. Especially
in the IPv6 universe.



Having said that, the philosophy has been that for each problem we
should have ONE protocol to solve it. This makes a certain amount of
sense. With routing information, this is supposed to be router
advertisements (RA). This is the argument against putting routing
information in DHCPv6 (as I understand it).

Strangely, rather than saying "look we have DNS information in DHCPv6 so
we don't need it in RA", the tactic was taken to create a RA that
includes DNS servers. Which sort of seems like TWO protocols to solve a
particular problem. Oh well, at least it's only EXPERIMENTAL (RFC 5006).

There does seem to be a draft for exactly this feature:

http://tools.ietf.org/html/draft-dec-dhcpv6-route-option-03

So there's hope for the future. The "intended status" is INFORMATIONAL
though, and it hasn't been accepted as a working group item yet, so who
knows... :)

--
Shane


From lists at hojmark.org  Mon May 17 09:16:42 2010
From: lists at hojmark.org (Asbjorn Hojmark - Lists)
Date: Mon, 17 May 2010 09:16:42 +0200
Subject: Decent IPv6 firewall with failover?
In-Reply-To: <5A6D953473350C4B9995546AFE9939EE09EA440B@RWC-EX1.corp.seven.com>
References: <5A6D953473350C4B9995546AFE9939EE09EA440B@RWC-EX1.corp.seven.com>
Message-ID: <40r1v5d36v0bsmtki0g5vg1m9jnsk8oqtm@hojmark.net>

On Sun, 16 May 2010 23:52:56 -0700, you wrote:

> I notice the Cisco ASA series still doesn't do failover for IPv6
> as of 8.3

New in 8.2:

http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.html

"IPv6 Support in Failover Configurations: IPv6 is now supported in
failover configurations. You can assign active and standby IPv6
addresses to interfaces and use IPv6 addresses for the failover and
Stateful Failover interfaces."

Isn't that what you want?

-A

From swmike at swm.pp.se  Mon May 17 09:19:55 2010
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Mon, 17 May 2010 09:19:55 +0200 (CEST)
Subject: DHCPv6 for IPv6 routing information, was Re: Mysterious missing
	DHCPv6 feature
In-Reply-To: <1274080537.14998.23721.camel@shane-asus-laptop>
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<1274080537.14998.23721.camel@shane-asus-laptop>
Message-ID: <alpine.DEB.1.10.1005170918460.28457@uplift.swm.pp.se>

On Mon, 17 May 2010, Shane Kerr wrote:

> Strangely, rather than saying "look we have DNS information in DHCPv6 so 
> we don't need it in RA", the tactic was taken to create a RA that 
> includes DNS servers. Which sort of seems like TWO protocols to solve a 
> particular problem. Oh well, at least it's only EXPERIMENTAL (RFC 5006).

People said that, but there was a big push to have DNS in RA and now there 
is push to have routing in DHCPv6, so I think it'll happen, we'll have 
quite a lot of overlap.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From bmanning at vacation.karoshi.com  Mon May 17 09:23:21 2010
From: bmanning at vacation.karoshi.com (bmanning at vacation.karoshi.com)
Date: Mon, 17 May 2010 07:23:21 +0000
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <alpine.DEB.1.10.1005170902090.28457@uplift.swm.pp.se>
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<20100517065804.GE23584@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170902090.28457@uplift.swm.pp.se>
Message-ID: <20100517072321.GF23584@vacation.karoshi.com.>

On Mon, May 17, 2010 at 09:04:48AM +0200, Mikael Abrahamsson wrote:
> On Mon, 17 May 2010, bmanning at vacation.karoshi.com wrote:
> 
> >	actually the Default Gateway option was - for me - a side effect.
> >	I wanted DNS servers.  having ripped off the covers,  finding
> >	the code being driven the way it was, I tossed in the proverbial
> >	towel and re-wrote it the way I wanted it.  One DHCP, address 
> >	agnostic.
> >	All defined DHCP options (should) work with anything that is suported
> >	by the newer APIs.  If some brave/foolhardy souls want to take up
> >	the torch and get such an idea standardised, go for it.
> 
> Why do you want a single protocol? Should the transport for this be either 
> IPv4 or IPv6? I kind of see the logic that DHCP for v4 is carried over 
> IPv4, and DHCPv6 is carried over IPv6, and keep them separate. I'm not 
> really a fan of mixing things too much, sounds like a complication?

	why do you want multiples? transport is what works.

> 
> Should IPv4 information be obtained using an IPv6 transport also?


	why not?  the transport used to deliver the datagrams is
	or should be agnostic of the content of those datagrams.

	as far as I can tell, we could use DECNET PhaseV as the 
	transport for DHCP and push IPv4 and IPv6 configuration data
	over DECNET.

	anyway - I've said my piece.  i did what i did, it works for me
	and i'm not asking any one to agree with me. i hope it was clear
	enough for Shane, who asked.  if not, lets take this off list.
> 
> -- 
> Mikael Abrahamsson    email: swmike at swm.pp.se

--bill

From andy at nosignal.org  Mon May 17 09:24:58 2010
From: andy at nosignal.org (Andy Davidson)
Date: Mon, 17 May 2010 08:24:58 +0100
Subject: Cisco 1801W, v6 on wireless, bvi argh.
In-Reply-To: <005101caf58f$359c13b0$a0d43b10$@com>
References: <24D585B4-F4CD-4CC6-AE98-46C1A3BEE4C7@nosignal.org>
	<005101caf58f$359c13b0$a0d43b10$@com>
Message-ID: <FE8CE3E0-2A37-4E2E-B707-347414B2B697@nosignal.org>


On 17 May 2010, at 08:04, Patrick Grossetete wrote:

> I didn?t see the ?bridge 1 route IPv6? command in your configuration

Hi, Patrick, thanks for your email.

Looks like I am going to need to drop to an earlier version, as this options isn't actually in the latest T-train IOS 15...

bcliffe-gw(config)#bridge 1 route ?
  clns    ISO CLNS
  decnet  DECnet
  ip      IP
  ipx     Novell IPX

Had a few interesting replies and examples, I will get these checked out and post to the list if I have something concrete that works soon.

Thanks,
Andy

From gbonser at seven.com  Mon May 17 09:26:09 2010
From: gbonser at seven.com (George Bonser)
Date: Mon, 17 May 2010 00:26:09 -0700
Subject: Decent IPv6 firewall with failover?
In-Reply-To: <40r1v5d36v0bsmtki0g5vg1m9jnsk8oqtm@hojmark.net>
References: <5A6D953473350C4B9995546AFE9939EE09EA440B@RWC-EX1.corp.seven.com>
	<40r1v5d36v0bsmtki0g5vg1m9jnsk8oqtm@hojmark.net>
Message-ID: <5A6D953473350C4B9995546AFE9939EE09EA440D@RWC-EX1.corp.seven.com>



> -----Original Message-----
> From: Asbjorn Hojmark - Lists [mailto:lists at hojmark.org]
> Sent: Monday, May 17, 2010 12:17 AM
> To: George Bonser
> Cc: ipv6-ops at lists.cluenet.de
> Subject: Re: Decent IPv6 firewall with failover?
> 
> On Sun, 16 May 2010 23:52:56 -0700, you wrote:
> 
> > I notice the Cisco ASA series still doesn't do failover for IPv6
> > as of 8.3
> 
> New in 8.2:
> 
>
http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn8
> 2.html
> 
> "IPv6 Support in Failover Configurations: IPv6 is now supported in
> failover configurations. You can assign active and standby IPv6
> addresses to interfaces and use IPv6 addresses for the failover and
> Stateful Failover interfaces."
> 
> Isn't that what you want?
> 
> -A

Interesting.  Because here:
http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/r
oute_overview.html#wpxref71253

It says:

Failover does not support IPv6. The ipv6 address command does not
support setting standby addresses for failover configurations. The
failover interface ip command does not support using IPv6 addresses on
the failover and Stateful Failover interfaces.

So now I don't know what to believe.


From pgrossetete at archrock.com  Mon May 17 09:04:37 2010
From: pgrossetete at archrock.com (Patrick Grossetete)
Date: Mon, 17 May 2010 00:04:37 -0700 (PDT)
Subject: Cisco 1801W, v6 on wireless, bvi argh.
In-Reply-To: <24D585B4-F4CD-4CC6-AE98-46C1A3BEE4C7@nosignal.org>
References: <24D585B4-F4CD-4CC6-AE98-46C1A3BEE4C7@nosignal.org>
Message-ID: <005101caf58f$359c13b0$a0d43b10$@com>

I didn't see the "bridge 1 route IPv6" command in your configuration

 

Regards

Patrick

 

 

From: ipv6-ops-bounces+pgrosset=archrock.com at lists.cluenet.de
[mailto:ipv6-ops-bounces+pgrosset=archrock.com at lists.cluenet.de] On Behalf
Of Andy Davidson
Sent: Sunday, May 16, 2010 10:12 PM
To: ipv6-ops at lists.cluenet.de
Subject: Cisco 1801W, v6 on wireless, bvi argh.

 

Hi,

 

Please help me get ipv6 working on my Cisco 1801W test router.  I have
working v6 on my wired vlan, but not wireless.

 

Cisco Bug CSCej50923
Symptom : BVI Routing does not work for IPV6 addressing.

This bug is marked 'fixed' as at February 2010, providing I use one of the
fixed versions of IOS.  I installed 15.1(1)XB in February on my Cisco
1801, which is one of the ones which has this bug fixed, however I could
not route IPv6 over the bridged/BVI interface.  I lost interest for a
little while, earlier I installed 15.1(1)T, but v6 still does not work
over the v6 interface.

 

By 'work', I mean pass v6 frames, act as a gateway, do ND, do router
advertisement.

 

If the bug *is* fixed, then is it my config which is wrong, surely.. This
is what I am doing - if someone has suggestions, I am all ears.  There are
two attached methods :

 

 

=========================================================

Method 1 - BVI

 

ipv6 unicast-routing

ipv6 cef

ipv6 multicast-routing

!

bridge irb

!

interface Dot11Radio0

 description Wireless Network / vlan 2

 no ip address

 no ip redirects

 ip local-proxy-arp

 ip virtual-reassembly

 ip tcp adjust-mss 1400

 !

 encryption mode ciphers tkip 

 !

 encryption vlan 2 mode ciphers tkip 

 !

 ssid rustykettle

 !

 speed basic-1.0 basic-2.0 basic-5.5 basic-6.0 basic-9.0 basic-11.0
basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0

 channel 2442

 station-role root

 world-mode dot11d country US indoor

 hold-queue 100 out

!

interface Dot11Radio0.2

 encapsulation dot1Q 2

 no ip redirects

 ip local-proxy-arp

 ip tcp adjust-mss 1400

 no cdp enable

 bridge-group 1

 bridge-group 1 subscriber-loop-control

 bridge-group 1 spanning-disabled

 bridge-group 1 block-unknown-source

 no bridge-group 1 source-learning

 no bridge-group 1 unicast-flooding

!

interface Vlan2

 description Wireless network VLAN

 no ip address

 ip pim sparse-dense-mode

 ip virtual-reassembly

 ip tcp adjust-mss 1400

 ip ospf 10 area 0

 ipv6 enable

 bridge-group 1

 bridge-group 1 subscriber-loop-control

 bridge-group 1 spanning-disabled

!

interface BVI1

 ip vrf forwarding vrf_Tunnel

 ip address 91.194.69.65 255.255.255.192

 ip nat inside

 ip virtual-reassembly

 ip tcp adjust-mss 1400

 ipv6 address 2A02:C30:100:2::1/64

 ipv6 enable

 

 

Issue :  connected ipv6 route for 2a02:c30:100:2::/64 is not installed in
the routing table.  devices on this lan do not discover the router via RA,
router does not learn any neighbors in this subnet.

 

 

=========================================================

 

Method 2: Address on radio interface

 

As above, but ..

 

no int bvi1

interface Dot11Radio0.2

 no bridge-group 1

 ip address 91.194.69.65 255.255.255.192

 ip vrf forwarding vrf_Tunnel

 ipv6 address 2A02:C30:100:2::1/64

 ipv6 enable

 

 

Issue :  IPv4 configuration is accepted, and routes properly.  ipv6 config
is not 'taken' by the router - it barfs at the 'v' on each of the ipv6
lines..

 

=========================================================

 

Any ideas ?

 

Kind regards, thanks and adoration in advance,

Andy

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100517/d89c1cf5/attachment.html 

From gert at space.net  Mon May 17 09:36:11 2010
From: gert at space.net (Gert Doering)
Date: Mon, 17 May 2010 09:36:11 +0200
Subject: Decent IPv6 firewall with failover?
In-Reply-To: <5A6D953473350C4B9995546AFE9939EE09EA440B@RWC-EX1.corp.seven.com>
References: <5A6D953473350C4B9995546AFE9939EE09EA440B@RWC-EX1.corp.seven.com>
Message-ID: <20100517073611.GX60850@Space.Net>

Hi,

On Sun, May 16, 2010 at 11:52:56PM -0700, George Bonser wrote:
> Does anyone have any recommendations for a medium sized firewall (say
> something in the ASA5550 class) that can do failover?

Juniper/Netscreen SSG with ScreenOS 6.2 and up will do IPv6 + NSRP
failover just perfectly - full session takeover, etc.

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  150584

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

From bmanning at vacation.karoshi.com  Mon May 17 09:40:11 2010
From: bmanning at vacation.karoshi.com (bmanning at vacation.karoshi.com)
Date: Mon, 17 May 2010 07:40:11 +0000
Subject: DHCPv6 for IPv6 routing information,
	was Re: Mysterious missing DHCPv6 feature
In-Reply-To: <alpine.DEB.1.10.1005170918460.28457@uplift.swm.pp.se>
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<1274080537.14998.23721.camel@shane-asus-laptop>
	<alpine.DEB.1.10.1005170918460.28457@uplift.swm.pp.se>
Message-ID: <20100517074011.GG23584@vacation.karoshi.com.>

On Mon, May 17, 2010 at 09:19:55AM +0200, Mikael Abrahamsson wrote:
> On Mon, 17 May 2010, Shane Kerr wrote:
> 
> >Strangely, rather than saying "look we have DNS information in DHCPv6 so 
> >we don't need it in RA", the tactic was taken to create a RA that 
> >includes DNS servers. Which sort of seems like TWO protocols to solve a 
> >particular problem. Oh well, at least it's only EXPERIMENTAL (RFC 5006).
> 
> People said that, but there was a big push to have DNS in RA and now there 
> is push to have routing in DHCPv6, so I think it'll happen, we'll have 
> quite a lot of overlap.
> 
> -- 
> Mikael Abrahamsson    email: swmike at swm.pp.se


	what was hard to digest was the fact that the base IPv6 architeecture
	only works for about 85% of the existing use cases. That leaves about
	15% of existing, core use cases where the default IPv6 tool suite
	won't work as advertized or will screw up everything..  case in point,
	an internet exchange on shared media (yeah, these are increasingly rare
	but work w/ me here)  I've got a dozen routers on the same media, all
	running RA - telliing/shouting to all the other routers - NO, USE ME!
	ND (neighboor discovery) has the same problems in a multi-homed network.

	It is for this reason, the other 15% that fall outside the "norm" that
	we need something like DHCP that is address family agnostic or I'm back to 
	hardcoding config data.

--bill

From shane at time-travellers.org  Mon May 17 09:42:44 2010
From: shane at time-travellers.org (Shane Kerr)
Date: Mon, 17 May 2010 15:42:44 +0800
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100517063204.GC23584@vacation.karoshi.com.>
References: <1273813186.14998.8476.camel@shane-asus-laptop>
	<C8131676.1B1D9%s.ewing@aussiehq.com.au>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABN1Vzy0JMPT57tl6Hh9eiCAQAAAAA=@iname.com>
	<AANLkTilqI94T9ILkGqStp3Nw2xa-oxHI_GHU3ZQjoH2e@mail.gmail.com>
	<AANLkTimVN2X2FVx2s3G2h5-gTDej2lMKn1VScvUkelTS@mail.gmail.com>
	<20100515003556.GA4206@vacation.karoshi.com.>
	<1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517063204.GC23584@vacation.karoshi.com.>
Message-ID: <1274082164.14998.23818.camel@shane-asus-laptop>

Bill,

On Mon, 2010-05-17 at 06:32 +0000, bmanning at vacation.karoshi.com wrote:
> On Mon, May 17, 2010 at 08:05:00AM +0200, Mikael Abrahamsson wrote:
> > On Mon, 17 May 2010, bmanning at vacation.karoshi.com wrote:
> > 
> > >	DHCP to hand out DNS servers, NTP servers on request, and do
> > >	dynamic update for the forward and reverse DNS maps.
> > 
> > And the new feature you were looking for was to hand out a default-gw, 
> > right? That's the "this" feature you were referring to and IETF didn't 
> > want to do?
> 
> 	-and- hand out DNS servers and NTP servers w/o pulling new
> 	option codes - basically rework DHCP internals to remove the
> 	IPv4 specific formats and use an adressing abstraction to 
> 	allow the existing options (that code addresses) to become
> 	address agnostic. For me, it was the more intuitive way to 
> 	slice the DHCP problem - now we have -two- things called 
> 	DHCP, one for IPv4 and one for IPv6 - and they are functionally
> 	different.  This seemed nutz to me, we don't have a DNS for 
> 	IPv4 and a slightly different and incompatible DNS for IPv6. **

There are a lot of differences, in all ways better for IPv6.

For example, in IPv6 you always have link-local addresses to use, even
before you get any "real" IPv6 addresses. For DHCP in IPv4 you have to
"cheat" a bit on all operating systems to do things like "send to an IP
without using ARP" or "send a packet without having a IP on the
interface". You actually need OS-specific code for this in most cases.

Another fundamental difference is how addresses are managed. In IPv6 you
have multiple addresses per interface. A proper address management
protocol, like DHCPv6, needs to know how to hand out multiple addresses
to a client. Also, in addition to lease timers, each address has
different timers to allow things like renumbering and privacy-preserving
addresses.

A huge amount of protocol hackery would have been required to include
even just the address management bits in something compatible with DHCP
for IPv4. Since DHCP for IPv4 is itself a hack on BOOTP, which Google
informs me evolved from RARP, it was already quite crufty. Having
implemented DHCPv6, I assure you it is a joy to work with, compared to
most other IETF protocols. :)

> 	But what do I know.  I'm just a code hobbiest - no corporate
> 	or vendor backing here.  I am not going to try and change the
> 	vectors on this code/base/spec - the inertia is just too large.

That's one way to look at it. I tend to think the DHCPv6 specification
is pretty good, and not in need of changing. In 5 years maybe I can
finally start using computers without this legacy DHCP crap on it, and
then I'll be very glad for the changes.

--
Shane


From gbonser at seven.com  Mon May 17 09:46:33 2010
From: gbonser at seven.com (George Bonser)
Date: Mon, 17 May 2010 00:46:33 -0700
Subject: Decent IPv6 firewall with failover?
In-Reply-To: <20100517073611.GX60850@Space.Net>
References: <5A6D953473350C4B9995546AFE9939EE09EA440B@RWC-EX1.corp.seven.com>
	<20100517073611.GX60850@Space.Net>
Message-ID: <5A6D953473350C4B9995546AFE9939EE09EA440E@RWC-EX1.corp.seven.com>



> -----Original Message-----
> From: Gert Doering [mailto:gert at space.net]
> Sent: Monday, May 17, 2010 12:36 AM
> To: George Bonser
> Cc: ipv6-ops at lists.cluenet.de
> Subject: Re: Decent IPv6 firewall with failover?
> 
> Hi,
> 
> On Sun, May 16, 2010 at 11:52:56PM -0700, George Bonser wrote:
> > Does anyone have any recommendations for a medium sized firewall
(say
> > something in the ASA5550 class) that can do failover?
> 
> Juniper/Netscreen SSG with ScreenOS 6.2 and up will do IPv6 + NSRP
> failover just perfectly - full session takeover, etc.
> 
> Gert Doering
>         -- NetMaster
> --

That is what I am leaning towards but I believe Juniper is trying to
phase out the ScreenOS stuff, though I am more familiar with it than the
JunOS.  I have some experience with ScreenOS and am more at home with
its "quirks".

Judging from recent traffic on the NANOG list, the SSG is more stable
than the SRX and stability is more of my concern than ease of
administration.

Thanks.

George


From swmike at swm.pp.se  Mon May 17 09:46:43 2010
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Mon, 17 May 2010 09:46:43 +0200 (CEST)
Subject: DHCPv6 for IPv6 routing information, was Re: Mysterious missing
	DHCPv6 feature
In-Reply-To: <20100517074011.GG23584@vacation.karoshi.com.>
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<1274080537.14998.23721.camel@shane-asus-laptop>
	<alpine.DEB.1.10.1005170918460.28457@uplift.swm.pp.se>
	<20100517074011.GG23584@vacation.karoshi.com.>
Message-ID: <alpine.DEB.1.10.1005170943160.28457@uplift.swm.pp.se>

On Mon, 17 May 2010, bmanning at vacation.karoshi.com wrote:

> 	what was hard to digest was the fact that the base IPv6 architeecture
> 	only works for about 85% of the existing use cases. That leaves about
> 	15% of existing, core use cases where the default IPv6 tool suite
> 	won't work as advertized or will screw up everything..  case in point,
> 	an internet exchange on shared media (yeah, these are increasingly rare
> 	but work w/ me here)  I've got a dozen routers on the same media, all
> 	running RA - telliing/shouting to all the other routers - NO, USE ME!
> 	ND (neighboor discovery) has the same problems in a multi-homed network.

IXes here in Europe primarily run in shared broadcast domains, and they 
generally require RA to be turned off completely:

http://www.ams-ix.net/allowed-traffic/

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From bmanning at vacation.karoshi.com  Mon May 17 09:52:32 2010
From: bmanning at vacation.karoshi.com (bmanning at vacation.karoshi.com)
Date: Mon, 17 May 2010 07:52:32 +0000
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <1274082164.14998.23818.camel@shane-asus-laptop>
References: <C8131676.1B1D9%s.ewing@aussiehq.com.au>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABN1Vzy0JMPT57tl6Hh9eiCAQAAAAA=@iname.com>
	<AANLkTilqI94T9ILkGqStp3Nw2xa-oxHI_GHU3ZQjoH2e@mail.gmail.com>
	<AANLkTimVN2X2FVx2s3G2h5-gTDej2lMKn1VScvUkelTS@mail.gmail.com>
	<20100515003556.GA4206@vacation.karoshi.com.>
	<1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517063204.GC23584@vacation.karoshi.com.>
	<1274082164.14998.23818.camel@shane-asus-laptop>
Message-ID: <20100517075232.GH23584@vacation.karoshi.com.>

On Mon, May 17, 2010 at 03:42:44PM +0800, Shane Kerr wrote:
> Bill,
> 
> On Mon, 2010-05-17 at 06:32 +0000, bmanning at vacation.karoshi.com wrote:
> > On Mon, May 17, 2010 at 08:05:00AM +0200, Mikael Abrahamsson wrote:
> > > On Mon, 17 May 2010, bmanning at vacation.karoshi.com wrote:
> > > 
> > > >	DHCP to hand out DNS servers, NTP servers on request, and do
> > > >	dynamic update for the forward and reverse DNS maps.
> > > 
> > > And the new feature you were looking for was to hand out a default-gw, 
> > > right? That's the "this" feature you were referring to and IETF didn't 
> > > want to do?
> > 
> > 	-and- hand out DNS servers and NTP servers w/o pulling new
> > 	option codes - basically rework DHCP internals to remove the
> > 	IPv4 specific formats and use an adressing abstraction to 
> > 	allow the existing options (that code addresses) to become
> > 	address agnostic. For me, it was the more intuitive way to 
> > 	slice the DHCP problem - now we have -two- things called 
> > 	DHCP, one for IPv4 and one for IPv6 - and they are functionally
> > 	different.  This seemed nutz to me, we don't have a DNS for 
> > 	IPv4 and a slightly different and incompatible DNS for IPv6. **
> 
> There are a lot of differences, in all ways better for IPv6.
> 
> For example, in IPv6 you always have link-local addresses to use, even
> before you get any "real" IPv6 addresses. For DHCP in IPv4 you have to
> "cheat" a bit on all operating systems to do things like "send to an IP
> without using ARP" or "send a packet without having a IP on the
> interface". You actually need OS-specific code for this in most cases.
> 
> Another fundamental difference is how addresses are managed. In IPv6 you
> have multiple addresses per interface. A proper address management
> protocol, like DHCPv6, needs to know how to hand out multiple addresses
> to a client. Also, in addition to lease timers, each address has
> different timers to allow things like renumbering and privacy-preserving
> addresses.

	you -could- support that in DHCPv6, i don't think its -required-
	or just take the degenerate case (which is what I did) and just
	hand out one - the others get assigned in the usual v6majik.

> A huge amount of protocol hackery would have been required to include
> even just the address management bits in something compatible with DHCP
> for IPv4. Since DHCP for IPv4 is itself a hack on BOOTP, which Google
> informs me evolved from RARP, it was already quite crufty. Having
> implemented DHCPv6, I assure you it is a joy to work with, compared to
> most other IETF protocols. :)

	Damming w/ faint praise! I built a bootp server to work w/ RARP
	and was in on the first DHCP WG mtgs - I thought Ralph was nutz too.
	As for a joy... maybe.  Its a royal PITA to have to run both a
	DHCP and DHCPv6 daemon.  

> > 	But what do I know.  I'm just a code hobbiest - no corporate
> > 	or vendor backing here.  I am not going to try and change the
> > 	vectors on this code/base/spec - the inertia is just too large.
> 
> That's one way to look at it. I tend to think the DHCPv6 specification
> is pretty good, and not in need of changing. In 5 years maybe I can
> finally start using computers without this legacy DHCP crap on it, and
> then I'll be very glad for the changes.

	5 years?  We could just dump RA/ND et.al. and DHCP and just 
	use Bonjour ...  :)  Just like it was promised in 1997.

> 
> --
> Shane

--bill (the cynic)

From hlk at kramse.org  Mon May 17 09:54:32 2010
From: hlk at kramse.org (=?iso-8859-1?Q?Henrik_Lund_Kramsh=F8j?=)
Date: Mon, 17 May 2010 09:54:32 +0200
Subject: Decent IPv6 firewall with failover?
In-Reply-To: <5A6D953473350C4B9995546AFE9939EE09EA440E@RWC-EX1.corp.seven.com>
References: <5A6D953473350C4B9995546AFE9939EE09EA440B@RWC-EX1.corp.seven.com>
	<20100517073611.GX60850@Space.Net>
	<5A6D953473350C4B9995546AFE9939EE09EA440E@RWC-EX1.corp.seven.com>
Message-ID: <128B2A83-66A1-4793-8BB7-93A8C32B07C9@kramse.org>


On 17/05/2010, at 09.46, George Bonser wrote:

> 
> 
>> -----Original Message-----
>> From: Gert Doering [mailto:gert at space.net]
>> Sent: Monday, May 17, 2010 12:36 AM
>> To: George Bonser
>> Cc: ipv6-ops at lists.cluenet.de
>> Subject: Re: Decent IPv6 firewall with failover?
>> 
>> Hi,
>> 
>> On Sun, May 16, 2010 at 11:52:56PM -0700, George Bonser wrote:
>>> Does anyone have any recommendations for a medium sized firewall
> (say
>>> something in the ASA5550 class) that can do failover?
>> 
>> Juniper/Netscreen SSG with ScreenOS 6.2 and up will do IPv6 + NSRP
>> failover just perfectly - full session takeover, etc.
>> 
>> Gert Doering
>>        -- NetMaster
>> --
> 
> That is what I am leaning towards but I believe Juniper is trying to
> phase out the ScreenOS stuff, though I am more familiar with it than the
> JunOS.  I have some experience with ScreenOS and am more at home with
> its "quirks".
> 
> Judging from recent traffic on the NANOG list, the SSG is more stable
> than the SRX and stability is more of my concern than ease of
> administration.

The SRX series is a bit more adventurous, but not stability wise. I run quite a few of
them, various models from SRX210 and up. Some single devices, others clustered.

The thing is they have merged in the screenos features and are scrambling to
expand the featurelist. My problems have mostly been with a few features supported
on some models and then not on the next.

Things like
IPsec+GRE tunnel, fine works - ohh in a cluster, then don't
IPv6 on low end models, and then suddenly not on larger models
Fixed 100Mbit - full-duplex, fine with single device, with cluster - cannot specify on reth Gbit interface on SRX210H
etc.

But the things advertised as working ARE working, so when features become
available they are trustworthy.

I made the switch from ScreenOS and things are different, but mostly to the better :-)
so now I enjoy Junos very much.


Best regards

Henrik

--
Henrik Lund Kramsh?j, Follower of the Great Way of Unix
hlk at kramse.dk hlk at security6.net, +45 2026 6000 cand.scient CISSP CEH
http://solidonetworks.com/ Network Security is a business enabler
http://www.security6.net - security, IPv6 and networks
http://www.portscan.dk - free portscan








From gert at space.net  Mon May 17 09:58:26 2010
From: gert at space.net (Gert Doering)
Date: Mon, 17 May 2010 09:58:26 +0200
Subject: Decent IPv6 firewall with failover?
In-Reply-To: <5A6D953473350C4B9995546AFE9939EE09EA440E@RWC-EX1.corp.seven.com>
References: <5A6D953473350C4B9995546AFE9939EE09EA440B@RWC-EX1.corp.seven.com>
	<20100517073611.GX60850@Space.Net>
	<5A6D953473350C4B9995546AFE9939EE09EA440E@RWC-EX1.corp.seven.com>
Message-ID: <20100517075826.GA60850@Space.Net>

Hi,

On Mon, May 17, 2010 at 12:46:33AM -0700, George Bonser wrote:
> That is what I am leaning towards but I believe Juniper is trying to
> phase out the ScreenOS stuff

This matches what we are hearing, and we're not exactly happy about it.

But this is vendors for you :-(

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  150584

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 306 bytes
Desc: not available
Url : http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100517/9696ec54/attachment.bin 

From nick-lists at netability.ie  Mon May 17 12:08:08 2010
From: nick-lists at netability.ie (Nick Hilliard)
Date: Mon, 17 May 2010 11:08:08 +0100
Subject: DHCPv6 for IPv6 routing information,
	was Re: Mysterious missing DHCPv6 feature
In-Reply-To: <alpine.DEB.1.10.1005170943160.28457@uplift.swm.pp.se>
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<1274080537.14998.23721.camel@shane-asus-laptop>
	<alpine.DEB.1.10.1005170918460.28457@uplift.swm.pp.se>
	<20100517074011.GG23584@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170943160.28457@uplift.swm.pp.se>
Message-ID: <0255AF4E-89DB-4219-A686-5460049E24FC@netability.ie>

> IXes here in Europe primarily run in shared broadcast domains, and  
> they generally require RA to be turned off completely:
>
> http://www.ams-ix.net/allowed-traffic/

Of course, "require" is a voluntary thing.  Being an ixp operator, I  
would really really like RA guard implemented on my kit, so that  
accidents don't happen.

Nick


From nick-lists at netability.ie  Mon May 17 12:11:50 2010
From: nick-lists at netability.ie (Nick Hilliard)
Date: Mon, 17 May 2010 11:11:50 +0100
Subject: DHCPv6 for IPv6 routing information,
	was Re: Mysterious missing DHCPv6 feature
In-Reply-To: <alpine.DEB.1.10.1005170918460.28457@uplift.swm.pp.se>
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<1274080537.14998.23721.camel@shane-asus-laptop>
	<alpine.DEB.1.10.1005170918460.28457@uplift.swm.pp.se>
Message-ID: <3A51278F-B6C9-4DA6-AFBA-99962AE9FED0@netability.ie>

> People said that, but there was a big push to have DNS in RA and now  
> there is push to have routing in DHCPv6, so I think it'll happen,  
> we'll have quite a lot of overlap.

I love the idea of future aspiration here; that one day we'll have  
functional  ipv6 autoconfiguration, just not yet.

Nick


From shane at time-travellers.org  Mon May 17 12:18:34 2010
From: shane at time-travellers.org (Shane Kerr)
Date: Mon, 17 May 2010 18:18:34 +0800
Subject: DHCPv6 for IPv6 routing information, was Re: Mysterious
	missing DHCPv6 feature
In-Reply-To: <3A51278F-B6C9-4DA6-AFBA-99962AE9FED0@netability.ie>
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<1274080537.14998.23721.camel@shane-asus-laptop>
	<alpine.DEB.1.10.1005170918460.28457@uplift.swm.pp.se>
	<3A51278F-B6C9-4DA6-AFBA-99962AE9FED0@netability.ie>
Message-ID: <1274091514.14998.24432.camel@shane-asus-laptop>

Nick,

On Mon, 2010-05-17 at 11:11 +0100, Nick Hilliard wrote:
> > People said that, but there was a big push to have DNS in RA and now  
> > there is push to have routing in DHCPv6, so I think it'll happen,  
> > we'll have quite a lot of overlap.
> 
> I love the idea of future aspiration here; that one day we'll have  
> functional  ipv6 autoconfiguration, just not yet.

To be fair, it works today in most cases.

You need something sending RA - probably a router, but can also be a
server.

Some way to get addresses to the hosts - either via stateless
autoconfiguration via the RA or via DHCPv6. Both work today, pretty much
perfectly.

Something answering DHCPv6 requests to get basic networking
configuration. This can be stateless DHCPv6 in the case of
autoconfigured or CGA, or it can be stateful if you are using DHCPv6
that way.


Now, if you mean *prefix* autoconfiguration, we're not there yet... :)

--
Shane


From martin at millnert.se  Mon May 17 12:33:46 2010
From: martin at millnert.se (Martin Millnert)
Date: Mon, 17 May 2010 12:33:46 +0200
Subject: DHCPv6 for IPv6 routing information, was Re: Mysterious
	missing DHCPv6 feature
In-Reply-To: <0255AF4E-89DB-4219-A686-5460049E24FC@netability.ie>
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<1274080537.14998.23721.camel@shane-asus-laptop>
	<alpine.DEB.1.10.1005170918460.28457@uplift.swm.pp.se>
	<20100517074011.GG23584@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170943160.28457@uplift.swm.pp.se>
	<0255AF4E-89DB-4219-A686-5460049E24FC@netability.ie>
Message-ID: <1274092426.9218.40.camel@hsa.vpn.anti>

On Mon, 2010-05-17 at 11:08 +0100, Nick Hilliard wrote:
> Being an ixp operator, I would really really like RA guard implemented
> on my kit, so that accidents don't happen.
> 
> Nick

For an accident to happen, obviously both a device sending a RA and,
more importantly, a device accepting that RA is necessary.

Whether your stack accepts an RA or not is something the stack ought to
let you configure, like Linux does:
anticimex at hsa:~$ ls /proc/sys/net/ipv6/conf/eth0/accept_ra*
/proc/sys/net/ipv6/conf/eth0/accept_ra
/proc/sys/net/ipv6/conf/eth0/accept_ra_defrtr
/proc/sys/net/ipv6/conf/eth0/accept_ra_pinfo
/proc/sys/net/ipv6/conf/eth0/accept_ra_rt_info_max_plen
/proc/sys/net/ipv6/conf/eth0/accept_ra_rtr_pref

By this, my point is that accidents that don't kill the fabric could
conceivably be thought of as not-your-problem.  But then we leave the
engineers desk and enter the real world...

Cheers,
-- 
Martin Millnert <martin at millnert.se>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
Url : http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100517/03fb2399/attachment.bin 

From me at benedikt-stockebrand.de  Mon May 17 12:44:32 2010
From: me at benedikt-stockebrand.de (Benedikt Stockebrand)
Date: Mon, 17 May 2010 10:44:32 +0000
Subject: DHCPv6 for IPv6 routing information, was Re: Mysterious missing
	DHCPv6 feature
In-Reply-To: <20100517074011.GG23584@vacation.karoshi.com.>
	(bmanning@vacation.karoshi.com's
	message of "Mon, 17 May 2010 07:40:11 +0000")
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<1274080537.14998.23721.camel@shane-asus-laptop>
	<alpine.DEB.1.10.1005170918460.28457@uplift.swm.pp.se>
	<20100517074011.GG23584@vacation.karoshi.com.>
Message-ID: <sa7632mq033.fsf@benedikt-stockebrand.de>

Hi Bill and list,

bmanning at vacation.karoshi.com writes:

> 	what was hard to digest was the fact that the base IPv6 architeecture
> 	only works for about 85% of the existing use cases. That leaves about
> 	15% of existing, core use cases where the default IPv6 tool suite
> 	won't work as advertized or will screw up everything..

just out of curiosity---do you have any citable reference for those
numbers?

>       case in point,
> 	an internet exchange on shared media (yeah, these are increasingly rare
> 	but work w/ me here)  I've got a dozen routers on the same media, all
> 	running RA - telliing/shouting to all the other routers - NO, USE ME!

If you do the numbers, the overhead here is 2.2 bits/s/router
(advertising a single prefix, using Ethernet frames).  Even if you put
several hundred routers on a single link this should be negligible in
all but the most unusual cases.

More important, though: Why would anyone enable router discovery in an
all-router network?  All router implementations I've come across so
far treat router advertisements as a feature that can be enabled or
disabled independently of addresses or forwarding or whatever else.

> 	ND (neighboor discovery) has the same problems in a multi-homed network.

Sorry, but I can't follow you here.  What is so special about ND in a
multi-homed setup?

> 	It is for this reason, the other 15% that fall outside the "norm" that
> 	we need something like DHCP that is address family agnostic or I'm back to 
> 	hardcoding config data.

DHCP for legacy IPv4 has at least two serious legacy issues: Backward
compatibility with BOOTP and the need to start without a working
address.  Both of these issues are obviously irrelevant with IPv6, but
trying to be "address family agnostic" implies that the protocol you
think of will have to carry these legacy issues over to IPv6.

That said, the one design issue I have with DHCP on IPv6 is that I
still need relays in all client-inhabited subnets even for stateless
DHCP.  Maybe eventually somebody comes up with an updated spec that
allows clients to access ff05::1:3 (or another dedicated, routed MC
group) directly, but aside from that I am reasonably comfortable with
stateless DHCP the way it is.


Cheers,

    Benedikt

-- 
			 Business Grade IPv6
		    Consulting, Training, Projects

Benedikt Stockebrand, Dipl.-Inform.   http://www.benedikt-stockebrand.de/


From bmanning at vacation.karoshi.com  Mon May 17 12:54:50 2010
From: bmanning at vacation.karoshi.com (bmanning at vacation.karoshi.com)
Date: Mon, 17 May 2010 10:54:50 +0000
Subject: DHCPv6 for IPv6 routing information,
	was Re: Mysterious missing DHCPv6 feature
In-Reply-To: <1274091514.14998.24432.camel@shane-asus-laptop>
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<1274080537.14998.23721.camel@shane-asus-laptop>
	<alpine.DEB.1.10.1005170918460.28457@uplift.swm.pp.se>
	<3A51278F-B6C9-4DA6-AFBA-99962AE9FED0@netability.ie>
	<1274091514.14998.24432.camel@shane-asus-laptop>
Message-ID: <20100517105450.GB24875@vacation.karoshi.com.>

On Mon, May 17, 2010 at 06:18:34PM +0800, Shane Kerr wrote:
> Nick,
> 
> On Mon, 2010-05-17 at 11:11 +0100, Nick Hilliard wrote:
> > > People said that, but there was a big push to have DNS in RA and now  
> > > there is push to have routing in DHCPv6, so I think it'll happen,  
> > > we'll have quite a lot of overlap.
> > 
> > I love the idea of future aspiration here; that one day we'll have  
> > functional  ipv6 autoconfiguration, just not yet.
> 
> To be fair, it works today in most cases.
> 
> You need something sending RA - probably a router, but can also be a
> server.

	ok, I'll bite.  like a DHCP server?

> --
> Shane

From nick-lists at netability.ie  Mon May 17 13:09:02 2010
From: nick-lists at netability.ie (Nick Hilliard)
Date: Mon, 17 May 2010 12:09:02 +0100
Subject: DHCPv6 for IPv6 routing information,
	was Re: Mysterious missing DHCPv6 feature
In-Reply-To: <20100517105450.GB24875@vacation.karoshi.com.>
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<1274080537.14998.23721.camel@shane-asus-laptop>
	<alpine.DEB.1.10.1005170918460.28457@uplift.swm.pp.se>
	<3A51278F-B6C9-4DA6-AFBA-99962AE9FED0@netability.ie>
	<1274091514.14998.24432.camel@shane-asus-laptop>
	<20100517105450.GB24875@vacation.karoshi.com.>
Message-ID: <2564E5F4-64C7-4F56-AA69-61EB80F8E863@netability.ie>

>    ok, I'll bite.  like a DHCP server?

I think you're preaching to the converted here, Bill.  :-)

Nick


From Ken.Mix at clearfly.net  Mon May 17 16:09:55 2010
From: Ken.Mix at clearfly.net (Ken Mix)
Date: Mon, 17 May 2010 14:09:55 +0000
Subject: Decent IPv6 firewall with failover?
In-Reply-To: <5A6D953473350C4B9995546AFE9939EE09EA440D@RWC-EX1.corp.seven.com>
References: <5A6D953473350C4B9995546AFE9939EE09EA440B@RWC-EX1.corp.seven.com>
	<40r1v5d36v0bsmtki0g5vg1m9jnsk8oqtm@hojmark.net>
	<5A6D953473350C4B9995546AFE9939EE09EA440D@RWC-EX1.corp.seven.com>
Message-ID: <229C96C745D66240A5A89CF17D1D4987175DC2@gold.corp.clearfly.net>

FWIW - I am running a pair of 5520s [v8.2(2)] that does support IPv6 failover.  I upgraded specifically for this feature, and it has been passing live traffic for 3+ months now.  Configuration is as simple as specifying a standby IPv6 address in the interface, although it appears that an IPv4 address does have to be present for failover to work properly. 

Regards,

Ken

-----Original Message-----
From: ipv6-ops-bounces+ken.mix=clearfly.net at lists.cluenet.de [mailto:ipv6-ops-bounces+ken.mix=clearfly.net at lists.cluenet.de] On Behalf Of George Bonser
Sent: Monday, May 17, 2010 1:26 AM
To: Asbjorn Hojmark - Lists
Cc: ipv6-ops at lists.cluenet.de
Subject: RE: Decent IPv6 firewall with failover?



> -----Original Message-----
> From: Asbjorn Hojmark - Lists [mailto:lists at hojmark.org]
> Sent: Monday, May 17, 2010 12:17 AM
> To: George Bonser
> Cc: ipv6-ops at lists.cluenet.de
> Subject: Re: Decent IPv6 firewall with failover?
> 
> On Sun, 16 May 2010 23:52:56 -0700, you wrote:
> 
> > I notice the Cisco ASA series still doesn't do failover for IPv6
> > as of 8.3
> 
> New in 8.2:
> 
>
http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn8
> 2.html
> 
> "IPv6 Support in Failover Configurations: IPv6 is now supported in
> failover configurations. You can assign active and standby IPv6
> addresses to interfaces and use IPv6 addresses for the failover and
> Stateful Failover interfaces."
> 
> Isn't that what you want?
> 
> -A

Interesting.  Because here:
http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/r
oute_overview.html#wpxref71253

It says:

Failover does not support IPv6. The ipv6 address command does not
support setting standby addresses for failover configurations. The
failover interface ip command does not support using IPv6 addresses on
the failover and Stateful Failover interfaces.

So now I don't know what to believe.


From dwing at cisco.com  Mon May 17 21:16:03 2010
From: dwing at cisco.com (Dan Wing)
Date: Mon, 17 May 2010 12:16:03 -0700
Subject: DHCPv6 for IPv6 routing information,
	was Re: Mysterious missingDHCPv6 feature
In-Reply-To: <1274080537.14998.23721.camel@shane-asus-laptop>
References: <1274063932.14998.22742.camel@shane-asus-laptop><20100517041615.GA22939@vacation.karoshi.com.><alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se><20100517.084430.78711679.sthaug@nethelp.no>
	<1274080537.14998.23721.camel@shane-asus-laptop>
Message-ID: <023301caf5f5$646bf5f0$c4f0200a@cisco.com>

> -----Original Message-----
> From: ipv6-ops-bounces+dwing=cisco.com at lists.cluenet.de 
> [mailto:ipv6-ops-bounces+dwing=cisco.com at lists.cluenet.de] On 
> Behalf Of Shane Kerr
> Sent: Monday, May 17, 2010 12:16 AM
> To: sthaug at nethelp.no
> Cc: ipv6-ops at lists.cluenet.de
> Subject: DHCPv6 for IPv6 routing information, was Re: 
> Mysterious missingDHCPv6 feature
> 
> Steinar,
> 
> On Mon, 2010-05-17 at 08:44 +0200, sthaug at nethelp.no wrote:
> > > > 	DHCP to hand out DNS servers, NTP servers on 
> request, and do
> > > > 	dynamic update for the forward and reverse DNS maps.
> > > 
> > > And the new feature you were looking for was to hand out 
> a default-gw, 
> > > right? That's the "this" feature you were referring to 
> and IETF didn't 
> > > want to do?
> > 
> > I'm glad to see such patches (I'm tempted to say "about time").
> > 
> > I would of course be even happier to see a *standardized* 
> solution to
> > let DHCPv6 hand out a default gateway. The lack of such a 
> feature (and
> > the strong religious opposition to it in certain circles), 
> despite clear
> > statements from several big operators that they need it, is 
> one of the
> > significant factors hampering IPv6 deployment.
> 
> I used to be a DHCPv6 guy, although not so much any more. (I 
> was part of
> the three-man team that coded ISC's first DHCPv6 release a few years
> back.)
> 
> As I understand it, there was a persistent and insistent 
> group of people
> within the IETF that really, really, REALLY wanted DHCP to 
> not exist on
> IPv6 at all. I wasn't involved at all during those times, but I am led
> to believe this was largely a "zeroconf" push.
> 
> Remember the idea that IPv6 was going to autoconfigure everything, and
> no management would be necessary?
> 
>                     HAHAHAHAHAHAHAHAHAHAHAHAHAHA!!!
> 
> Honestly. Some people. I'm reminded of people who told me in 1990 that
> programing would go away because it would be so easy to make 
> software do
> what you wanted it to.
> 
> Anyway, whatever the reason, there is a group of DHCP-haters. 
> Especially
> in the IPv6 universe.
> 
> 
> 
> Having said that, the philosophy has been that for each problem we
> should have ONE protocol to solve it. This makes a certain amount of
> sense. With routing information, this is supposed to be router
> advertisements (RA). This is the argument against putting routing
> information in DHCPv6 (as I understand it).
> 
> Strangely, rather than saying "look we have DNS information 
> in DHCPv6 so
> we don't need it in RA", the tactic was taken to create a RA that
> includes DNS servers. Which sort of seems like TWO protocols 
> to solve a
> particular problem. Oh well, at least it's only EXPERIMENTAL 
> (RFC 5006).

Which is adding DNS search list (so it provides the same
information as the associated DHCPv6 RFC) and going standards 
track,
http://tools.ietf.org/html/draft-ietf-6man-dns-options-bis-00


> There does seem to be a draft for exactly this feature:
> 
> http://tools.ietf.org/html/draft-dec-dhcpv6-route-option-03

Which is doing almost the same thing as RFC4191, which uses
RAs.

> So there's hope for the future. The "intended status" is INFORMATIONAL
> though, and it hasn't been accepted as a working group item 
> yet, so who knows... :)

I understand the IETF's MIF working group has interest in 
draft-dec-dhcpv6-route-option.

-d


From nanog at 85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org  Tue May 18 00:21:50 2010
From: nanog at 85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org (Mark Smith)
Date: Tue, 18 May 2010 07:51:50 +0930
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100517.084430.78711679.sthaug@nethelp.no>
References: <1274063932.14998.22742.camel@shane-asus-laptop>
	<20100517041615.GA22939@vacation.karoshi.com.>
	<alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
Message-ID: <20100518075150.404fd6a6@opy.nosense.org>

On Mon, 17 May 2010 08:44:30 +0200 (CEST)
sthaug at nethelp.no wrote:

> > > 	DHCP to hand out DNS servers, NTP servers on request, and do
> > > 	dynamic update for the forward and reverse DNS maps.
> > 
> > And the new feature you were looking for was to hand out a default-gw, 
> > right? That's the "this" feature you were referring to and IETF didn't 
> > want to do?
> 
> I'm glad to see such patches (I'm tempted to say "about time").
> 
> I would of course be even happier to see a *standardized* solution to
> let DHCPv6 hand out a default gateway. The lack of such a feature (and
> the strong religious opposition to it in certain circles), despite clear
> statements from several big operators that they need it, is one of the
> significant factors hampering IPv6 deployment.
> 

I don't think so.

What I think is hampering deployment is people constantly discussing
and debating design decisions that they don't agree with, 10 to 15
years after they were made, rather than accepting them, and getting on
with deploying it. It may not be perfect in their opinion (and it
isn't in mine), but then usually nothing ever is - it's all about trade
offs. The pressing problem is deployment.

I'm also getting tired of the "the IETF didn't talk to us" arguement. If
the operators want to be listened to, they need *participate* in the
IETF, not complain about it. That means writing or reviewing Internet
Drafts, and posting well formed opinions about them if you have them.
In my experience, "The IETF" will listen to them, and if their
useful, place value on them, regardless of your background, or how silly
your email address looks. You might also get some credit in the
drafts/RFCs if you make a significant enough contribution.

(btw, I'd mostly much rather DHCPv6 didn't exist at all. It only really
exists in IPv6 because it exists in IPv4, and it only really exists in
IPv4 because IPv4's node addressing wasn't big enough to do autoconf,
unlike IPX's, DECNETs, CLNS etc. But people have got used to 'database
driven' address assignment, so it was inevitable that it'd exist in
IPv6)


From thegameiam at yahoo.com  Tue May 18 00:49:31 2010
From: thegameiam at yahoo.com (David Barak)
Date: Mon, 17 May 2010 15:49:31 -0700 (PDT)
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100518075150.404fd6a6@opy.nosense.org>
Message-ID: <464482.57725.qm@web31805.mail.mud.yahoo.com>


--- On Mon, 5/17/10, Mark Smith 
> What I think is hampering deployment is people constantly
> discussing
> and debating design decisions that they don't agree with,
> 10 to 15
> years after they were made, rather than accepting them, and
> getting on
> with deploying it. It may not be perfect in their opinion
> (and it
> isn't in mine), but then usually nothing ever is - it's all
> about trade
> offs. The pressing problem is deployment.
> 

toMAYto toMAHto.

One of the things about IPv4+DHCP which helped it really take off is the ability of providers + enterprises to regulate and monetize their interactions with their downstreams.  The IPv6 designers, in their infinite wisdom, chose to {ignore |disregard} the desires of organizations which have made significant infrastructure investments in this.  In that vein, they chose to make centralized decisions necessarily decentralized.  This is viewed as an improvement by some, but certainly not by all.

Are you honestly suggesting that this should be swallowed without comment?  What if the design decisions are in fact bad?  Why not try to fix the brokenness?

David Barak
Need Geek Rock?  Try The Franchise: 
http://www.listentothefranchise.com



      

From he at uninett.no  Tue May 18 07:36:44 2010
From: he at uninett.no (Havard Eidnes)
Date: Tue, 18 May 2010 07:36:44 +0200 (CEST)
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100518075150.404fd6a6@opy.nosense.org>
References: <alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<20100518075150.404fd6a6@opy.nosense.org>
Message-ID: <20100518.073644.23028119.he@uninett.no>

> > I would of course be even happier to see a *standardized* solution to
> > let DHCPv6 hand out a default gateway. The lack of such a feature (and
> > the strong religious opposition to it in certain circles), despite clear
> > statements from several big operators that they need it, is one of the
> > significant factors hampering IPv6 deployment.
>
> I don't think so.
>
> What I think is hampering deployment is people constantly discussing
> and debating design decisions that they don't agree with, 10 to 15
> years after they were made, rather than accepting them, and getting on
> with deploying it. It may not be perfect in their opinion (and it
> isn't in mine), but then usually nothing ever is - it's all about trade
> offs. The pressing problem is deployment.

The decision "only one protocol to implement a feature" or "only one
way to hand out addresses" can hardly be called a design decision.  To
me it sounds more like an article of faith.

Not being able to correct mis-designs after operator feedback because
"it was designed 10-15 years ago, so must now be perfect!" also
appears more as religious fervor rather than sound engineering.

Follow down this path, and we're doomed to do IPv4 NAT forever.
That's not a position I would like to see us end up in.

Regards,

- H?vard

From nick-lists at netability.ie  Tue May 18 11:43:44 2010
From: nick-lists at netability.ie (Nick Hilliard)
Date: Tue, 18 May 2010 10:43:44 +0100
Subject: Cisco 1801W, v6 on wireless, bvi argh.
In-Reply-To: <4BF0538D.2000005@netability.ie>
References: <24D585B4-F4CD-4CC6-AE98-46C1A3BEE4C7@nosignal.org>
	<4BF0538D.2000005@netability.ie>
Message-ID: <4BF26150.9030407@netability.ie>

On 16/05/2010 21:20, Nick Hilliard wrote:
> You didn't try 12.4(22)T, did you?  This bug was fixed in that version, and

I lied - the bug wasn't fixed in that version after all.

I could have sworn at the time that either this bugid or a similar bugid
was marked fixed in 12.4(22)T.  However, looking at the description for
CSCej50923, there's no fixed listed for 12.4T at all.  Same with bugid
CSCta27529, which was mentioned in:

http://puck.nether.net/pipermail/cisco-nsp/2009-September/064077.html

confused,
Nick

From me at benedikt-stockebrand.de  Tue May 18 11:48:15 2010
From: me at benedikt-stockebrand.de (Benedikt Stockebrand)
Date: Tue, 18 May 2010 09:48:15 +0000
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100518.073644.23028119.he@uninett.no> (Havard Eidnes's
	message of "Tue, 18 May 2010 07:36:44 +0200 (CEST)")
References: <alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<20100518075150.404fd6a6@opy.nosense.org>
	<20100518.073644.23028119.he@uninett.no>
Message-ID: <sa7hbm5v8v4.fsf@benedikt-stockebrand.de>

Hi list,

[Steinar Haug]
>> > I would of course be even happier to see a *standardized* solution to
>> > let DHCPv6 hand out a default gateway. The lack of such a feature (and
>> > the strong religious opposition to it in certain circles), despite clear
>> > statements from several big operators that they need it, is one of the
>> > significant factors hampering IPv6 deployment.

I disagree here.  From what I've seen so far the key problem with
regard to IPv6 is that a lot of people try to make IPv6 an "IPv4 with
larger addresses", preserving all the workarounds they have come to
get used to.  "We've always used DHCP", "I want my NAT back", "I've
always written IP addresses in decimal", "There can't be multiple
default routes in a routing table" and so on.

Unless I missed something, nobody in this discussion came up with an
explanation what's wrong about making ones default routers advertise
itself as such.

On the other hand, using autoconfiguration for this job has the
additional advantage that it allows one to provide redundant routers
without having to resort to HSRP or VRRP.  That sort of solution may
not be up to par in a data center setup, but it *is* helpful
especially at small business customers.

And I am not even bothering to bring up the operational issues address
allocation via DHCP brings into office style IPv4 networks.  Using
stateless DHCP is pretty much fine with me, but from an operational
point of view stateless address autoconfiguration is quite a step in
the right direction.

[Mark Smith]
>> I don't think so.
>>
>> What I think is hampering deployment is people constantly discussing
>> and debating design decisions that they don't agree with, 10 to 15
>> years after they were made, rather than accepting them, and getting on
>> with deploying it.

Almost:-).  I'd say it is perfectly valid to keep discussing design
decisions---but only as long as the impact of a design change at the
given point in time is given the appropriate degree of consideration.

>> It may not be perfect in their opinion (and it isn't in mine), but
>> then usually nothing ever is - it's all about trade offs. The
>> pressing problem is deployment.

Right.  And, just for completeness sake: If we can't get the specs to
stabilize, we can't deploy.

[Havard Eidnes]
> The decision "only one protocol to implement a feature" or "only one
> way to hand out addresses" can hardly be called a design decision.  To
> me it sounds more like an article of faith.

If you offer multiple protocols, or protocol features, for a single
feature, you'll eventually have to implement, support and configure
them all.  If you take a look at SIP you'll get an idea of this
problem.

> Not being able to correct mis-designs after operator feedback because
> "it was designed 10-15 years ago, so must now be perfect!" also
> appears more as religious fervor rather than sound engineering.

That's not what Mark wrote.

> Follow down this path, and we're doomed to do IPv4 NAT forever.
> That's not a position I would like to see us end up in.

If we keep disagreeing and messing around with the protocols over and
again, we're just as "doomed to do IPv4 NAT forever".


Cheers,

    Benedikt

-- 
			 Business Grade IPv6
		    Consulting, Training, Projects

Benedikt Stockebrand, Dipl.-Inform.   http://www.benedikt-stockebrand.de/


From otroan at employees.org  Tue May 18 11:58:20 2010
From: otroan at employees.org (Ole Troan)
Date: Tue, 18 May 2010 11:58:20 +0200
Subject: Cisco 1801W, v6 on wireless, bvi argh.
In-Reply-To: <4BF26150.9030407@netability.ie>
References: <24D585B4-F4CD-4CC6-AE98-46C1A3BEE4C7@nosignal.org>
	<4BF0538D.2000005@netability.ie> <4BF26150.9030407@netability.ie>
Message-ID: <8DB354A9-C161-461C-A787-EB7C8EA40E2C@employees.org>

>> You didn't try 12.4(22)T, did you?  This bug was fixed in that version, and
> 
> I lied - the bug wasn't fixed in that version after all.
> 
> I could have sworn at the time that either this bugid or a similar bugid
> was marked fixed in 12.4(22)T.  However, looking at the description for
> CSCej50923, there's no fixed listed for 12.4T at all.  Same with bugid
> CSCta27529, which was mentioned in:

CSCta27529 is integrated in 15.1T images.

cheers,
Ole


From nick-lists at netability.ie  Tue May 18 12:08:45 2010
From: nick-lists at netability.ie (Nick Hilliard)
Date: Tue, 18 May 2010 11:08:45 +0100
Subject: Cisco 1801W, v6 on wireless, bvi argh.
In-Reply-To: <8DB354A9-C161-461C-A787-EB7C8EA40E2C@employees.org>
References: <24D585B4-F4CD-4CC6-AE98-46C1A3BEE4C7@nosignal.org>
	<4BF0538D.2000005@netability.ie> <4BF26150.9030407@netability.ie>
	<8DB354A9-C161-461C-A787-EB7C8EA40E2C@employees.org>
Message-ID: <4BF2672D.9080508@netability.ie>

On 18/05/2010 10:58, Ole Troan wrote:
>>> You didn't try 12.4(22)T, did you?  This bug was fixed in that version, and
>>
>> I lied - the bug wasn't fixed in that version after all.
>>
>> I could have sworn at the time that either this bugid or a similar bugid
>> was marked fixed in 12.4(22)T.  However, looking at the description for
>> CSCej50923, there's no fixed listed for 12.4T at all.  Same with bugid
>> CSCta27529, which was mentioned in:
> 
> CSCta27529 is integrated in 15.1T images.

Both CSCej50923 and CSCta27529 are listed as being fixed in 15.1(0.1)T
onwards.  However, if as Andy claims there is no "bridge XXX route ipv6"
command in 15.1(1)T, then it looks like there's something odd going on.

If I can spare some office downtime over the next couple of days, I'll take
a look at some different images to see what the story is.

Nick

From nanog at 85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org  Tue May 18 12:08:41 2010
From: nanog at 85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org (Mark Smith)
Date: Tue, 18 May 2010 19:38:41 +0930
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100518.073644.23028119.he@uninett.no>
References: <alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<20100518075150.404fd6a6@opy.nosense.org>
	<20100518.073644.23028119.he@uninett.no>
Message-ID: <20100518193841.416fbd84@opy.nosense.org>

Hi Havard,

On Tue, 18 May 2010 07:36:44 +0200 (CEST)
Havard Eidnes <he at uninett.no> wrote:

> > > I would of course be even happier to see a *standardized* solution to
> > > let DHCPv6 hand out a default gateway. The lack of such a feature (and
> > > the strong religious opposition to it in certain circles), despite clear
> > > statements from several big operators that they need it, is one of the
> > > significant factors hampering IPv6 deployment.
> >
> > I don't think so.
> >
> > What I think is hampering deployment is people constantly discussing
> > and debating design decisions that they don't agree with, 10 to 15
> > years after they were made, rather than accepting them, and getting on
> > with deploying it. It may not be perfect in their opinion (and it
> > isn't in mine), but then usually nothing ever is - it's all about trade
> > offs. The pressing problem is deployment.
> 
> The decision "only one protocol to implement a feature" or "only one
> way to hand out addresses" can hardly be called a design decision.  To
> me it sounds more like an article of faith.
> 

It's an architectural principle of the Internet (RFC1958) -


3.2 If there are several ways of doing the same thing, choose one.
   If a previous design, in the Internet context or elsewhere, has
   successfully solved the same problem, choose the same solution unless
   there is a good technical reason not to.  Duplication of the same
   protocol functionality should be avoided as far as possible, without
   of course using this argument to reject improvements.

I don't believe DHCPv6 only verses RA+DHCPv6 is a significant
improvement, worth the additional costs. It doesn't save significant RAM
or packets, would require additional code - which means new and
different bugs, and causes more confusion as to what options to pick
when deploying IPv6.

> Not being able to correct mis-designs after operator feedback because
> "it was designed 10-15 years ago, so must now be perfect!" also
> appears more as religious fervor rather than sound engineering.
> 

Where did I say it was perfect? In fact I said I disagree with some
of the design. But it's too late to change it - that opportunity is
gone, and as long as what exists is adequate, I'll deploy it how it is.
I don't want tacked on, second system syndrome solutions to problems
that have already been solved adequately, which will only cause more
delay, additional deployment design solutions, and more problems due to
feature or parameter interaction.

> Follow down this path, and we're doomed to do IPv4 NAT forever.
> That's not a position I would like to see us end up in.
> 

That's exactly my point. IPv6 methods work. They may not work how some
people want them to, but tough, deployment of something that works is
more important now than trying to change design decisions that have
been in place for 10 to 15 years.

Regards,
Mark.

From me at benedikt-stockebrand.de  Tue May 18 12:57:24 2010
From: me at benedikt-stockebrand.de (Benedikt Stockebrand)
Date: Tue, 18 May 2010 10:57:24 +0000
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <464482.57725.qm@web31805.mail.mud.yahoo.com> (David Barak's
	message of "Mon, 17 May 2010 15:49:31 -0700 (PDT)")
References: <464482.57725.qm@web31805.mail.mud.yahoo.com>
Message-ID: <sa7d3wtv5nv.fsf@benedikt-stockebrand.de>

Hi David and list,

David Barak <thegameiam at yahoo.com> writes:

> toMAYto toMAHto.

this isn't elementary school.

> One of the things about IPv4+DHCP which helped it really take off is
> the ability of providers + enterprises to regulate and monetize
> their interactions with their downstreams.

Indeed.  

They only started to offer IP at all when their various proprietary
services (BTX in Germany, Minitel in France, CompuServe, AOL, MSN in
the US/worldwide, and so on) lost customers at a breathtaking speed.

And then they got the addresses from the RIRs for free and, at least
here in Germany, charged end customers 135 DM (roughly equivalent to
EUR 100 (USD 160?) these days) per month for a single static address.

The traditional carriers have quite a track history of making as much
money as they can with as little effort as possible.

> The IPv6 designers, in their infinite wisdom, chose to {ignore
> |disregard} the desires of organizations which have made significant
> infrastructure investments in this.

The IETF meetings are open to everyone willing to participate.  Those
enterprises should blame themselves for not bothering about IPv6 for
so long.

If there's one party that may be involuntarily underrepresented, then
it's the end users, who largely lack both the funding and technical
expertise to participate.

> In that vein, they chose to make centralized decisions
> necessarily decentralized.

Anybody is free to design and implement their own protocols.

But unless customers have changed since the early 1990s I doubt that
that protocol not generally supported are a feasible business model.

> This is viewed as an improvement by some, but certainly not by all.

Any change to the existing Internet, especially if its as "radical" as
IPv6, is a disadvantage to the organizations "which have made
significant infrastructure investments in this".

This is especially so because the Internet *is* changing, and if those
organizations believe they can stop these changes, they'll be overrun
by a new generation of better-value-for-less-money providers.

Tough, but that's the way how business in a free market works.

> Are you honestly suggesting that this should be swallowed without
> comment?

"Comment" is ok...

> What if the design decisions are in fact bad? 

... and so is asking these questions---in the right place ...

> Why not try to fix the brokenness?

... but showing up after ten or more years complaining that one's
existing business model isn't protected is not.

IPv6 deployment is long overdue.  Coming up with reasonings "but we
can do this slightly better if we do it another way" however is pretty
embarrassing at best.


Cheers,

    Benedikt

-- 
			 Business Grade IPv6
		    Consulting, Training, Projects

Benedikt Stockebrand, Dipl.-Inform.   http://www.benedikt-stockebrand.de/


From thegameiam at yahoo.com  Tue May 18 13:35:44 2010
From: thegameiam at yahoo.com (David Barak)
Date: Tue, 18 May 2010 04:35:44 -0700 (PDT)
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100518193841.416fbd84@opy.nosense.org>
Message-ID: <169090.81460.qm@web31812.mail.mud.yahoo.com>





--- On Tue, 5/18/10, Mark Smith <nanog at 85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org> wrote:

> It's an architectural principle of the Internet (RFC1958)
> -
> 
> 
> 3.2 If there are several ways of doing the same thing,
> choose one.
> ???If a previous design, in the Internet
> context or elsewhere, has
> ???successfully solved the same problem,
> choose the same solution unless
> ???there is a good technical reason not
> to.? Duplication of the same
> ???protocol functionality should be avoided
> as far as possible, without
> ???of course using this argument to reject
> improvements.
> 
> I don't believe DHCPv6 only verses RA+DHCPv6 is a
> significant
> improvement, worth the additional costs. It doesn't save
> significant RAM
> or packets, would require additional code - which means new
> and
> different bugs, and causes more confusion as to what
> options to pick
> when deploying IPv6.


Here we disagree.  In IPv4-land, a whole bunch of functions are handled via DHCP, and modifications in a simgle place (the DHCP server) can affect a whole bunch of remote clients without any other necessary changes.  RA+DHCPv6 requires congruent configurations in N places, where N >= 2 always, and for large scale enterprises N is much greater than 2.  Moving to a DHCP-only model would restore the business processes that many, many enterprises have built using centralized management, and would allow a single authoritative server to control their remote deployments.  That is a HUGE improvement over RA+DHCPv6, and arguments against it have a religious timbre rather than a technical one.

> That's exactly my point. IPv6 methods work *FOR SOME PEOPLE AND SOME VALUES OF "WORK"*. They may not
> work how some
> people want them to, but tough, deployment of something
> that works is
> more important now than trying to change design decisions
> that have
> been in place for 10 to 15 years.

Fixed that for you.  Seriously, that attitude - "hey, this works well enough for me, you should just suck it up and redesign your business process for your multiple million customer installed base" is part of the problem, not the solution.

David Barak
Need Geek Rock?  Try The Franchise: 
http://www.listentothefranchise.com


      

From nanog at 85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org  Tue May 18 14:17:55 2010
From: nanog at 85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org (Mark Smith)
Date: Tue, 18 May 2010 21:47:55 +0930
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <464482.57725.qm@web31805.mail.mud.yahoo.com>
References: <20100518075150.404fd6a6@opy.nosense.org>
	<464482.57725.qm@web31805.mail.mud.yahoo.com>
Message-ID: <20100518214755.7f64ce5f@opy.nosense.org>

On Mon, 17 May 2010 15:49:31 -0700 (PDT)
David Barak <thegameiam at yahoo.com> wrote:

> 
> --- On Mon, 5/17/10, Mark Smith 
> > What I think is hampering deployment is people constantly
> > discussing
> > and debating design decisions that they don't agree with,
> > 10 to 15
> > years after they were made, rather than accepting them, and
> > getting on
> > with deploying it. It may not be perfect in their opinion
> > (and it
> > isn't in mine), but then usually nothing ever is - it's all
> > about trade
> > offs. The pressing problem is deployment.
> > 
> 
> toMAYto toMAHto.
> 
> One of the things about IPv4+DHCP which helped it really take off is the ability of providers + enterprises to regulate and monetize their interactions with their downstreams.  The IPv6 designers, in their infinite wisdom, chose to {ignore |disregard} the desires of organizations which have made significant infrastructure investments in this.  In that vein, they chose to make centralized decisions necessarily decentralized.  This is viewed as an improvement by some, but certainly not by all.
> 

So where are your posts to the IETF IPv6 mailing lists, stating these
desires?

> Are you honestly suggesting that this should be swallowed without comment?  What if the design decisions are in fact bad?  Why not try to fix the brokenness?
> 

How do you know existing methods are broken? Have you deployed them? 


> David Barak
> Need Geek Rock?  Try The Franchise: 
> http://www.listentothefranchise.com
> 
> 
> 
>       

From nick-lists at netability.ie  Tue May 18 14:21:54 2010
From: nick-lists at netability.ie (Nick Hilliard)
Date: Tue, 18 May 2010 13:21:54 +0100
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100518214755.7f64ce5f@opy.nosense.org>
References: <20100518075150.404fd6a6@opy.nosense.org>	<464482.57725.qm@web31805.mail.mud.yahoo.com>
	<20100518214755.7f64ce5f@opy.nosense.org>
Message-ID: <4BF28662.80108@netability.ie>

On 18/05/2010 13:17, Mark Smith wrote:
> How do you know existing methods are broken? Have you deployed them? 

I have.  When I plug my computer into an ipv6 only network, I can't see any
interwebs.  Like it or not, this is how I define brokenness.

This conversation reached the end of its functional life many posts ago.

Can anyone interested in resurrecting it please move back to 2008 and
continue rambling there.

thank you,

Nick

From thegameiam at yahoo.com  Tue May 18 14:54:35 2010
From: thegameiam at yahoo.com (David Barak)
Date: Tue, 18 May 2010 05:54:35 -0700 (PDT)
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <sa7d3wtv5nv.fsf@benedikt-stockebrand.de>
Message-ID: <468940.30738.qm@web31814.mail.mud.yahoo.com>

--- On Tue, 5/18/10, Benedikt Stockebrand <me at benedikt-stockebrand.de> wrote:

> Any change to the existing Internet, especially if its as
> "radical" as
> IPv6, is a disadvantage to the organizations "which have
> made
> significant infrastructure investments in this".
> 
> This is especially so because the Internet *is* changing,
> and if those
> organizations believe they can stop these changes, they'll
> be overrun
> by a new generation of better-value-for-less-money
> providers.

To paraphrase Randy Bush, I encourage my competition to take this approach to service deployment.  

> 
> Tough, but that's the way how business in a free market
> works.
> 
> > Are you honestly suggesting that this should be
> swallowed without
> > comment?
> 
> "Comment" is ok...
> 
> > What if the design decisions are in fact bad? 
> 
> ... and so is asking these questions---in the right place
> ...
> 
> > Why not try to fix the brokenness?
> 
> ... but showing up after ten or more years complaining that
> one's
> existing business model isn't protected is not.
> IPv6 deployment is long overdue.? Coming up with
> reasonings "but we
> can do this slightly better if we do it another way"
> however is pretty
> embarrassing at best.

Some of us have been complaining about the brokenness of the IPv6 autoconf approach for a long time.  Check your archives, and you'll see that this is true.  For years, the response was "RA is sufficient, and will make DHCP obsolete."  Now that DHCPv6 is becoming a requirement, it is only a matter of time before every feature present in DHCPv4 is also present in DHCPv6.  This isn't about "protecting a business model" - it's about making very large scale deployments work *at scale*.  There is a *currently working* approach.  The burden of proof is on those who want things to be different, not on those who want it to be the same.

If you don't understand the difference between the complexity of a single centralized management server and that of a centralized management server plus N midpoints (where N ~= number of customers), then nothing I say is going to help: I encourage rereading RFC 1925.

But hey, if you think that's embarrassing, that's fine too.

David Barak
Need Geek Rock?  Try The Franchise: 
http://www.listentothefranchise.com



      

From rdroms at cisco.com  Tue May 18 15:09:28 2010
From: rdroms at cisco.com (Ralph Droms)
Date: Tue, 18 May 2010 09:09:28 -0400
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <468940.30738.qm@web31814.mail.mud.yahoo.com>
References: <468940.30738.qm@web31814.mail.mud.yahoo.com>
Message-ID: <37F50567-B956-4A90-B778-97F71DB4560D@cisco.com>

Discussion of default router and prefix advertisement options for  
DHCPv6 has been ongoing, in many fora.  Thomas Narten and I drafted a  
spec for those options: draft-droms-dhc-dhcpv6-default-router.  We had  
an open and frank discussion of the spec at IETF 74, San Francisco.   
In my opinion, the discussion was pretty much on the merits of the  
proposal and free of architectural preconceptions.  There was no  
sufficiently well-defined use case or supporting constituency to  
support moving forward with the draft.

So, if you want those options, bring it to the IETF and justify your  
case...

- Ralph


On May 18, 2010, at 8:54 AM 5/18/10, David Barak wrote:

> --- On Tue, 5/18/10, Benedikt Stockebrand <me at benedikt- 
> stockebrand.de> wrote:
>
>> Any change to the existing Internet, especially if its as
>> "radical" as
>> IPv6, is a disadvantage to the organizations "which have
>> made
>> significant infrastructure investments in this".
>>
>> This is especially so because the Internet *is* changing,
>> and if those
>> organizations believe they can stop these changes, they'll
>> be overrun
>> by a new generation of better-value-for-less-money
>> providers.
>
> To paraphrase Randy Bush, I encourage my competition to take this  
> approach to service deployment.
>
>>
>> Tough, but that's the way how business in a free market
>> works.
>>
>>> Are you honestly suggesting that this should be
>> swallowed without
>>> comment?
>>
>> "Comment" is ok...
>>
>>> What if the design decisions are in fact bad?
>>
>> ... and so is asking these questions---in the right place
>> ...
>>
>>> Why not try to fix the brokenness?
>>
>> ... but showing up after ten or more years complaining that
>> one's
>> existing business model isn't protected is not.
>> IPv6 deployment is long overdue.  Coming up with
>> reasonings "but we
>> can do this slightly better if we do it another way"
>> however is pretty
>> embarrassing at best.
>
> Some of us have been complaining about the brokenness of the IPv6  
> autoconf approach for a long time.  Check your archives, and you'll  
> see that this is true.  For years, the response was "RA is  
> sufficient, and will make DHCP obsolete."  Now that DHCPv6 is  
> becoming a requirement, it is only a matter of time before every  
> feature present in DHCPv4 is also present in DHCPv6.  This isn't  
> about "protecting a business model" - it's about making very large  
> scale deployments work *at scale*.  There is a *currently working*  
> approach.  The burden of proof is on those who want things to be  
> different, not on those who want it to be the same.
>
> If you don't understand the difference between the complexity of a  
> single centralized management server and that of a centralized  
> management server plus N midpoints (where N ~= number of customers),  
> then nothing I say is going to help: I encourage rereading RFC 1925.
>
> But hey, if you think that's embarrassing, that's fine too.
>
> David Barak
> Need Geek Rock?  Try The Franchise:
> http://www.listentothefranchise.com
>
>
>
>


From evyncke at cisco.com  Tue May 18 18:02:01 2010
From: evyncke at cisco.com (Eric Vyncke (evyncke))
Date: Tue, 18 May 2010 18:02:01 +0200
Subject: Yet another IPv6 deployment statistics
In-Reply-To: <4BED332E.3090500@unfix.org>
References: <AANLkTinH34CC45ayBZng25bLLCJOlQmbfKCC7qB3WC2T@mail.gmail.com><20100514110251.GG60850@Space.Net>
	<4BED332E.3090500@unfix.org>
Message-ID: <317616CE96204D49B5A1811098BA895001F75133@XMB-AMS-110.cisco.com>

http://www.vyncke.org/ipv6status/ (based on prior work from Mark Prior) daily runs some tests on multiple international (read non US :-)) sites and check whether there is any IPv6-enabled web, email and DNS servers for this site.

It aggregates the statistics by DNS TLD (assuming that TLD = a country -- I know gross estimation) and results are not really what I was expecting.

The top 25 sites (from Alexa) from several TLD are taken into consideration.

If you leave the mouse on green/orange box, some more data is displayed: RTT, MTU, MSS, ...

I really welcome any comment and suggestion

Hope this helps

-?ric

PS: the issue with US as a country is that there are not so many US sites having a .US domain name :-( 

From gert at space.net  Tue May 18 18:08:32 2010
From: gert at space.net (Gert Doering)
Date: Tue, 18 May 2010 18:08:32 +0200
Subject: Yet another IPv6 deployment statistics
In-Reply-To: <317616CE96204D49B5A1811098BA895001F75133@XMB-AMS-110.cisco.com>
References: <AANLkTinH34CC45ayBZng25bLLCJOlQmbfKCC7qB3WC2T@mail.gmail.com>
	<20100514110251.GG60850@Space.Net> <4BED332E.3090500@unfix.org>
	<317616CE96204D49B5A1811098BA895001F75133@XMB-AMS-110.cisco.com>
Message-ID: <20100518160832.GB60850@Space.Net>

Hi Eric,

On Tue, May 18, 2010 at 06:02:01PM +0200, Eric Vyncke (evyncke) wrote:
> http://www.vyncke.org/ipv6status/ (based on prior work from Mark Prior) 
> daily runs some tests on multiple international (read non US :-)) sites 
> and check whether there is any IPv6-enabled web, email and DNS servers 
> for this site.

Nice work.  (You might want to extend this to the top100 from Alexa, this
might catch some of the german sites... :-) - but even then, it will still
be in the single-digit percent values).

> ... and results are not really what I was expecting.

It's definitely very frustrating, but I have to admit, I'm not overly
surprised :-( - it's all a big game of pretending that IPv6 is not
relevant, IPv6 does not exist, IPv6 is too expensive, IPv6 won't be
necessary, ...

OTOH, .NL is good.  "3 out of 25 sites in Alexa Top 25 have enabled IPv6
and it did not harm their business - so *that* excuse is just lame, now
go and find a new one" :-)

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  150584

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

From drixter at e-utp.net  Tue May 18 18:05:43 2010
From: drixter at e-utp.net (Marcin Gondek)
Date: Tue, 18 May 2010 18:05:43 +0200
Subject: Yet another IPv6 deployment statistics
In-Reply-To: <317616CE96204D49B5A1811098BA895001F75133@XMB-AMS-110.cisco.com>
References: <AANLkTinH34CC45ayBZng25bLLCJOlQmbfKCC7qB3WC2T@mail.gmail.com><20100514110251.GG60850@Space.Net>
	<4BED332E.3090500@unfix.org>
	<317616CE96204D49B5A1811098BA895001F75133@XMB-AMS-110.cisco.com>
Message-ID: <1531a8073cb5da1c6920d5b747919af0@127.0.0.1>

On Tue, 18 May 2010 18:02:01 +0200, "Eric Vyncke (evyncke)"
<evyncke at cisco.com> wrote:

> http://www.vyncke.org/ipv6status/ (based on prior work from Mark Prior)
> daily runs some tests on multiple international (read non US :-)) sites
and
> check whether there is any IPv6-enabled web, email and DNS servers for
this
> site.
> It aggregates the statistics by DNS TLD (assuming that TLD = a country
--
> I know gross estimation) and results are not really what I was
expecting.
> The top 25 sites (from Alexa) from several TLD are taken into
> consideration.
> If you leave the mouse on green/orange box, some more data is displayed:
> RTT, MTU, MSS, ...
> 
> I really welcome any comment and suggestion

No Poland, no .NET, .COM, .ORG domains :-/

-- 
Marcin Gondek / Drixter
e-utp.net
NIP: PL1181589645
REGON: 140584662
Tel. +48602159929
Fax. +48222012418
office at e-utp.net
http://www.e-utp.net

From evyncke at cisco.com  Tue May 18 20:04:57 2010
From: evyncke at cisco.com (Eric Vyncke (evyncke))
Date: Tue, 18 May 2010 20:04:57 +0200
Subject: Yet another IPv6 deployment statistics
In-Reply-To: <1531a8073cb5da1c6920d5b747919af0@127.0.0.1>
References: <AANLkTinH34CC45ayBZng25bLLCJOlQmbfKCC7qB3WC2T@mail.gmail.com><20100514110251.GG60850@Space.Net><4BED332E.3090500@unfix.org><317616CE96204D49B5A1811098BA895001F75133@XMB-AMS-110.cisco.com>
	<1531a8073cb5da1c6920d5b747919af0@127.0.0.1>
Message-ID: <317616CE96204D49B5A1811098BA895001F75182@XMB-AMS-110.cisco.com>

Adding .PL (or any other country TLD is trivial -- consider it done for .PL) but I wonder whether there is something useful to add multi-country, fuzzy defined TLD such as .NET or .COM or .ORG. I would rather add specific sites in .NET .COM .ORG in specific countries, of course, a manual process :-(

> -----Original Message-----
> From: ipv6-ops-bounces+evyncke=cisco.com at lists.cluenet.de [mailto:ipv6-ops-
> bounces+evyncke=cisco.com at lists.cluenet.de] On Behalf Of Marcin Gondek
> Sent: mardi 18 mai 2010 18:06
> To: ipv6-ops at lists.cluenet.de
> Subject: Re: Yet another IPv6 deployment statistics
> 
> On Tue, 18 May 2010 18:02:01 +0200, "Eric Vyncke (evyncke)"
> <evyncke at cisco.com> wrote:
> 
> > http://www.vyncke.org/ipv6status/ (based on prior work from Mark Prior)
> > daily runs some tests on multiple international (read non US :-)) sites
> and
> > check whether there is any IPv6-enabled web, email and DNS servers for
> this
> > site.
> > It aggregates the statistics by DNS TLD (assuming that TLD = a country
> --
> > I know gross estimation) and results are not really what I was
> expecting.
> > The top 25 sites (from Alexa) from several TLD are taken into
> > consideration.
> > If you leave the mouse on green/orange box, some more data is displayed:
> > RTT, MTU, MSS, ...
> >
> > I really welcome any comment and suggestion
> 
> No Poland, no .NET, .COM, .ORG domains :-/
> 
> --
> Marcin Gondek / Drixter
> e-utp.net
> NIP: PL1181589645
> REGON: 140584662
> Tel. +48602159929
> Fax. +48222012418
> office at e-utp.net
> http://www.e-utp.net

From dougb at dougbarton.us  Wed May 19 02:35:30 2010
From: dougb at dougbarton.us (Doug Barton)
Date: Tue, 18 May 2010 17:35:30 -0700
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <sa7d3wtv5nv.fsf@benedikt-stockebrand.de>
References: <464482.57725.qm@web31805.mail.mud.yahoo.com>
	<sa7d3wtv5nv.fsf@benedikt-stockebrand.de>
Message-ID: <4BF33252.1070103@dougbarton.us>

On 5/18/2010 3:57 AM, Benedikt Stockebrand wrote:
>
> ... but showing up after ten or more years complaining that one's
> existing business model isn't protected is not.

I actually agreed with a lot of what you wrote, but here is where I take
exception. I actually DID say "No one is going to deploy IPv6 in an
enterprise network without DHCP that looks substantially like it does in
IPv4, and supports the same options." I was shouted down LOUDLY by the
autoconf religious zealots, so I went away. I had a lot of company in
both regards (what I said, and not bothering to keep saying it since no
one was listening).

I (and others) have continued to try to say these things periodically
over the past decade, and we continue to get shouted down, although less
loudly nowadays. Eventually I think this debate (DHCP vs. RA) will go
the same way IPv6 PI space did, religious zealots dragged kicking and
screaming into reality by those who are more interested in seeing IPv6
actually deployed.

> IPv6 deployment is long overdue.  Coming up with reasonings "but we
> can do this slightly better if we do it another way" however is pretty
> embarrassing at best.

You're attempting to minimize the significance of the arguments you
don't agree with, which is a fine rhetorical technique, but not very
useful from an operational perspective. Whether you agree with the
reasons enterprises want DHCP or not, enough folks have repeated those
reasons often enough at this point that by disregarding or diminishing
them it only makes you look foolish, and out of touch.

In no particular order, the main reasons enterprises like DHCP:
1. It allows them to configure multiple aspects of Host Configuration,
not just the bare minimums required for connectivity.
2. Configuring one (or at most a few) DHCP servers is easier than
configuring many routers.
3. The administrative domains covered by network administration and
those who configure DHCP are often different, and the needs of the
latter are often more dynamic (pardon the pun) which requires fast
response times to meet effectiveness goals.
4. Security concerns related to rogue/misconfigured RA messages. (This
is the everyone fails instantly vs. only failing when you renew your
lease problem.) Yes, I know that RA guard is "almost done," but the
concern remains valid.

Telling enterprise users, "But this is a New Thing(TM), so you have to
learn (read spend money on) new ways of doing things" is going to
continue to get you the same response it has for the last 10 years, "No
thanks, we'll just use NAT."

It's actually really important to understand this, since there is
ABSOLUTELY no argument you can advance for why IPv6 is "better" that is
persuasive here. Even in a world where 99.99999% of the content "on the
intarwebz" is available ONLY over IPv6, IPv6 NAT at the border of their
IPv4-only network will work just as well for them as NAT at the border
of their IPv4-only network works for them now.


hth,

Doug

-- 

	... and that's just a little bit of history repeating.
			-- Propellerheads

	Improve the effectiveness of your Internet presence with
	a domain name makeover!    http://SupersetSolutions.com/


From mloftis at wgops.com  Wed May 19 04:03:55 2010
From: mloftis at wgops.com (Michael Loftis)
Date: Tue, 18 May 2010 20:03:55 -0600
Subject: Mysterious missing DHCPv6 feature, was Re: How does one
	obtain	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <4BF33252.1070103@dougbarton.us>
References: <464482.57725.qm@web31805.mail.mud.yahoo.com>
	<sa7d3wtv5nv.fsf@benedikt-stockebrand.de>
	<4BF33252.1070103@dougbarton.us>
Message-ID: <B4CD0533886CDA2AA537E898@[192.168.1.100]>



--On Tuesday, May 18, 2010 5:35 PM -0700 Doug Barton <dougb at dougbarton.us> 
wrote:

> On 5/18/2010 3:57 AM, Benedikt Stockebrand wrote:
>>
>> ... but showing up after ten or more years complaining that one's
>> existing business model isn't protected is not.
>
> I actually agreed with a lot of what you wrote, but here is where I take
> exception. I actually DID say "No one is going to deploy IPv6 in an
> enterprise network without DHCP that looks substantially like it does in
> IPv4, and supports the same options." I was shouted down LOUDLY by the
> autoconf religious zealots, so I went away. I had a lot of company in
> both regards (what I said, and not bothering to keep saying it since no
> one was listening).

I also have to chime in with a "Me Too" on Doug's statements.  autoconf/RA 
doesn't even come close to solving the problems that DHCP does.  They're in 
entirely different problem spaces, and in some orgs, they're in different 
administrative domains.  Not having a fully featured/feature parity with 
DHCP(v4) DHCPv6 is absolutely going to hurt IPv6 deployment.  Only the most 
simple scenarios work with the mish-mash of autoconf, RA, and ND that is 
being pushed for IPv6.  And it's for the exact reasons mentioned, DHCP goes 
*beyond* the connectivity bare minimums, which is VERY necessary in many 
situations, and DHCP has been found to be a reliable, extendable, scalable, 
and well understood method for doing this dynamic configuration. 
Surprise....DHCP does what it's supposed to.  Having/not having full DHCPv6 
should not be left to the (core) networking people, because by and large 
they're NOT the ones that care about DHCP, it's those involved with 
deployment, management, and maintaining of workstations.

I think that's the root of the issue there, too many of the people who will 
actually be using IPv6 haven't been involved in certain aspects of the 
process that they really needed to be heard and involved in.  And partly 
because they don't see the problem with continuing to use IPv4(+NAT/PAT).



From rdroms at cisco.com  Wed May 19 04:20:12 2010
From: rdroms at cisco.com (Ralph Droms)
Date: Tue, 18 May 2010 22:20:12 -0400
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <B4CD0533886CDA2AA537E898@[192.168.1.100]>
References: <464482.57725.qm@web31805.mail.mud.yahoo.com>
	<sa7d3wtv5nv.fsf@benedikt-stockebrand.de>
	<4BF33252.1070103@dougbarton.us>
	<B4CD0533886CDA2AA537E898@[192.168.1.100]>
Message-ID: <F1C1B711-F253-4566-A66F-7607885E252C@cisco.com>

The doc is written: draft-droms-dhc-dhcpv6-default-router  Make the  
case; send text for use cases; we're happy to add authors.  Bring  
support for the doc to the IETF and get the doc adopted as aWG work  
item.

- Ralph


On May 18, 2010, at 10:03 PM 5/18/10, Michael Loftis wrote:

>
>
> --On Tuesday, May 18, 2010 5:35 PM -0700 Doug Barton <dougb at dougbarton.us 
> > wrote:
>
>> On 5/18/2010 3:57 AM, Benedikt Stockebrand wrote:
>>>
>>> ... but showing up after ten or more years complaining that one's
>>> existing business model isn't protected is not.
>>
>> I actually agreed with a lot of what you wrote, but here is where I  
>> take
>> exception. I actually DID say "No one is going to deploy IPv6 in an
>> enterprise network without DHCP that looks substantially like it  
>> does in
>> IPv4, and supports the same options." I was shouted down LOUDLY by  
>> the
>> autoconf religious zealots, so I went away. I had a lot of company in
>> both regards (what I said, and not bothering to keep saying it  
>> since no
>> one was listening).
>
> I also have to chime in with a "Me Too" on Doug's statements.   
> autoconf/RA doesn't even come close to solving the problems that  
> DHCP does.  They're in entirely different problem spaces, and in  
> some orgs, they're in different administrative domains.  Not having  
> a fully featured/feature parity with DHCP(v4) DHCPv6 is absolutely  
> going to hurt IPv6 deployment.  Only the most simple scenarios work  
> with the mish-mash of autoconf, RA, and ND that is being pushed for  
> IPv6.  And it's for the exact reasons mentioned, DHCP goes *beyond*  
> the connectivity bare minimums, which is VERY necessary in many  
> situations, and DHCP has been found to be a reliable, extendable,  
> scalable, and well understood method for doing this dynamic  
> configuration. Surprise....DHCP does what it's supposed to.  Having/ 
> not having full DHCPv6 should not be left to the (core) networking  
> people, because by and large they're NOT the ones that care about  
> DHCP, it's those involved with deployment, management, and  
> maintaining of workstations.
>
> I think that's the root of the issue there, too many of the people  
> who will actually be using IPv6 haven't been involved in certain  
> aspects of the process that they really needed to be heard and  
> involved in.  And partly because they don't see the problem with  
> continuing to use IPv4(+NAT/PAT).
>
>


From ben at bjencks.net  Wed May 19 04:50:42 2010
From: ben at bjencks.net (Ben Jencks)
Date: Tue, 18 May 2010 22:50:42 -0400
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain an 
	IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <4BF33252.1070103@dougbarton.us>
References: <464482.57725.qm@web31805.mail.mud.yahoo.com>
	<sa7d3wtv5nv.fsf@benedikt-stockebrand.de>
	<4BF33252.1070103@dougbarton.us>
Message-ID: <AANLkTimUHmMCxo4VLWtOujSufKRNUQawoReiEkXmYMP2@mail.gmail.com>

On Tue, May 18, 2010 at 20:35, Doug Barton <dougb at dougbarton.us> wrote:
> On 5/18/2010 3:57 AM, Benedikt Stockebrand wrote:
>>
>> ... but showing up after ten or more years complaining that one's
>> existing business model isn't protected is not.
>
> I actually agreed with a lot of what you wrote, but here is where I take
> exception. I actually DID say "No one is going to deploy IPv6 in an
> enterprise network without DHCP that looks substantially like it does in
> IPv4, and supports the same options." I was shouted down LOUDLY by the
> autoconf religious zealots, so I went away. I had a lot of company in
> both regards (what I said, and not bothering to keep saying it since no
> one was listening).
>
> I (and others) have continued to try to say these things periodically
> over the past decade, and we continue to get shouted down, although less
> loudly nowadays. Eventually I think this debate (DHCP vs. RA) will go
> the same way IPv6 PI space did, religious zealots dragged kicking and
> screaming into reality by those who are more interested in seeing IPv6
> actually deployed.

Admittedly, I came into this late, only a couple years ago, but I
haven't seen anyone arguing DHCP vs. RA. Rather, I've seen one side
arguing that DHCP+RA is a perfectly good solution, and it's what we
have now, and the other side arguing that RA is Evil and should be
eliminated in favor of pure DHCP.

The debate is getting tiresome, though. Every time anyone brings up
even a semi-valid point on one side, people on the other side trot out
the same tired arguments against all the invalid points they've seen
over and over, turning it into the exact same debate we have every
month. I'll try to keep my arguments to the points you actually
raised.

[snip]

> In no particular order, the main reasons enterprises like DHCP:
> 1. It allows them to configure multiple aspects of Host Configuration,
> not just the bare minimums required for connectivity.

Yes... DHCPv6 is standardized and works perfectly well, in conjunction with RAs.

> 2. Configuring one (or at most a few) DHCP servers is easier than
> configuring many routers.

You have to configure those routers with their addresses and prefixes
anyway, otherwise they won't be able to route. The Managed Address
Configuration flag is the only extra information you need to configure
on the routers. And the relay agent needs configuring regardless of
whether RA is used or not.

> 3. The administrative domains covered by network administration and
> those who configure DHCP are often different, and the needs of the
> latter are often more dynamic (pardon the pun) which requires fast
> response times to meet effectiveness goals.

See #1.

> 4. Security concerns related to rogue/misconfigured RA messages. (This
> is the everyone fails instantly vs. only failing when you renew your
> lease problem.) Yes, I know that RA guard is "almost done," but the
> concern remains valid.

Some people consider that failure mode a feature, not a bug (lets you
see cause/effect more easily), but either way, it's hard to take
seriously a complaint of "if you configure it wrong it doesn't work".
Luckily, most of the frequently changing information is on the DHCP
server, so the routers can be under stricter change control. For the
rogue RA issue, RA guard really is the solution, and I find it bizarre
that it started so recently -- did people even 5 years ago really
believe that key management would be a solved problem and everyone
would use SeND?

The only use case that I've seen that DHCPv4 satisfies and DHCPv6+RA
doesn't is where different hosts on the same subnet need different
default routers. Something like draft-droms-dhc-dhcpv6-default-router
or draft-dec-dhcpv6-route-option-02 could satisfy that use case.

-Ben

From michael at rancid.berkeley.edu  Wed May 19 19:36:39 2010
From: michael at rancid.berkeley.edu (Michael Sinatra)
Date: Wed, 19 May 2010 10:36:39 -0700
Subject: xkcd commentary on v4 -> v6 migration
Message-ID: <4BF421A7.7060201@rancid.berkeley.edu>

A sysadmin here at UCB alerted me to today's xkcd comic:

http://xkcd.com/742/

If you mouse over the comic, you get the humorous IPv4 commentary.

michael

From gdolley at arpnetworks.com  Thu May 20 01:21:14 2010
From: gdolley at arpnetworks.com (Garry Dolley)
Date: Wed, 19 May 2010 16:21:14 -0700
Subject: xkcd commentary on v4 -> v6 migration
In-Reply-To: <4BF421A7.7060201@rancid.berkeley.edu>
References: <4BF421A7.7060201@rancid.berkeley.edu>
Message-ID: <20100519232114.GA27683@garry-thinkpad.arpnetworks.com>

On Wed, May 19, 2010 at 10:36:39AM -0700, Michael Sinatra wrote:
> A sysadmin here at UCB alerted me to today's xkcd comic:
>
> http://xkcd.com/742/
>
> If you mouse over the comic, you get the humorous IPv4 commentary.

LOL, that's awesome :)

-- 
Garry Dolley
ARP Networks, Inc. | http://www.arpnetworks.com | (818) 206-0181
Data center, VPS, and IP Transit solutions
Member Los Angeles County REACT, Unit 336 | WQGK336
Blog http://scie.nti.st

From frnkblk at iname.com  Thu May 20 16:24:11 2010
From: frnkblk at iname.com (Frank Bulk - iName.com)
Date: Thu, 20 May 2010 09:24:11 -0500
Subject: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABoh5VD8VypSLqcY/KCKOCvAQAAAAA=@iname.com>
References: <1273813186.14998.8476.camel@shane-asus-laptop>		<C8131676.1B1D9%s.ewing@aussiehq.com.au>		<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABN1Vzy0JMPT57tl6Hh9eiCAQAAAAA=@iname.com>		<AANLkTilqI94T9ILkGqStp3Nw2xa-oxHI_GHU3ZQjoH2e@mail.gmail.com>	<AANLkTimVN2X2FVx2s3G2h5-gTDej2lMKn1VScvUkelTS@mail.gmail.com>
	<!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABoh5VD8VypSLqcY/KCKOCvAQAAAAA=@iname.com>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAACQnKXioIb3RLxYDgaS0YvdAQAAAAA=@iname.com>

Cisco TAC confirmed that it's not possible today to obtain a IPv6 DNS
server, and so they have opened enhancement CSCtg92043 to address this
feature gap.

Regards,

Frank

-----Original Message-----
From: ipv6-ops-bounces+frnkblk=iname.com at lists.cluenet.de
[mailto:ipv6-ops-bounces+frnkblk=iname.com at lists.cluenet.de] On Behalf Of
Frank Bulk
Sent: Friday, May 14, 2010 7:34 AM
To: 'Andrew Yourtchenko'; Ben Jencks
Cc: Shaun Ewing; Shane Kerr; ipv6-ops at lists.cluenet.de
Subject: RE: How does one obtain an IPv6 DNS server when VPNing to an ASA?

No, I don't plan to get rid of our IPv4 DNS server, but if it's not there,
it's a gap in a full feature set.

I will open a TAC case on this.

Frank

-----Original Message-----
From: Andrew Yourtchenko [mailto:ayourtch at gmail.com] 
Sent: Friday, May 14, 2010 3:53 AM
To: Ben Jencks
Cc: frnkblk at iname.com; Shaun Ewing; Shane Kerr; ipv6-ops at lists.cluenet.de
Subject: Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?

<snip>

>From the config - since you give out both IPv4 and IPv6 - just
dual-stack the recursive DNS server, and use IPv4 towards the clients
?

Or you plan to get rid of IPv4 completely for those clients ?

cheers,
andrew



From frnkblk at iname.com  Sat May 22 04:35:44 2010
From: frnkblk at iname.com (Frank Bulk)
Date: Fri, 21 May 2010 21:35:44 -0500
Subject: Windows 2003 DNS server's IPv6 support
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABOgTAFcSYhT7Udx2WvaCf+AQAAAAA=@iname.com>

>From my initial testing it looks like Windows 2003's DNS server listens on
an IPv6 address, but won't initiate requests to the root servers, etc on
IPv6.  When I did a v6 dig from a *nix box while doing a packet capture on
the Windows 2003 server, I saw the UDP request for onlyv6.com, but the DNS
server's queries to the root server for the NS records and all subsequent
queries were v4.  The result was "no servers could be reached".

Can anyone else confirm this behavior?  Is that resolved in Windows 2008?

Frank


From Sean.Siler at microsoft.com  Sat May 22 10:27:30 2010
From: Sean.Siler at microsoft.com (Sean Siler)
Date: Sat, 22 May 2010 08:27:30 +0000
Subject: Windows 2003 DNS server's IPv6 support
In-Reply-To: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABOgTAFcSYhT7Udx2WvaCf+AQAAAAA=@iname.com>
References: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABOgTAFcSYhT7Udx2WvaCf+AQAAAAA=@iname.com>
Message-ID: <726B24CA0C7F494795894989DCF1FE013887E12F@TK5EX14MBXC123.redmond.corp.microsoft.com>

On your Win2K3 Server, run the following command:

dnscmd /config /EnableIPv6 1

That will allow DNS to use IPv6 instead of IPv4.  In Windows Server 2008 and 2008 R2, that command isn't necessary; they allow v6 or v4 communications by default.



Sean Siler
Microsoft IPv6 Guy

-----Original Message-----
From: ipv6-ops-bounces+sean.siler=microsoft.com at lists.cluenet.de [mailto:ipv6-ops-bounces+sean.siler=microsoft.com at lists.cluenet.de] On Behalf Of Frank Bulk
Sent: Friday, May 21, 2010 19:36
To: ipv6-ops at lists.cluenet.de
Subject: Windows 2003 DNS server's IPv6 support

>From my initial testing it looks like Windows 2003's DNS server listens 
>on
an IPv6 address, but won't initiate requests to the root servers, etc on IPv6.  When I did a v6 dig from a *nix box while doing a packet capture on the Windows 2003 server, I saw the UDP request for onlyv6.com, but the DNS server's queries to the root server for the NS records and all subsequent queries were v4.  The result was "no servers could be reached".

Can anyone else confirm this behavior?  Is that resolved in Windows 2008?

Frank



From frnkblk at iname.com  Sat May 22 22:08:33 2010
From: frnkblk at iname.com (Frank Bulk)
Date: Sat, 22 May 2010 15:08:33 -0500
Subject: Windows 2003 DNS server's IPv6 support
In-Reply-To: <726B24CA0C7F494795894989DCF1FE013887E12F@TK5EX14MBXC123.redmond.corp.microsoft.com>
References: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABOgTAFcSYhT7Udx2WvaCf+AQAAAAA=@iname.com>
	<726B24CA0C7F494795894989DCF1FE013887E12F@TK5EX14MBXC123.redmond.corp.microsoft.com>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAADTk8+hJh5EQKCj6ppj6NO3AQAAAAA=@iname.com>

Thanks.  I did that already, and restarted the service, but the iterative
commands are still IPv4.  I also verified that EnableIPv6 = 1 is in the
registry, too.

Frank

-----Original Message-----
From: Sean Siler [mailto:Sean.Siler at microsoft.com] 
Sent: Saturday, May 22, 2010 3:28 AM
To: frnkblk at iname.com; ipv6-ops at lists.cluenet.de
Subject: RE: Windows 2003 DNS server's IPv6 support

On your Win2K3 Server, run the following command:

dnscmd /config /EnableIPv6 1

That will allow DNS to use IPv6 instead of IPv4.  In Windows Server 2008 and
2008 R2, that command isn't necessary; they allow v6 or v4 communications by
default.

Sean Siler
Microsoft IPv6 Guy

-----Original Message-----
From: ipv6-ops-bounces+sean.siler=microsoft.com at lists.cluenet.de
[mailto:ipv6-ops-bounces+sean.siler=microsoft.com at lists.cluenet.de] On
Behalf Of Frank Bulk
Sent: Friday, May 21, 2010 19:36
To: ipv6-ops at lists.cluenet.de
Subject: Windows 2003 DNS server's IPv6 support

>From my initial testing it looks like Windows 2003's DNS server listens 
>on
an IPv6 address, but won't initiate requests to the root servers, etc on
IPv6.  When I did a v6 dig from a *nix box while doing a packet capture on
the Windows 2003 server, I saw the UDP request for onlyv6.com, but the DNS
server's queries to the root server for the NS records and all subsequent
queries were v4.  The result was "no servers could be reached".

Can anyone else confirm this behavior?  Is that resolved in Windows 2008?

Frank



From frnkblk at iname.com  Sat May 22 22:08:46 2010
From: frnkblk at iname.com (Frank Bulk)
Date: Sat, 22 May 2010 15:08:46 -0500
Subject: Windows 2003 DNS server's IPv6 support
In-Reply-To: <726B24CA0C7F494795894989DCF1FE013887E12F@TK5EX14MBXC123.redmond.corp.microsoft.com>
References: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABOgTAFcSYhT7Udx2WvaCf+AQAAAAA=@iname.com>
	<726B24CA0C7F494795894989DCF1FE013887E12F@TK5EX14MBXC123.redmond.corp.microsoft.com>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAADTk8+hJh5EQKCj6ppj6NO3AQAAAAA=@iname.com>

Thanks.  I did that already, and restarted the service, but the iterative
commands are still IPv4.  I also verified that EnableIPv6 = 1 is in the
registry, too.

Frank

-----Original Message-----
From: Sean Siler [mailto:Sean.Siler at microsoft.com] 
Sent: Saturday, May 22, 2010 3:28 AM
To: frnkblk at iname.com; ipv6-ops at lists.cluenet.de
Subject: RE: Windows 2003 DNS server's IPv6 support

On your Win2K3 Server, run the following command:

dnscmd /config /EnableIPv6 1

That will allow DNS to use IPv6 instead of IPv4.  In Windows Server 2008 and
2008 R2, that command isn't necessary; they allow v6 or v4 communications by
default.

Sean Siler
Microsoft IPv6 Guy

-----Original Message-----
From: ipv6-ops-bounces+sean.siler=microsoft.com at lists.cluenet.de
[mailto:ipv6-ops-bounces+sean.siler=microsoft.com at lists.cluenet.de] On
Behalf Of Frank Bulk
Sent: Friday, May 21, 2010 19:36
To: ipv6-ops at lists.cluenet.de
Subject: Windows 2003 DNS server's IPv6 support

>From my initial testing it looks like Windows 2003's DNS server listens 
>on
an IPv6 address, but won't initiate requests to the root servers, etc on
IPv6.  When I did a v6 dig from a *nix box while doing a packet capture on
the Windows 2003 server, I saw the UDP request for onlyv6.com, but the DNS
server's queries to the root server for the NS records and all subsequent
queries were v4.  The result was "no servers could be reached".

Can anyone else confirm this behavior?  Is that resolved in Windows 2008?

Frank




From me at benedikt-stockebrand.de  Mon May 24 20:27:37 2010
From: me at benedikt-stockebrand.de (Benedikt Stockebrand)
Date: Mon, 24 May 2010 18:27:37 +0000
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <4BF33252.1070103@dougbarton.us> (Doug Barton's message of
	"Tue, 18 May 2010 17:35:30 -0700")
References: <464482.57725.qm@web31805.mail.mud.yahoo.com>
	<sa7d3wtv5nv.fsf@benedikt-stockebrand.de>
	<4BF33252.1070103@dougbarton.us>
Message-ID: <sa78w7917fq.fsf@benedikt-stockebrand.de>

Hi Doug and list,

sorry for the late and rather hasty reply, but I'm just between
conferences.

Doug Barton <dougb at dougbarton.us> writes:

> You're attempting to minimize the significance of the arguments you
> don't agree with, which is a fine rhetorical technique, but not very
> useful from an operational perspective.

Actually, no.  What seems to you like a "fine rhetorical technique" is
apparently a misunderstanding.  Let's get straight about what I was
talking about: Distributing a *default route* via DHCP.  That's a
functionality already available via Autoconfiguration.

I have never said that using (stateless) DHCP for application layer
configuration was a bad move.  In fact I consider the combination of
Autoconfiguration (for network layer configuration) and stateless DHCP
(for application layer configuration) the way to go.

I suppose that kind of disqualifies me as an "Autoconf zealot":-)

Unfortunately, at least David Barak seems to believe that anybody who
considers stateful DHCP inferior to Autoconf wants to get rid of DHCP
entirely.

> Whether you agree with the reasons enterprises want DHCP or not,
> enough folks have repeated those reasons often enough at this point
> that by disregarding or diminishing them it only makes you look
> foolish, and out of touch.

Maybe.  But maybe I've seen too many people who want IPv6 to be
nothing more than "IPv4 with longer addresses".

> In no particular order, the main reasons enterprises like DHCP:
> 1. It allows them to configure multiple aspects of Host Configuration,
> not just the bare minimums required for connectivity.

So does Autoconfiguration and stateless DHCP.

> 2. Configuring one (or at most a few) DHCP servers is easier than
> configuring many routers.

The way DHCPv6 works, you still have to set up DHCP relays in all
subnets.

> 3. The administrative domains covered by network administration and
> those who configure DHCP are often different, and the needs of the
> latter are often more dynamic (pardon the pun) which requires fast
> response times to meet effectiveness goals.

Hmm, from my personal experience I usually found it quite tedious to
first deal with the network people and then with the server people to
get a new subnet up and running.  But that may be a matter of personal
experience.

What I consider a more important reasoning is that Autoconf takes care
of network layer configuration (ignoring this rather questionable
approach to deploy DNS related information via Autoconf) while
stateless DHCP, with vendor extensions and all, takes care of the
application side.  Keeping these two separated appears quite
reasonable to me.

> 4. Security concerns related to rogue/misconfigured RA messages. (This
> is the everyone fails instantly vs. only failing when you renew your
> lease problem.) Yes, I know that RA guard is "almost done," but the
> concern remains valid.

I agree that that's a point, but there's a tendency towards a "many
small subnet" topology where only few machines are affected by that
scenario.  (Sorry, there's more to say about this, but I'm running out
of time right now.)

An issue with stateful DHCPv6 is that it uses routed traffic and as
such is more or less vulnerable to remote attacks.  Autoconfiguration
is inherently limited to link-local scope.

In security sensitive contexts I actually recommend to configure a
stateless DHCP server (rather than relay) in every subnet, provided
that the routers used can be used for this.  Doing so however requires
a bit of scripting to ensure that the DHCP data is managed centrally.

> Telling enterprise users, "But this is a New Thing(TM), so you have to
> learn (read spend money on) new ways of doing things" is going to
> continue to get you the same response it has for the last 10 years, "No
> thanks, we'll just use NAT."

There are increasingly more people actually setting up IPv6
internally, and using proxies to communicate with the outside.  This
is partly due to the impact of Windows 7, including Direct Access and
Home Groups.

> It's actually really important to understand this, since there is
> ABSOLUTELY no argument you can advance for why IPv6 is "better" that is
> persuasive here.

Actually, there are two: Additional functionality and reduced costs.

As I said, some functionality is only available with IPv6.

At another customer I recently got them moving towards IPv6 by simply
pointing out that this would get them rid of the problems they
currently have with NAT; they mentioned that at least in one case they
have to cross for consecutive NAT gateways "in the wrong way".  This
is costing them actual money.

Reliability, or, more generally, expenses are what makes managers do
things.

> Even in a world where 99.99999% of the content "on the
> intarwebz" is available ONLY over IPv6, IPv6 NAT at the border of their
> IPv4-only network will work just as well for them as NAT at the border
> of their IPv4-only network works for them now.

(I suppose you mean protocol translation, and possibly proxies, not
(IPv4) NAT.)

Your reasoning assumes that you can get both at the same cost.  NAT
gateways, proxies and NAT-PT stuff all cost significant money,
especially if you count the "opportunity costs" in when they fail.
And from the experience with large scale NAT gateways I have serious
doubts that these coses are negligible.

Yet another issue is actually running out of addresses.  That's not
much of an issue in the U.S., and not too much of an issue here in
central Europe, but the situation is worse in the LACNIC, AfriNIC and
APNIC regions.

If you have to pay twice as much for IPv4, then you'll move to IPv6.
If you can't get any static IPv4 addresses but need them, you'll move
to IPv6, too.


Cheers,

    Benedikt

-- 
			 Business Grade IPv6
		    Consulting, Training, Projects

Benedikt Stockebrand, Dipl.-Inform.   http://www.benedikt-stockebrand.de/


From dougb at dougbarton.us  Mon May 24 21:42:30 2010
From: dougb at dougbarton.us (Doug Barton)
Date: Mon, 24 May 2010 12:42:30 -0700 (PDT)
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <sa78w7917fq.fsf@benedikt-stockebrand.de>
References: <464482.57725.qm@web31805.mail.mud.yahoo.com>
	<sa7d3wtv5nv.fsf@benedikt-stockebrand.de>
	<4BF33252.1070103@dougbarton.us>
	<sa78w7917fq.fsf@benedikt-stockebrand.de>
Message-ID: <alpine.BSF.2.00.1005241223170.3582@qbhto.arg>

On Mon, 24 May 2010, Benedikt Stockebrand wrote:

> Hi Doug and list,
>
> sorry for the late and rather hasty reply, but I'm just between
> conferences.

No problem, for me that life was recent enough that I still remember 
what it was like, and long enough ago that most of the involuntary 
muscle contractions have subsided. :)

> Doug Barton <dougb at dougbarton.us> writes:
>
>> You're attempting to minimize the significance of the arguments you
>> don't agree with, which is a fine rhetorical technique, but not very
>> useful from an operational perspective.
>
> Actually, no.  What seems to you like a "fine rhetorical technique" is
> apparently a misunderstanding.  Let's get straight about what I was
> talking about: Distributing a *default route* via DHCP.  That's a
> functionality already available via Autoconfiguration.

And what many of us have said, repeatedly over the last decade, is that 
we would like to be able to run our networks with DHCP only, and not 
have to enable RA at all.

> I have never said that using (stateless) DHCP for application layer
> configuration was a bad move.  In fact I consider the combination of
> Autoconfiguration (for network layer configuration) and stateless DHCP
> (for application layer configuration) the way to go.
>
> I suppose that kind of disqualifies me as an "Autoconf zealot":-)

That puts you in tier 2 of autoconf zealotry, at least in my book. The 
fact that you don't seem to be able to imagine a world with no RA 
prevents you from being disqualified altogether. Although I would 
happily stand corrected if I'm wrong.

[snipping here to get to the juicy bits]

>> 3. The administrative domains covered by network administration and
>> those who configure DHCP are often different, and the needs of the
>> latter are often more dynamic (pardon the pun) which requires fast
>> response times to meet effectiveness goals.
>
> Hmm, from my personal experience I usually found it quite tedious to
> first deal with the network people and then with the server people to
> get a new subnet up and running.  But that may be a matter of personal
> experience.
>
> What I consider a more important reasoning is that Autoconf takes care
> of network layer configuration (ignoring this rather questionable
> approach to deploy DNS related information via Autoconf) while
> stateless DHCP, with vendor extensions and all, takes care of the
> application side.  Keeping these two separated appears quite
> reasonable to me.

That's great, but what I've been trying to get across for a long time 
now is that it really doesn't matter how clever your argument is, how 
much YOU think it's reasonable, etc. The fact is that a lot of large 
enterprises won't even LOOK at IPv6 for their internal networks because 
they don't want to unravel the administrative procedures that they 
already have in place, and that are already working well for them.

>> Telling enterprise users, "But this is a New Thing(TM), so you have to
>> learn (read spend money on) new ways of doing things" is going to
>> continue to get you the same response it has for the last 10 years, "No
>> thanks, we'll just use NAT."
>
> There are increasingly more people actually setting up IPv6
> internally, and using proxies to communicate with the outside.  This
> is partly due to the impact of Windows 7, including Direct Access and
> Home Groups.
>
>> It's actually really important to understand this, since there is
>> ABSOLUTELY no argument you can advance for why IPv6 is "better" that is
>> persuasive here.
>
> Actually, there are two: Additional functionality and reduced costs.
>
> As I said, some functionality is only available with IPv6.

Can you point some out? References would be fine here. I'd love to have 
some actual ammunition that I can point people to when they ask me why 
they should bother deploying IPv6.

> At another customer I recently got them moving towards IPv6 by simply
> pointing out that this would get them rid of the problems they
> currently have with NAT; they mentioned that at least in one case they
> have to cross for consecutive NAT gateways "in the wrong way".  This
> is costing them actual money.

I assume you meant "four" there, and if so I would assert that their v4 
network architecture was bad and not meeting their needs to begin with, 
so at that point tearing it all down and starting over with IPv6 is not 
that great of a marginal expense.

> Reliability, or, more generally, expenses are what makes managers do
> things.
>
>> Even in a world where 99.99999% of the content "on the
>> intarwebz" is available ONLY over IPv6, IPv6 NAT at the border of their
>> IPv4-only network will work just as well for them as NAT at the border
>> of their IPv4-only network works for them now.
>
> (I suppose you mean protocol translation, and possibly proxies, not
> (IPv4) NAT.)

I'm using "NAT" in a generic sense here, yes.

> Your reasoning assumes that you can get both at the same cost.  NAT
> gateways, proxies and NAT-PT stuff all cost significant money,
> especially if you count the "opportunity costs" in when they fail.
> And from the experience with large scale NAT gateways I have serious
> doubts that these coses are negligible.

But the costs and upgrade activity (read, pain) are all contained in one 
silo, the network administration group. Compared to the costs associated 
with rolling new things out to every desktop, re-architecting existing 
networks, etc.; whatever costs are involved with setting up IPv6 
compatibility at the border of the internal network are minuscule.

> Yet another issue is actually running out of addresses.  That's not
> much of an issue in the U.S., and not too much of an issue here in
> central Europe, but the situation is worse in the LACNIC, AfriNIC and
> APNIC regions.

I'm talking internal networks here. Lots of 1918 space available.


Doug

-- 

 	Improve the effectiveness of your Internet presence with
 	a domain name makeover!    http://SupersetSolutions.com/

 	Computers are useless. They can only give you answers.
 			-- Pablo Picasso


From dougb at dougbarton.us  Mon May 24 21:50:43 2010
From: dougb at dougbarton.us (Doug Barton)
Date: Mon, 24 May 2010 12:50:43 -0700 (PDT)
Subject: So why is "IPv4 with longer addresses" a problem anyway?
Message-ID: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>

On Mon, 24 May 2010, Benedikt Stockebrand wrote:
>
> Doug Barton <dougb at dougbarton.us> writes:
>
>> Whether you agree with the reasons enterprises want DHCP or not,
>> enough folks have repeated those reasons often enough at this point
>> that by disregarding or diminishing them it only makes you look
>> foolish, and out of touch.
>
> Maybe.  But maybe I've seen too many people who want IPv6 to be
> nothing more than "IPv4 with longer addresses".

I'm responding to this bit separately because I think it deserves its
own topic. I hear this all the time, and I'm genuinely curious about the 
answer to this question.

Given all the churn in network protocols that was happening in the 90's 
already I have a theory that if "we" had simply done "IPv4 with longer 
addresses" in the first place that IPNG would have been deployed almost 
immediately and all the energy and drama that's been spent on trying to 
make it more than that could have been better spent elsewhere.

So my question is, other than longer addresses, what are the benefits to 
IPv6 that I can point clients to which will help them justify the 
expense of the upgrade?


Doug

-- 

 	Improve the effectiveness of your Internet presence with
 	a domain name makeover!    http://SupersetSolutions.com/

 	Computers are useless. They can only give you answers.
 			-- Pablo Picasso


From tedm at ipinc.net  Mon May 24 22:27:45 2010
From: tedm at ipinc.net (Ted Mittelstaedt)
Date: Mon, 24 May 2010 13:27:45 -0700
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <alpine.BSF.2.00.1005241223170.3582@qbhto.arg>
References: <464482.57725.qm@web31805.mail.mud.yahoo.com>	<sa7d3wtv5nv.fsf@benedikt-stockebrand.de>	<4BF33252.1070103@dougbarton.us>	<sa78w7917fq.fsf@benedikt-stockebrand.de>
	<alpine.BSF.2.00.1005241223170.3582@qbhto.arg>
Message-ID: <4BFAE141.2070605@ipinc.net>



On 5/24/2010 12:42 PM, Doug Barton wrote:
> On Mon, 24 May 2010, Benedikt Stockebrand wrote:
>
>> Yet another issue is actually running out of addresses. That's not
>> much of an issue in the U.S., and not too much of an issue here in
>> central Europe, but the situation is worse in the LACNIC, AfriNIC and
>> APNIC regions.
>
> I'm talking internal networks here. Lots of 1918 space available.
>

Hi All,

   Let me jump in here with my $0.02

   I am VERY hard-pressed to imagine a business or corporate network
that would have a layout or technical reason that they would have to
dual-stack IPv6 internally on more than a handful of systems.

   I can, of course, easily imagine an academic network that had to be
dual-stacked.

    I can also imagine a company like, for example, Cisco, which as
they are getting money selling IPv6 solutions, that they would for
purely marketing and political reasons, mandate dual-stacking internally.

   But for your typical non-high-tech company, uh uh.  Most of this
crowd can probably get away with an application-level web proxy that
allows their inside privately-numbered IPv4 host access to any IPv6-only
websites that might be out on the Internet in the coming years, without
dual-stacking -anything- internal.

   Obviously, this isn't going to last forever.  But you would be
surprised at how long older networking technologies last.  The Netatalk
package is still in wide use to support older System 9 Macs.  There are 
even still people using the decade-old MARS software with IPX.

   There is no pressing need for most corporate networks to run
into IPv6 for internal networks -if- they have an IPv4 network that is 
doing everything for them that they want, and they have the money to
pony up for an application-level web proxy.  Nor is there really a need
among the Internet for them to do this - with the exception of people
wanting to create new products that are dependent solely on IPv6 from
server to client.

Ted

From tedm at ipinc.net  Mon May 24 22:40:59 2010
From: tedm at ipinc.net (Ted Mittelstaedt)
Date: Mon, 24 May 2010 13:40:59 -0700
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
Message-ID: <4BFAE45B.1060808@ipinc.net>



On 5/24/2010 12:50 PM, Doug Barton wrote:

>
> So my question is, other than longer addresses, what are the benefits to
> IPv6 that I can point clients to which will help them justify the
> expense of the upgrade?
>

I think this is the wrong way to look at it.

If your client's looking at moving to IPv6 as carrying a significant 
expense, then I think that your going about it the wrong way.

What your client should be doing is demanding IPv6 in all NEW
applications and devices they are fielding.  If they don't have
IPv6 support among all hosts in their current network then I'm
sure they have some hosts with IPv6 support.  Any Win Vista & 7 system 
would have IPv6 support for example.

Ultimately the day will come that some external reason - perhaps there's
a website they want to get at that's IPv6 only, perhaps there's a new
application that demands IPv6 - will make them want IPv6.

At that time, if they have been properly purchasing things, then just
about everything they have will be IPv6-compliant, and turning it on
will merely involve some labor.

Does your client have Win 2003 servers for example?  Do they have Macs?
Well, if they have W2003 servers but no Macs, then one day they might
end up buying a Mac - and on that day, discover some of the limitations
of using the SMB client in MacOS X to access those Win 2003 servers.  On
that day they would be pleasantly surprised to find that Win2003 server
has had the capability of providing AFP services to that new Mac all
this time.  Maybe they didn't spec AFP as a requirement when they bought
that 2003 license - but I guarantee you that somebody did, which is why
Microsoft stuck it in there.

Getting your client "ready" for IPv6 merely means educating them a bit.
A little bit of education injected into purchasing decisions can do a
tremendous amount.


Ted

From gert at space.net  Wed May 26 19:53:58 2010
From: gert at space.net (Gert Doering)
Date: Wed, 26 May 2010 19:53:58 +0200
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
Message-ID: <20100526175358.GM68820@Space.Net>

Hi,

On Mon, May 24, 2010 at 12:50:43PM -0700, Doug Barton wrote:
> So my question is, other than longer addresses, what are the benefits to 
> IPv6 that I can point clients to which will help them justify the 
> expense of the upgrade?

Money saved in "no longer working around the limitations of IPv4".

Things like forced-NAT (because you can't get enough addresses, not because
you consider NAT a useful tool), address collisions in VPN setups, address
collisions on company mergers, endless hassle with IPv4 subnet sizing
(it's always too small or too big in hindsight) - this is causing hidden
costs that people won't notice until they take a close look at IPv6 and
find out "oh, there is no need to haggle about subnet sizes anymore, wow!".

All the nice bits like SeND, CGAs, SLAAC, etc., are a consequence of
"having (MUCH) longer addresses"...

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  150584

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

From alan.batie at peakinternet.com  Wed May 26 20:05:11 2010
From: alan.batie at peakinternet.com (Alan Batie)
Date: Wed, 26 May 2010 11:05:11 -0700
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <20100526175358.GM68820@Space.Net>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
	<20100526175358.GM68820@Space.Net>
Message-ID: <4BFD62D7.9080703@peakinternet.com>

On 5/26/10 10:53 AM, Gert Doering wrote:

> Money saved in "no longer working around the limitations of IPv4".
> 
> this is causing hidden
> costs that people won't notice until they take a close look at IPv6 and
> find out "oh, there is no need to haggle about subnet sizes anymore, wow!".

Amen to that --- working with IPv6 is like taking off a straight-jacket
in a closet and moving into a mansion.  There may still be some
construction going on in one or another wing, but it's still a vast
improvement.

From andy at nosignal.org  Wed May 26 20:31:08 2010
From: andy at nosignal.org (Andy Davidson)
Date: Wed, 26 May 2010 19:31:08 +0100
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
Message-ID: <9AAE6366-7974-4F42-9707-FF9A1CF28E87@nosignal.org>


On 24 May 2010, at 20:50, Doug Barton wrote:

> So my question is, other than longer addresses, what are the benefits to IPv6 that I can point clients to which will help them justify the expense of the upgrade?

For me, it's that one day, we'll get to bin the v4 swamp.

Andy




From aaronh at bind.com  Wed May 26 20:45:32 2010
From: aaronh at bind.com (Aaron Hughes)
Date: Wed, 26 May 2010 11:45:32 -0700
Subject: [ipv6-ops]  Re: So why is "IPv4 with longer addresses" a
	problem anyway?
In-Reply-To: <9AAE6366-7974-4F42-9707-FF9A1CF28E87@nosignal.org>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
	<9AAE6366-7974-4F42-9707-FF9A1CF28E87@nosignal.org>
Message-ID: <20100526184532.GB14781@trace.bind.com>

Doug,

- Survivability
- End to end reachability
- Guaranteed uniqueness
- Some added security (everyone will be forced to address security without NAT in place)
- IPv4 space will become very expensive post RIR exhaustion.
- IPv6 allows for longer term architecture (allocations and assignment) planning.
- Filtering is easier
- Regional aggregation is easier
- TE (Traffic Engineering) is easier
- You will likely never haver to go back to your provider or registry for more IP resources.
- Today, IPv6 transit is free -> $inexpensive
- When the day comes (first IPv6 only reachable content/eyeballs come online, you will reach them.
- Client / eyeball / content analysis gives more accurate data
- From the end user perspective, real IP addresses for all objects. (no more pay for or small subs)

While this is a list of perfectly justifiable reasons, the key factor to selling this to your clients is survivability. This will cost money, it will take time, it will cause problems while migrating, but must be done. We don't run IPX/SPX, AppleTalk, thin net, X.25, Windows 3.1(tcpman.exe), etc anymore because the technology is no longer good enough. IPv4 is no longer good enough for us either as the resource will simply run out. This run-out has many significant impacts to our costs, routing infrastructure, tracking abilities, etc and will have to be addressed (pardon the pun) sooner or later. The later we embrace, the more it costs us over the long term.

Hope this is helpful.

Cheers,
Aaron




On Wed, May 26, 2010 at 07:31:08PM +0100, Andy Davidson wrote:
> 
> On 24 May 2010, at 20:50, Doug Barton wrote:
> 
> > So my question is, other than longer addresses, what are the benefits to IPv6 that I can point clients to which will help them justify the expense of the upgrade?
> 
> For me, it's that one day, we'll get to bin the v4 swamp.
> 
> Andy
> 
> 

-- 

Aaron Hughes 
aaronh at bind.com
+1-831-824-4161
Key fingerprint = AD 67 37 60 7D 73 C5 B7 33 18 3F 36 C3 1C C6 B8
http://www.bind.com/

From frnkblk at iname.com  Wed May 26 22:35:21 2010
From: frnkblk at iname.com (Frank Bulk - iName.com)
Date: Wed, 26 May 2010 15:35:21 -0500
Subject: Windows 2003 DNS server's IPv6 support
In-Reply-To: <726B24CA0C7F494795894989DCF1FE013887E12F@TK5EX14MBXC123.redmond.corp.microsoft.com>
References: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAABOgTAFcSYhT7Udx2WvaCf+AQAAAAA=@iname.com>
	<726B24CA0C7F494795894989DCF1FE013887E12F@TK5EX14MBXC123.redmond.corp.microsoft.com>
Message-ID: <!&!AAAAAAAAAAAuAAAAAAAAAKTyXRN5/+lGvU59a+P7CFMBAN6gY+ZG84BMpVQcAbDh1IQAAAATbSgAABAAAACG6INMftoOTaKRekZJ5XHyAQAAAAA=@iname.com>

Sean confirmed with his DNS folk that the W2K03 DNS server does not
*originate* IPv6 requests, so records for domain names that have IPv6-only
glue will not succeed (i.e. onlyv6.com).  W2K08 does not have this
limitation.

Frank

-----Original Message-----
From: Sean Siler [mailto:Sean.Siler at microsoft.com] 
Sent: Saturday, May 22, 2010 3:28 AM
To: frnkblk at iname.com; ipv6-ops at lists.cluenet.de
Subject: RE: Windows 2003 DNS server's IPv6 support

On your Win2K3 Server, run the following command:

dnscmd /config /EnableIPv6 1

That will allow DNS to use IPv6 instead of IPv4.  In Windows Server 2008 and
2008 R2, that command isn't necessary; they allow v6 or v4 communications by
default.



Sean Siler
Microsoft IPv6 Guy

-----Original Message-----
From: ipv6-ops-bounces+sean.siler=microsoft.com at lists.cluenet.de
[mailto:ipv6-ops-bounces+sean.siler=microsoft.com at lists.cluenet.de] On
Behalf Of Frank Bulk
Sent: Friday, May 21, 2010 19:36
To: ipv6-ops at lists.cluenet.de
Subject: Windows 2003 DNS server's IPv6 support

>From my initial testing it looks like Windows 2003's DNS server listens 
>on
an IPv6 address, but won't initiate requests to the root servers, etc on
IPv6.  When I did a v6 dig from a *nix box while doing a packet capture on
the Windows 2003 server, I saw the UDP request for onlyv6.com, but the DNS
server's queries to the root server for the NS records and all subsequent
queries were v4.  The result was "no servers could be reached".

Can anyone else confirm this behavior?  Is that resolved in Windows 2008?

Frank



From nanog at 85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org  Wed May 26 23:32:05 2010
From: nanog at 85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org (Mark Smith)
Date: Thu, 27 May 2010 07:02:05 +0930
Subject: [ipv6-ops]  Re: So why is "IPv4 with longer addresses" a
	problem anyway?
In-Reply-To: <20100526184532.GB14781@trace.bind.com>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
	<9AAE6366-7974-4F42-9707-FF9A1CF28E87@nosignal.org>
	<20100526184532.GB14781@trace.bind.com>
Message-ID: <20100527070205.690e8cdb@opy.nosense.org>

On Wed, 26 May 2010 11:45:32 -0700
Aaron Hughes <aaronh at bind.com> wrote:

> Doug,
> 
> - Survivability
> - End to end reachability
> - Guaranteed uniqueness
> - Some added security (everyone will be forced to address security without NAT in place)
> - IPv4 space will become very expensive post RIR exhaustion.
> - IPv6 allows for longer term architecture (allocations and assignment) planning.
> - Filtering is easier
> - Regional aggregation is easier
> - TE (Traffic Engineering) is easier
> - You will likely never haver to go back to your provider or registry for more IP resources.
> - Today, IPv6 transit is free -> $inexpensive
> - When the day comes (first IPv6 only reachable content/eyeballs come online, you will reach them.
> - Client / eyeball / content analysis gives more accurate data
> - From the end user perspective, real IP addresses for all objects. (no more pay for or small subs)
> 
> While this is a list of perfectly justifiable reasons, the key factor to selling this to your clients is survivability. This will cost money, it will take time, it will cause problems while migrating, but must be done. We don't run IPX/SPX,

IMHO, if the Internet was running IPX (32 bit network number, 48 bit
node address), we'd still be running it, and wouldn't now have the
problem of running out of addresses. It had nearly all the features IPv6
has, and it had them in the early 90s. I think one of the major reasons
it didn't survive because IPv4 is what the Internet runs. Having
personally gone from virtually not learning IPX and working with it
quite successfully, to then learning IPv4 and all it's quirks like
classes, subnet masks, prefix lengths etc., it seems to me that being
connected to the Internet was more important to people than the
protocol that operated it and it's drawbacks and complexities. I think
people also, sometimes very slowly, tend towards efficiency. Once IP was
deployed in people's networks, and there was no chance of getting rid
of it (because of this Internet thing), if IP could replace IPX it was
inevitably going to.

One of the things I like about IPv6 is that if people deploy it right,
and don't choose to make that deployment as complicated as they could,
we'll have back the 1990s (and earlier) simplicity in networking that
protocols like IPX and Appletalk provided. 

> AppleTalk, thin net, X.25, Windows 3.1(tcpman.exe), etc anymore
 because the technology is no longer good enough. IPv4 is no longer
 good enough for us either as the resource will simply run out. This
 run-out has many significant impacts to our costs, routing
 infrastructure, tracking abilities, etc and will have to be addressed
 (pardon the pun) sooner or later. The later we embrace, the more it
 costs us over the long term.
> 
> Hope this is helpful.
> 
> Cheers,
> Aaron
> 
> 
> 
> 
> On Wed, May 26, 2010 at 07:31:08PM +0100, Andy Davidson wrote:
> > 
> > On 24 May 2010, at 20:50, Doug Barton wrote:
> > 
> > > So my question is, other than longer addresses, what are the benefits to IPv6 that I can point clients to which will help them justify the expense of the upgrade?
> > 
> > For me, it's that one day, we'll get to bin the v4 swamp.
> > 
> > Andy
> > 
> > 
> 
> -- 
> 
> Aaron Hughes 
> aaronh at bind.com
> +1-831-824-4161
> Key fingerprint = AD 67 37 60 7D 73 C5 B7 33 18 3F 36 C3 1C C6 B8
> http://www.bind.com/

From fred at cisco.com  Thu May 27 02:01:08 2010
From: fred at cisco.com (Fred Baker)
Date: Wed, 26 May 2010 17:01:08 -0700
Subject: [ipv6-ops] Re: So why is "IPv4 with longer addresses" a problem
	anyway?
In-Reply-To: <20100527070205.690e8cdb@opy.nosense.org>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
	<9AAE6366-7974-4F42-9707-FF9A1CF28E87@nosignal.org>
	<20100526184532.GB14781@trace.bind.com>
	<20100527070205.690e8cdb@opy.nosense.org>
Message-ID: <67FDAEC4-6755-46BC-9A95-8E17F15D4817@cisco.com>


On May 26, 2010, at 2:32 PM, Mark Smith wrote:

> IMHO, if the Internet was running IPX (32 bit network number, 48 bit node address), we'd still be running it, and wouldn't now have the problem of running out of addresses. 

well, yes, but we might have some issues with route scaling. IPX enumerates LANs, not edge networks or the ISPs that serve them. 

We could make the same comment about CLNS and NSAPs; CLNS enumerates networks, and within them, subnets and hosts. The networks would be the edge networks, not the ISPs that serve them.

IPv6 isn't perfect. The nice thing about it is that we can reasonably enumerate hosts, subnets (/64), edge networks (/48 or longer), and ISPs (/32 or thereabouts). 

From tedm at ipinc.net  Thu May 27 10:33:15 2010
From: tedm at ipinc.net (Ted Mittelstaedt)
Date: Thu, 27 May 2010 01:33:15 -0700
Subject: [ipv6-ops] Re: So why is "IPv4 with longer addresses" a	problem
	anyway?
In-Reply-To: <20100527070205.690e8cdb@opy.nosense.org>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>	<9AAE6366-7974-4F42-9707-FF9A1CF28E87@nosignal.org>	<20100526184532.GB14781@trace.bind.com>
	<20100527070205.690e8cdb@opy.nosense.org>
Message-ID: <4BFE2E4B.6060908@ipinc.net>



On 5/26/2010 2:32 PM, Mark Smith wrote:
> On Wed, 26 May 2010 11:45:32 -0700
> Aaron Hughes<aaronh at bind.com>  wrote:
>
>> Doug,
>>
>> - Survivability
>> - End to end reachability
>> - Guaranteed uniqueness
>> - Some added security (everyone will be forced to address security without NAT in place)
>> - IPv4 space will become very expensive post RIR exhaustion.
>> - IPv6 allows for longer term architecture (allocations and assignment) planning.
>> - Filtering is easier
>> - Regional aggregation is easier
>> - TE (Traffic Engineering) is easier
>> - You will likely never haver to go back to your provider or registry for more IP resources.
>> - Today, IPv6 transit is free ->  $inexpensive
>> - When the day comes (first IPv6 only reachable content/eyeballs come online, you will reach them.
>> - Client / eyeball / content analysis gives more accurate data
>> - From the end user perspective, real IP addresses for all objects. (no more pay for or small subs)
>>
>> While this is a list of perfectly justifiable reasons, the key factor to selling this to your clients is survivability. This will cost money, it will take time, it will cause problems while migrating, but must be done. We don't run IPX/SPX,
>
> IMHO, if the Internet was running IPX (32 bit network number, 48 bit
> node address), we'd still be running it, and wouldn't now have the
> problem of running out of addresses. It had nearly all the features IPv6
> has, and it had them in the early 90s. I think one of the major reasons
> it didn't survive because IPv4 is what the Internet runs.   Having
> personally gone from virtually not learning IPX and working with it
> quite successfully, to then learning IPv4 and all it's quirks like
> classes, subnet masks, prefix lengths etc., it seems to me that being
> connected to the Internet was more important to people than the
> protocol that operated it and it's drawbacks and complexities. I think
> people also, sometimes very slowly, tend towards efficiency. Once IP was
> deployed in people's networks, and there was no chance of getting rid
> of it (because of this Internet thing), if IP could replace IPX it was
> inevitably going to.
>

No, that's not why IPX was replaced.  IPX was replaced because Novell
didn't open-source it and because of that IPX was viewed by the
network community as being tied to Novell's fortunes - then Novell
crashed and burned.

If Novell had retained USL and done what their original gameplan
was, which was to move NCP on to a UNIX server core, and done it
by first releasing IPX into the Net/2 distribution (so that everyone
could run it) then MacOS X wouldn't exist, and MS server and Netware
today would have had the market split.

Novell also badly underestimated the criticalness of having a
solid client.  ipx.com and netx.exe was perfect for DOS systems
and OK for Win31, as long as you knew to use the updated dlls.

But, when Win 95 came out they didn't have a 32-bit client
and the 16 bit clients were kludges under win95.

Ted

From gert at space.net  Thu May 27 15:53:46 2010
From: gert at space.net (Gert Doering)
Date: Thu, 27 May 2010 15:53:46 +0200
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <alpine.BSF.2.00.1005241223170.3582@qbhto.arg>
References: <464482.57725.qm@web31805.mail.mud.yahoo.com>
	<sa7d3wtv5nv.fsf@benedikt-stockebrand.de>
	<4BF33252.1070103@dougbarton.us>
	<sa78w7917fq.fsf@benedikt-stockebrand.de>
	<alpine.BSF.2.00.1005241223170.3582@qbhto.arg>
Message-ID: <20100527135346.GV68820@Space.Net>

Hi,

On Mon, May 24, 2010 at 12:42:30PM -0700, Doug Barton wrote:
> I'm talking internal networks here. Lots of 1918 space available.

I wonder why there's so much address collisions between VPN sites and
at enterprise mergers and acquisitions...

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  150584

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

From gert at space.net  Thu May 27 16:04:53 2010
From: gert at space.net (Gert Doering)
Date: Thu, 27 May 2010 16:04:53 +0200
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <169090.81460.qm@web31812.mail.mud.yahoo.com>
References: <20100518193841.416fbd84@opy.nosense.org>
	<169090.81460.qm@web31812.mail.mud.yahoo.com>
Message-ID: <20100527140453.GW68820@Space.Net>

Hi,

On Tue, May 18, 2010 at 04:35:44AM -0700, David Barak wrote:
> Here we disagree.  In IPv4-land, a whole bunch of functions are
> handled via DHCP, and modifications in a simgle place (the DHCP
> server) can affect a whole bunch of remote clients without any other
> necessary changes.  RA+DHCPv6 requires congruent configurations in
> N places, where N >= 2 always, and for large scale enterprises N
> is much greater than 2.  

This claim is surely nice, but just plain wrong.

At initial configuration time:

 - with RA+DHCP: you touch every router (to enter the prefix configured on
   the interface, set the "other-config bit", turn on DHCP relay), and the 
   DHCP server

 - with DHCP: you touch every router (to enter the prefix configured on
   the interface, turn off RA, turn on DHCP relay), and the DHCP server

If you change DHCP options, like "who is the NTP server":

 - with RA+DHCP: you touch the DHCP server

 - with DHCP: you touch the DHCP server

If you change network options, like "what is the prefix used in a given
facility":

 - with RA+DHCP: you touch every router to configure the new prefix

 - with DHCP: you touch every router to configure the new prefix

Maybe my creativity is a bit limited, but please tell me what sort of
configuration change you have in mind that would affect a different
number of devices for "RA+DHCP" vs. "DHCP-only".


(DHCP Prefix Delegation could indeed make setup in a large network a lot
more automatic, but that is a somewhat independent discussion on the 
method used to configure hosts on the LAN)

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  150584

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

From thegameiam at yahoo.com  Thu May 27 17:27:39 2010
From: thegameiam at yahoo.com (David Barak)
Date: Thu, 27 May 2010 08:27:39 -0700 (PDT)
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100527140453.GW68820@Space.Net>
Message-ID: <342151.92267.qm@web31811.mail.mud.yahoo.com>

-- On Thu, 5/27/10, Gert Doering <gert at space.net> wrote:

> Maybe my creativity is a bit limited, but please tell me
> what sort of
> configuration change you have in mind that would affect a
> different
> number of devices for "RA+DHCP" vs. "DHCP-only".
> 

If I want to change the default gateway of hosts on my LAN, I can make a DHCPv4 change to do this.  Migrations or maintenance make this a useful attribute.  

RA existed in IPv4, and was not widely used: DHCP was used for the default gateway instead, because operators preferred it.  Let's put the shoe on the other foot: if I don't want to deploy RA, why should I be forced to do so?

David Barak
Need Geek Rock?  Try The Franchise: 
http://www.listentothefranchise.com


      

From gert at space.net  Thu May 27 17:38:37 2010
From: gert at space.net (Gert Doering)
Date: Thu, 27 May 2010 17:38:37 +0200
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <342151.92267.qm@web31811.mail.mud.yahoo.com>
References: <20100527140453.GW68820@Space.Net>
	<342151.92267.qm@web31811.mail.mud.yahoo.com>
Message-ID: <20100527153837.GD68820@Space.Net>

Hi,

On Thu, May 27, 2010 at 08:27:39AM -0700, David Barak wrote:
> -- On Thu, 5/27/10, Gert Doering <gert at space.net> wrote:
> 
> > Maybe my creativity is a bit limited, but please tell me
> > what sort of
> > configuration change you have in mind that would affect a
> > different
> > number of devices for "RA+DHCP" vs. "DHCP-only".
> 
> If I want to change the default gateway of hosts on my LAN, I can
> make a DHCPv4 change to do this.  Migrations or maintenance make
> this a useful attribute.

The argument was "with DHCP-only, you have to touch much less places".

If you want to change the default gateway for a given LAN, it's either
"change the DHCP server" or "change the router config", which is both
"touch one device" for me.  Not "large N".

If you want to change the default gateway for "large N" LANs at the 
same time, it won't be done with a single click in the DHCP server 
config either (and the question be permitted, "how realistic would 
that scenario be").

But thanks for agreeing that it's hard to find a scenario that backs
the claim "with RA+DHCP, I need to touch many more places than with 
DHCP-only".


> RA existed in IPv4, and was not widely used: DHCP was used for
> the default gateway instead, because operators preferred it.  

Mostly because "Microsoft didn't implement RA for IPv4" - so the
critical mass was not there.  Microsoft implemented handling of RA,
while Apple doesn't implement DHCPv6.  So what?

> Let's put the shoe on the other foot: if I don't want to deploy RA, why
> should I be forced to do so?

Nobody is forcing you.  You can configure your machines statically all
the way you want, or spend time and money to get default gateway into
DHCPv6 - either as a vendor extention or via IETF processes.

I'm purely objecting to the FUD about "with RA+DHCP, there is so much
more work than with DHCP-only".  People will read that, believe it, and
make decisions based on bad data.

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  150584

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

From swmike at swm.pp.se  Thu May 27 17:43:11 2010
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Thu, 27 May 2010 17:43:11 +0200 (CEST)
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100527153837.GD68820@Space.Net>
References: <20100527140453.GW68820@Space.Net>
	<342151.92267.qm@web31811.mail.mud.yahoo.com>
	<20100527153837.GD68820@Space.Net>
Message-ID: <alpine.DEB.1.10.1005271742220.28457@uplift.swm.pp.se>

On Thu, 27 May 2010, Gert Doering wrote:

> I'm purely objecting to the FUD about "with RA+DHCP, there is so much 
> more work than with DHCP-only".  People will read that, believe it, and 
> make decisions based on bad data.

I read the argument as "with RA+DHCP you have to do things *differently*" 
and that large enterprise customers don't want to change their procedures, 
that that there was *more* to do.

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From swmike at swm.pp.se  Thu May 27 17:44:48 2010
From: swmike at swm.pp.se (Mikael Abrahamsson)
Date: Thu, 27 May 2010 17:44:48 +0200 (CEST)
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <alpine.DEB.1.10.1005271742220.28457@uplift.swm.pp.se>
References: <20100527140453.GW68820@Space.Net>
	<342151.92267.qm@web31811.mail.mud.yahoo.com>
	<20100527153837.GD68820@Space.Net>
	<alpine.DEB.1.10.1005271742220.28457@uplift.swm.pp.se>
Message-ID: <alpine.DEB.1.10.1005271744290.28457@uplift.swm.pp.se>

On Thu, 27 May 2010, Mikael Abrahamsson wrote:

> I read the argument as "with RA+DHCP you have to do things *differently*" and 
> that large enterprise customers don't want to change their procedures, that 
> that there was *more* to do.

Sigh, I meant to write "not that there was *more* to do".

-- 
Mikael Abrahamsson    email: swmike at swm.pp.se

From Sam.Wilson at ed.ac.uk  Thu May 27 17:46:33 2010
From: Sam.Wilson at ed.ac.uk (Sam Wilson)
Date: Thu, 27 May 2010 16:46:33 +0100
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100527153837.GD68820@Space.Net>
References: <20100527140453.GW68820@Space.Net>
	<342151.92267.qm@web31811.mail.mud.yahoo.com>
	<20100527153837.GD68820@Space.Net>
Message-ID: <79A66327-8B22-48A6-B902-28F72473A766@ed.ac.uk>


On 27 May 2010, at 16:38, Gert Doering wrote:

> But thanks for agreeing that it's hard to find a scenario that backs
> the claim "with RA+DHCP, I need to touch many more places than with
> DHCP-only".

100% more places.  Anyone care to define whether that's "many" or not?

Sam

-- 
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.


From thegameiam at yahoo.com  Thu May 27 17:50:45 2010
From: thegameiam at yahoo.com (David Barak)
Date: Thu, 27 May 2010 08:50:45 -0700 (PDT)
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <alpine.DEB.1.10.1005271742220.28457@uplift.swm.pp.se>
Message-ID: <851493.2525.qm@web31807.mail.mud.yahoo.com>

--- On Thu, 5/27/10, Mikael Abrahamsson <swmike at swm.pp.se> wrote:
> > I'm purely objecting to the FUD about "with RA+DHCP,
> there is so much more work than with DHCP-only".?
> People will read that, believe it, and make decisions based
> on bad data.
> 
> I read the argument as "with RA+DHCP you have to do things
> *differently*" and that large enterprise customers don't
> want to change their procedures, that that there was *more*
> to do.

Mikael said it much better than I did.  If you're talking about a greenfield installation, it's the same amount of work.  But if you've already got a configuration management infrastructure suitable for multiple hundreds of thousands of customers, changing the way that it works for an ephimeral benefit is not something *attractive* about v6 deployment.  Allowing enterprises to continue doing what they were doing before makes the "sell" for v6 deployment a lot easier.

David Barak
Need Geek Rock?  Try The Franchise: 
http://www.listentothefranchise.com




      

From gert at space.net  Thu May 27 17:53:36 2010
From: gert at space.net (Gert Doering)
Date: Thu, 27 May 2010 17:53:36 +0200
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <alpine.DEB.1.10.1005271742220.28457@uplift.swm.pp.se>
References: <20100527140453.GW68820@Space.Net>
	<342151.92267.qm@web31811.mail.mud.yahoo.com>
	<20100527153837.GD68820@Space.Net>
	<alpine.DEB.1.10.1005271742220.28457@uplift.swm.pp.se>
Message-ID: <20100527155336.GF68820@Space.Net>

Hi,

On Thu, May 27, 2010 at 05:43:11PM +0200, Mikael Abrahamsson wrote:
> On Thu, 27 May 2010, Gert Doering wrote:
> 
> > I'm purely objecting to the FUD about "with RA+DHCP, there is so much 
> > more work than with DHCP-only".  People will read that, believe it, and 
> > make decisions based on bad data.
> 
> I read the argument as "with RA+DHCP you have to do things *differently*" 
> and that large enterprise customers don't want to change their procedures, 
> that that there was *more* to do.

True, but that's not what he wrote.

(Of *course* IPv6 is different, that's the whole point.  We don't want
no legacy IP anymore)

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  150584

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 306 bytes
Desc: not available
Url : http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100527/c7e7607d/attachment.bin 

From gert at space.net  Thu May 27 17:56:50 2010
From: gert at space.net (Gert Doering)
Date: Thu, 27 May 2010 17:56:50 +0200
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <79A66327-8B22-48A6-B902-28F72473A766@ed.ac.uk>
References: <20100527140453.GW68820@Space.Net>
	<342151.92267.qm@web31811.mail.mud.yahoo.com>
	<20100527153837.GD68820@Space.Net>
	<79A66327-8B22-48A6-B902-28F72473A766@ed.ac.uk>
Message-ID: <20100527155650.GG68820@Space.Net>

Hi,

On Thu, May 27, 2010 at 04:46:33PM +0100, Sam Wilson wrote:
> On 27 May 2010, at 16:38, Gert Doering wrote:
> 
> > But thanks for agreeing that it's hard to find a scenario that backs
> > the claim "with RA+DHCP, I need to touch many more places than with
> > DHCP-only".
> 
> 100% more places.  Anyone care to define whether that's "many" or not?

Huh?  You need to touch the router, and the server.  In both cases.

Sounds like "same number of places" to me.

Actually, "RA with no DHCP" is "1 place less", but I'm not argueing
for "no DHCP" at all here.  So that's moot.

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  150584

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 306 bytes
Desc: not available
Url : http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100527/8e59f6ac/attachment.bin 

From Sam.Wilson at ed.ac.uk  Thu May 27 17:57:34 2010
From: Sam.Wilson at ed.ac.uk (Sam Wilson)
Date: Thu, 27 May 2010 16:57:34 +0100
Subject: [ipv6-ops] Re: So why is "IPv4 with longer addresses" a problem
	anyway?
In-Reply-To: <67FDAEC4-6755-46BC-9A95-8E17F15D4817@cisco.com>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
	<9AAE6366-7974-4F42-9707-FF9A1CF28E87@nosignal.org>
	<20100526184532.GB14781@trace.bind.com>
	<20100527070205.690e8cdb@opy.nosense.org>
	<67FDAEC4-6755-46BC-9A95-8E17F15D4817@cisco.com>
Message-ID: <239692FF-453F-491B-A43E-D6CDC14FCD6B@ed.ac.uk>


On 27 May 2010, at 01:01, Fred Baker wrote:

>
> On May 26, 2010, at 2:32 PM, Mark Smith wrote:
>
>> IMHO, if the Internet was running IPX (32 bit network number, 48  
>> bit node address), we'd still be running it, and wouldn't now have  
>> the problem of running out of addresses.
>
> well, yes, but we might have some issues with route scaling. IPX  
> enumerates LANs, not edge networks or the ISPs that serve them.

In the traditional Novell IPX architecture IPX also enumerates  
servers, since each one has its own unique internal network number.  
Having been slightly involved in a plan to build a nationwide IPX  
service in UK Academia I can attest that it really wasn't a very easy  
protocol to scale.

Sam

-- 
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.


From paul at timmins.net  Thu May 27 18:14:37 2010
From: paul at timmins.net (Paul Timmins)
Date: Thu, 27 May 2010 12:14:37 -0400
Subject: Mysterious missing DHCPv6 feature,	was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <79A66327-8B22-48A6-B902-28F72473A766@ed.ac.uk>
References: <20100527140453.GW68820@Space.Net>	<342151.92267.qm@web31811.mail.mud.yahoo.com>	<20100527153837.GD68820@Space.Net>
	<79A66327-8B22-48A6-B902-28F72473A766@ed.ac.uk>
Message-ID: <4BFE9A6D.4090507@timmins.net>

Sam Wilson wrote:
>
> On 27 May 2010, at 16:38, Gert Doering wrote:
>
>> But thanks for agreeing that it's hard to find a scenario that backs
>> the claim "with RA+DHCP, I need to touch many more places than with
>> DHCP-only".
>
> 100% more places.  Anyone care to define whether that's "many" or not?
How are you changing what the subnet is in IPv4 with DHCP? Don't you 
still need to log into the router to assign a secondary address, or 
change the primary address of the interface? If so, you're right, on a 
cisco that's two commands instead of one.. gotta change the IP address 
AND change the ipv6 nd prefix xxxxxx/64

So much more work and management headache!


From thegameiam at yahoo.com  Thu May 27 18:48:40 2010
From: thegameiam at yahoo.com (David Barak)
Date: Thu, 27 May 2010 09:48:40 -0700 (PDT)
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100527155336.GF68820@Space.Net>
Message-ID: <505433.88234.qm@web31806.mail.mud.yahoo.com>

--- On Thu, 5/27/10, Gert Doering <gert at space.net> wrote:
> 
> (Of *course* IPv6 is different, that's the whole
> point.? We don't want
> no legacy IP anymore)

What's this "we" of which you speak?  

There are a whole lot of folks who think that IPv4 is a perfectly fine protocol, and the major problem with it is that its finitude is too close at hand.

David Barak
Need Geek Rock?  Try The Franchise: 
http://www.listentothefranchise.com




      

From Sam.Wilson at ed.ac.uk  Thu May 27 19:12:48 2010
From: Sam.Wilson at ed.ac.uk (Sam Wilson)
Date: Thu, 27 May 2010 18:12:48 +0100
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100527155650.GG68820@Space.Net>
References: <20100527140453.GW68820@Space.Net>
	<342151.92267.qm@web31811.mail.mud.yahoo.com>
	<20100527153837.GD68820@Space.Net>
	<79A66327-8B22-48A6-B902-28F72473A766@ed.ac.uk>
	<20100527155650.GG68820@Space.Net>
Message-ID: <521950E3-B58B-47A0-9960-17E1562C2451@ed.ac.uk>


On 27 May 2010, at 16:56, Gert Doering wrote:

> Hi,
>
> On Thu, May 27, 2010 at 04:46:33PM +0100, Sam Wilson wrote:
>> On 27 May 2010, at 16:38, Gert Doering wrote:
>>
>>> But thanks for agreeing that it's hard to find a scenario that backs
>>> the claim "with RA+DHCP, I need to touch many more places than with
>>> DHCP-only".
>>
>> 100% more places.  Anyone care to define whether that's "many" or  
>> not?
>
> Huh?  You need to touch the router, and the server.  In both cases.

I was taking the claim literally and a little light heartedly.  Sorry  
for not being serious.

Sam


-- 
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.


From gert at space.net  Thu May 27 20:15:25 2010
From: gert at space.net (Gert Doering)
Date: Thu, 27 May 2010 20:15:25 +0200
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <505433.88234.qm@web31806.mail.mud.yahoo.com>
References: <20100527155336.GF68820@Space.Net>
	<505433.88234.qm@web31806.mail.mud.yahoo.com>
Message-ID: <20100527181525.GI68820@Space.Net>

Hi,

On Thu, May 27, 2010 at 09:48:40AM -0700, David Barak wrote:
> --- On Thu, 5/27/10, Gert Doering <gert at space.net> wrote:
> > 
> > (Of *course* IPv6 is different, that's the whole
> > point.? We don't want
> > no legacy IP anymore)
> 
> What's this "we" of which you speak?  
> 
> There are a whole lot of folks who think that IPv4 is a perfectly fine protocol, and the major problem with it is that its finitude is too close at hand.

Well, that *is* the problem with it - and thus, it's not a perfectly fine
protocol.

If people could have real IPv4 addresses wherever they want them, in 
enough supply to avoid address space haggling everywhere and nasty tricks
with non-unique addressing in connected networks, indeed, then IPv4 would
be perfectly sufficient.  Unfortunately, as you say, it isn't.

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  150584

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

From tedm at ipinc.net  Thu May 27 21:14:01 2010
From: tedm at ipinc.net (Ted Mittelstaedt)
Date: Thu, 27 May 2010 12:14:01 -0700
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100527135346.GV68820@Space.Net>
References: <464482.57725.qm@web31805.mail.mud.yahoo.com>	<sa7d3wtv5nv.fsf@benedikt-stockebrand.de>	<4BF33252.1070103@dougbarton.us>	<sa78w7917fq.fsf@benedikt-stockebrand.de>	<alpine.BSF.2.00.1005241223170.3582@qbhto.arg>
	<20100527135346.GV68820@Space.Net>
Message-ID: <4BFEC479.3030005@ipinc.net>



On 5/27/2010 6:53 AM, Gert Doering wrote:
> Hi,
>
> On Mon, May 24, 2010 at 12:42:30PM -0700, Doug Barton wrote:
>> I'm talking internal networks here. Lots of 1918 space available.
>
> I wonder why there's so much address collisions between VPN sites and
> at enterprise mergers and acquisitions...
>

Because everyone uses 192.168.1.X since that's the default on
most translators.

The solution - renumbering - isn't going to go away after IPv6.
When you have a merger you may get away with not immediately
renumbering as a result of IPv6 but you almost certainly are going
to be changing ISP's used at the acquired entity, and when you
do that you will have to renumber the inside network.

Ted

From tedm at ipinc.net  Thu May 27 21:36:21 2010
From: tedm at ipinc.net (Ted Mittelstaedt)
Date: Thu, 27 May 2010 12:36:21 -0700
Subject: Mysterious missing DHCPv6 feature,	was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <505433.88234.qm@web31806.mail.mud.yahoo.com>
References: <505433.88234.qm@web31806.mail.mud.yahoo.com>
Message-ID: <4BFEC9B5.9000500@ipinc.net>



On 5/27/2010 9:48 AM, David Barak wrote:
> --- On Thu, 5/27/10, Gert Doering<gert at space.net>  wrote:
>>
>> (Of *course* IPv6 is different, that's the whole
>> point.  We don't want
>> no legacy IP anymore)
>
> What's this "we" of which you speak?
>
> There are a whole lot of folks who think that IPv4 is a perfectly fine protocol, and the major problem with it is that its finitude is too close at hand.
>

IPv4 isn't a protocol.  IPv6 isn't a protocol, either.

TCP, UDP, ICMP, those are protocols.  IPv4 vs IPv6 is
an ADDRESSING SCHEME

Do you really, honestly, think that it would be a Good Thing
for every host on the Internet to be known by 2, incompatible,
addressing schemes?

Do you really, honestly, think that it would be a Good Thing
for some hosts on the Internet to be known by 1 addressing
scheme and for others to be known by a different, incompatible
addressing scheme?  Particularly when the protocols in use
under those schemes are the same?

We ALREADY use multiple addressing schemes to identify hosts ON
AN INTERNAL LAN.  We can use IPX addressing, or Appleytalk, or just 
plain old Mac addresses as in NetBEUI.  And that has worked out so well
that just about all orgs got rid of those other addressing schemes
years ago.

Ted

From dougb at dougbarton.us  Fri May 28 00:02:33 2010
From: dougb at dougbarton.us (Doug Barton)
Date: Thu, 27 May 2010 15:02:33 -0700
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <20100527155650.GG68820@Space.Net>
References: <20100527140453.GW68820@Space.Net>	<342151.92267.qm@web31811.mail.mud.yahoo.com>	<20100527153837.GD68820@Space.Net>	<79A66327-8B22-48A6-B902-28F72473A766@ed.ac.uk>
	<20100527155650.GG68820@Space.Net>
Message-ID: <4BFEEBF9.8020204@dougbarton.us>

On 05/27/10 08:56, Gert Doering wrote:
> Hi,
>
> On Thu, May 27, 2010 at 04:46:33PM +0100, Sam Wilson wrote:
>> On 27 May 2010, at 16:38, Gert Doering wrote:
>>
>>> But thanks for agreeing that it's hard to find a scenario that backs
>>> the claim "with RA+DHCP, I need to touch many more places than with
>>> DHCP-only".
>>
>> 100% more places.  Anyone care to define whether that's "many" or not?
>
> Huh?  You need to touch the router, and the server.  In both cases.
>
> Sounds like "same number of places" to me.

Sure, in your contrived example the number of things to configure is 
equal. I can contrive equally effective examples of stuff that doesn't 
require the people doing the configuration to touch the router.

You still haven't answered the question, "Why should RA be _required_ in 
IPv6 when DHCP is perfectly capable of doing everything that RA can do 
and more?"


Doug

-- 

	... and that's just a little bit of history repeating.
			-- Propellerheads

	Improve the effectiveness of your Internet presence with
	a domain name makeover!    http://SupersetSolutions.com/


From paul at timmins.net  Fri May 28 00:21:27 2010
From: paul at timmins.net (Paul Timmins)
Date: Thu, 27 May 2010 18:21:27 -0400
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <4BFEEBF9.8020204@dougbarton.us>
References: <20100527140453.GW68820@Space.Net>	<342151.92267.qm@web31811.mail.mud.yahoo.com>	<20100527153837.GD68820@Space.Net>	<79A66327-8B22-48A6-B902-28F72473A766@ed.ac.uk>	<20100527155650.GG68820@Space.Net>
	<4BFEEBF9.8020204@dougbarton.us>
Message-ID: <4BFEF067.8030307@timmins.net>

Doug Barton wrote:
> On 05/27/10 08:56, Gert Doering wrote:
>> Hi,
>>
>> On Thu, May 27, 2010 at 04:46:33PM +0100, Sam Wilson wrote:
>>> On 27 May 2010, at 16:38, Gert Doering wrote:
>>>
>>>> But thanks for agreeing that it's hard to find a scenario that backs
>>>> the claim "with RA+DHCP, I need to touch many more places than with
>>>> DHCP-only".
>>>
>>> 100% more places.  Anyone care to define whether that's "many" or not?
>>
>> Huh?  You need to touch the router, and the server.  In both cases.
>>
>> Sounds like "same number of places" to me.
>
> Sure, in your contrived example the number of things to configure is 
> equal. I can contrive equally effective examples of stuff that doesn't 
> require the people doing the configuration to touch the router.
Give an example where you could change the subnet assigned on a segment 
without touching the router on it. (And only the subnet, since that's 
all RA can set anyway)

> You still haven't answered the question, "Why should RA be _required_ 
> in IPv6 when DHCP is perfectly capable of doing everything that RA can 
> do and more?"

Because RA is way easier to develop embedded devices for than DHCP. 
Getting an interrupt and checking the buffer, finding an RA and then do 
the address set and change routine, and going back to normal work is way 
easier than maintaining a state machine that has to keep track of 
address expiry, renewal, and even the request/handle response/ack can be 
complex if you're doing everything in 8k/16k of space.

I'm talking telemetry units that either respond to polls or blatt data 
out on to the wire as multicast as soon as it's collected here, not 
smart fridges that have enough ram to drive a LCD display, and thus 
could maybe fit a DHCP implementation.

The nice thing is that if you use stateless DHCP, smart devices will 
work okay, and so will really dumb devices scarcely bigger than the 
RJ-45 jack they plug into.

-Paul

From thegameiam at yahoo.com  Fri May 28 00:33:48 2010
From: thegameiam at yahoo.com (David Barak)
Date: Thu, 27 May 2010 15:33:48 -0700 (PDT)
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <4BFEF067.8030307@timmins.net>
Message-ID: <571617.44366.qm@web31813.mail.mud.yahoo.com>

--- On Thu, 5/27/10, Paul Timmins <paul at timmins.net> wrote:

> > You still haven't answered the question, "Why should
> RA be _required_ in IPv6 when DHCP is perfectly capable of
> doing everything that RA can do and more?"
> 
> Because RA is way easier to develop embedded devices for
> than DHCP. Getting an interrupt and checking the buffer,
> finding an RA and then do the address set and change
> routine, and going back to normal work is way easier than
> maintaining a state machine that has to keep track of
> address expiry, renewal, and even the request/handle
> response/ack can be complex if you're doing everything in
> 8k/16k of space.
> 
> I'm talking telemetry units that either respond to polls or
> blatt data out on to the wire as multicast as soon as it's
> collected here, not smart fridges that have enough ram to
> drive a LCD display, and thus could maybe fit a DHCP
> implementation.

That's the best explanation of a sensible rationale I've heard for this.  I still disagree with the approach: I think it's too "one size fits all" even when it doesn't, and it ignores the security lessons we've had over the past decade with regard to self-organizing networks, but I can at least see where *someone* benefits.  

I'd still like to remove the dependancy on RA for those things which CAN support a DHCP implementation - it's just yet another thing which can either break or become a security vulnerability on a typical enterprise LAN.

David Barak
Need Geek Rock?  Try The Franchise: 
http://www.listentothefranchise.com



      

From dougb at dougbarton.us  Fri May 28 00:37:17 2010
From: dougb at dougbarton.us (Doug Barton)
Date: Thu, 27 May 2010 15:37:17 -0700
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <4BFEF067.8030307@timmins.net>
References: <20100527140453.GW68820@Space.Net>	<342151.92267.qm@web31811.mail.mud.yahoo.com>	<20100527153837.GD68820@Space.Net>	<79A66327-8B22-48A6-B902-28F72473A766@ed.ac.uk>	<20100527155650.GG68820@Space.Net>
	<4BFEEBF9.8020204@dougbarton.us> <4BFEF067.8030307@timmins.net>
Message-ID: <4BFEF41D.7010307@dougbarton.us>

On 5/27/2010 3:21 PM, Paul Timmins wrote:
> Doug Barton wrote:
>
>> Sure, in your contrived example the number of things to configure is
>> equal. I can contrive equally effective examples of stuff that doesn't
>> require the people doing the configuration to touch the router.
 >
> Give an example where you could change the subnet assigned on a segment
> without touching the router on it. (And only the subnet, since that's
> all RA can set anyway)

At one place I worked we had a setup where the MAC addresses for known 
hosts were saved in a database along with their appropriate subnets and 
other important information. When those hosts connected to the DHCP 
server they were assigned the appropriate configuration and the switch 
port they were attached to was configured for the proper VLAN, etc. 
Connecting an unknown host got you routed to the "guest" network.

>> You still haven't answered the question, "Why should RA be _required_
>> in IPv6 when DHCP is perfectly capable of doing everything that RA can
>> do and more?"
>
> Because RA is way easier to develop embedded devices for than DHCP.

A) This may have been true 15 years ago, but as it has already been 
pointed out numerous times the marginal coast of stateless DHCP vs. RA 
on today's devices is well into the noise. And B) even if it were true, 
I don't have these theoretical micro-devices on my network, so I ask 
again, why MUST I configure RA in order to have IPv6?


Doug

-- 

	... and that's just a little bit of history repeating.
			-- Propellerheads

	Improve the effectiveness of your Internet presence with
	a domain name makeover!    http://SupersetSolutions.com/


From dougb at dougbarton.us  Fri May 28 00:39:48 2010
From: dougb at dougbarton.us (Doug Barton)
Date: Thu, 27 May 2010 15:39:48 -0700
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
Message-ID: <4BFEF4B4.5020804@dougbarton.us>

On 5/27/2010 12:14 PM, Ted Mittelstaedt wrote:
>
> On 5/27/2010 6:53 AM, Gert Doering wrote:
>> Hi,
>>
>> On Mon, May 24, 2010 at 12:42:30PM -0700, Doug Barton wrote:
>>> I'm talking internal networks here. Lots of 1918 space available.
>>
>> I wonder why there's so much address collisions between VPN sites and
>> at enterprise mergers and acquisitions...
>>
>
> Because everyone uses 192.168.1.X since that's the default on
> most translators.

Right-O. Or 10.0.0.0/24, or what have you. At $SEVERAL_JOBS_AGO when we
were talking about setting up subnets for an isolated internal project I 
suggested using 172.16/12 since we weren't using any of that space at
the time, and I wanted the new thing to be clearly identifiable as
"other." I was told that we couldn't do that because those were public
addresses. Another time we were dealing with reorganizing some internal
networks for local and remote offices I suggested that we _start_ our
organizational plan at 10.200 and give each site their own /16. They
looked at me like I had 3 heads.

> The solution - renumbering - isn't going to go away after IPv6.
> When you have a merger you may get away with not immediately
> renumbering as a result of IPv6 but you almost certainly are going
> to be changing ISP's used at the acquired entity, and when you
> do that you will have to renumber the inside network.

... or it's just easier to have everyone under the same prefix, etc.
I've been on both sides of the M&A equation, so I think I understand the 
issues there pretty well.

My point being that IPv6 doesn't magically fix the renumbering problems
(such as they are) that exist in IPv4 today. It does make some things
easier, but it comes at a cost. The important thing is to do a
_realistic_ assessment of both the costs and the benefits.


Doug

-- 

	... and that's just a little bit of history repeating.
			-- Propellerheads

	Improve the effectiveness of your Internet presence with
	a domain name makeover!    http://SupersetSolutions.com/


From tedm at ipinc.net  Fri May 28 01:50:24 2010
From: tedm at ipinc.net (Ted Mittelstaedt)
Date: Thu, 27 May 2010 16:50:24 -0700
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <4BFEF4B4.5020804@dougbarton.us>
References: <4BFEF4B4.5020804@dougbarton.us>
Message-ID: <4BFF0540.8000301@ipinc.net>



On 5/27/2010 3:39 PM, Doug Barton wrote:
> On 5/27/2010 12:14 PM, Ted Mittelstaedt wrote:
>>
>> On 5/27/2010 6:53 AM, Gert Doering wrote:
>>> Hi,
>>>
>>> On Mon, May 24, 2010 at 12:42:30PM -0700, Doug Barton wrote:
>>>> I'm talking internal networks here. Lots of 1918 space available.
>>>
>>> I wonder why there's so much address collisions between VPN sites and
>>> at enterprise mergers and acquisitions...
>>>
>>
>> Because everyone uses 192.168.1.X since that's the default on
>> most translators.
>
> Right-O. Or 10.0.0.0/24, or what have you. At $SEVERAL_JOBS_AGO when we
> were talking about setting up subnets for an isolated internal project I
> suggested using 172.16/12 since we weren't using any of that space at
> the time, and I wanted the new thing to be clearly identifiable as
> "other." I was told that we couldn't do that because those were public
> addresses. Another time we were dealing with reorganizing some internal
> networks for local and remote offices I suggested that we _start_ our
> organizational plan at 10.200 and give each site their own /16. They
> looked at me like I had 3 heads.
>

We started assisting customers to put translators on their networks
about 10 years ago.  At that time I started with using 192.168.50.X
as I could see what was coming.  Since that time we have had 2-3 of
those customers interconnect either with other customers and that
has saved their bacon.  But much more than that - most customers 
nowadays have employees who VPN in, and those VPN's originate from
behind translators, almost always running 192.168.1 or 192.168.0,
and having the mothership NOT on the same subnet has helped 
troubleshooting immensely.

>> The solution - renumbering - isn't going to go away after IPv6.
>> When you have a merger you may get away with not immediately
>> renumbering as a result of IPv6 but you almost certainly are going
>> to be changing ISP's used at the acquired entity, and when you
>> do that you will have to renumber the inside network.
>
> ... or it's just easier to have everyone under the same prefix, etc.
> I've been on both sides of the M&A equation, so I think I understand the
> issues there pretty well.
>

same here.

> My point being that IPv6 doesn't magically fix the renumbering problems

Yes, we agree there.

> (such as they are) that exist in IPv4 today. It does make some things
> easier, but it comes at a cost. The important thing is to do a
> _realistic_ assessment of both the costs and the benefits.
>

realistic is a subjective and the weighing of costs and benefits is very
subjective.

Ted



>
> Doug
>

From gert at space.net  Fri May 28 09:43:41 2010
From: gert at space.net (Gert Doering)
Date: Fri, 28 May 2010 09:43:41 +0200
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <4BFEEBF9.8020204@dougbarton.us>
References: <20100527140453.GW68820@Space.Net>
	<342151.92267.qm@web31811.mail.mud.yahoo.com>
	<20100527153837.GD68820@Space.Net>
	<79A66327-8B22-48A6-B902-28F72473A766@ed.ac.uk>
	<20100527155650.GG68820@Space.Net> <4BFEEBF9.8020204@dougbarton.us>
Message-ID: <20100528074341.GK68820@Space.Net>

Hi,

On Thu, May 27, 2010 at 03:02:33PM -0700, Doug Barton wrote:
> >>> But thanks for agreeing that it's hard to find a scenario that backs
> >>> the claim "with RA+DHCP, I need to touch many more places than with
> >>> DHCP-only".
> >>
> >> 100% more places.  Anyone care to define whether that's "many" or not?
> >
> > Huh?  You need to touch the router, and the server.  In both cases.
> >
> > Sounds like "same number of places" to me.
> 
> Sure, in your contrived example the number of things to configure is 
> equal. I can contrive equally effective examples of stuff that doesn't 
> require the people doing the configuration to touch the router.

Funny enough that nobody making that claim is actually delivering.

So: please do so.  I have explicitely asked for an example where "DHCP-only"
would require only a single configuration change where "DHCP+RA" would 
require N+1 configuration changes for N affected routers.

You could consider this "enlighten the unenlightened" - if there *are*
such scenarios, I'd like to learn about them.  Vague handwaving isn't
helping.

> You still haven't answered the question, "Why should RA be _required_ in 
> IPv6 when DHCP is perfectly capable of doing everything that RA can do 
> and more?"

It is not required.  I have said so.

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  150584

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

From gert at space.net  Fri May 28 09:50:33 2010
From: gert at space.net (Gert Doering)
Date: Fri, 28 May 2010 09:50:33 +0200
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <4BFEF41D.7010307@dougbarton.us>
References: <20100527140453.GW68820@Space.Net>
	<342151.92267.qm@web31811.mail.mud.yahoo.com>
	<20100527153837.GD68820@Space.Net>
	<79A66327-8B22-48A6-B902-28F72473A766@ed.ac.uk>
	<20100527155650.GG68820@Space.Net> <4BFEEBF9.8020204@dougbarton.us>
	<4BFEF067.8030307@timmins.net> <4BFEF41D.7010307@dougbarton.us>
Message-ID: <20100528075033.GL68820@Space.Net>

Hi,

On Thu, May 27, 2010 at 03:37:17PM -0700, Doug Barton wrote:
> At one place I worked we had a setup where the MAC addresses for known 
> hosts were saved in a database along with their appropriate subnets and 
> other important information. When those hosts connected to the DHCP 
> server they were assigned the appropriate configuration and the switch 
> port they were attached to was configured for the proper VLAN, etc. 
> Connecting an unknown host got you routed to the "guest" network.

While a fairly common scenario, this is usually not tied to DHCP in
the first place (but to a MAC->VLAN databases, either in the switches
or in a switch management software).  DHCP only starts after the 
device is already in the right VLAN.  Of course it can be done the other
way round, but sounds like an interesting amount of trickery in the 
DHCP server.

But this sounds like a nice approach to security.  Change your laptop's
MAC address, get access to whatever VLAN you want...?

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  150584

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

From me at benedikt-stockebrand.de  Sat May 29 22:08:25 2010
From: me at benedikt-stockebrand.de (Benedikt Stockebrand)
Date: Sat, 29 May 2010 20:08:25 +0000
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <alpine.BSF.2.00.1005241223170.3582@qbhto.arg> (Doug Barton's
	message of "Mon, 24 May 2010 12:42:30 -0700 (PDT)")
References: <464482.57725.qm@web31805.mail.mud.yahoo.com>
	<sa7d3wtv5nv.fsf@benedikt-stockebrand.de>
	<4BF33252.1070103@dougbarton.us>
	<sa78w7917fq.fsf@benedikt-stockebrand.de>
	<alpine.BSF.2.00.1005241223170.3582@qbhto.arg>
Message-ID: <sa7typqpj2e.fsf@benedikt-stockebrand.de>

Hi Doug and list,

Doug Barton <dougb at dougbarton.us> writes:

> On Mon, 24 May 2010, Benedikt Stockebrand wrote:
>
>> sorry for the late and rather hasty reply, but I'm just between
>> conferences.
>
> No problem, for me that life was recent enough that I still remember
> what it was like, and long enough ago that most of the involuntary
> muscle contractions have subsided. :)

Those were technical conferences, not academic ones, and I didn't do
any tutorials or talks for a change:-)

> And what many of us have said, repeatedly over the last decade, is
> that we would like to be able to run our networks with DHCP only, and
> not have to enable RA at all.

Right.  But stateful DHCP on IPv4 has shown a number of significant
drawbacks, so making use of the sparse address space in IPv6 was only
reasonable.

>> I suppose that kind of disqualifies me as an "Autoconf zealot":-)
>
> That puts you in tier 2 of autoconf zealotry, at least in my book.

Oh, great.  Now the DHCP-only people will call me a "tier 2 autoconf
zealot" and at the same time the Autoconf-only people will call me a
"tier 2 DHCP zealot":-)

> The fact that you don't seem to be able to imagine a world with no
> RA prevents you from being disqualified altogether. Although I would
> happily stand corrected if I'm wrong.

Actually, I can imagine a world without Autoconf.

There are however a number of reasons why I consider Autoconf superior
over DHCP with regard to address assignment.

They are to some degree based on the assumption that IPv6 doesn't only
allow people to use a "many small subnets" design (with "small" being
the number of nodes attached, not any prefix lengths).  In any
security sensitive context, and that's pretty much the case in any
enterprise network, this is the reasonable way to go.  (If you don't
want to agree with this assumption I suggest we start an independent
thread here, it's actually a rather complex topic by itself.)

Address configuration with DHCP has a number of serious technical
drawbacks:

- It is more complex, and as such more susceptible to implementation
  errors and possibly even design errors.

- Unless I want to run a DHCP server in every subnet, I have to use
  routed DHCP packets between relays and servers.  These are a
  potential attack vector which doesn't exist with link-local-only
  Autoconf.

- DHCP servers are prone to DoS attacks by simply allocating
  sufficiently large numbers of addresses.  They can be made to either
  run out of addresses (when given a small address range) or either
  performance or persistent storage for the leases DB (given a large
  address range).

- Making DHCP servers redundant either takes twice the number of
  addresses or some extra effort and complexity.

The one drawback that Autoconf has is that, outside Windows/Active
Directory setups there is no commonly available means to update DNS
records.  There are a few old lab-grade tools available for Unix
(*BSD, Solaris, Linux) on my home page, but that's pretty much it.

> That's great, but what I've been trying to get across for a long time
> now is that it really doesn't matter how clever your argument is, how
> much YOU think it's reasonable, etc. The fact is that a lot of large
> enterprises won't even LOOK at IPv6 for their internal networks
> because they don't want to unravel the administrative procedures that
> they already have in place, and that are already working well for them.

I suppose I am less optimistic than you are.  From what I've seen in
the second half of the 1990s I am pretty sure that the large majority
of companies will rush towards IPv6 with a time frame of a few months,
most likely the last about six months until support for Windows XP
runs out.  The level of technical similarities doesn't really matter
that much when it all depends on management allocating money.

As far as the administrative procedures are concerned, in most cases
I've seen it was rather tedious to make the network (Cisco etc.)
people work together with the server (Unix, Windows, whatever the DHCP
server was running on) work together.

>> As I said, some functionality is only available with IPv6.
>
> Can you point some out? References would be fine here. I'd love to
> have some actual ammunition that I can point people to when they ask
> me why they should bother deploying IPv6.

Sure: Direct Access (for enterprise users) and Home Groups (for
private end users).

And of course, statically allocated global addresses for everyone.
This may not be as important to you as you are apparently based in the
U.S., but to people outside the ARIN and RIPE regions it is.

>> At another customer I recently got them moving towards IPv6 by simply
>> pointing out that this would get them rid of the problems they
>> currently have with NAT; they mentioned that at least in one case they
>> have to cross for consecutive NAT gateways "in the wrong way".  This
>> is costing them actual money.
>
> I assume you meant "four" there, and if so I would assert that their
> v4 network architecture was bad and not meeting their needs to begin
> with, so at that point tearing it all down and starting over with IPv6
> is not that great of a marginal expense.

It's not as easy.  Gert already pointed out elsewhere in this thread
that mergers and acquisitions have a huge effect on this.  Beyond that
we have large companies like Comcast who simply need more than the
RFC1918 addresses even for internal purposes.  Others just don't go
public about that same problem.

The customer I was referring to had yet another problem: They are
doing IT operations for various customers.  What happened there was
that two companies both used NAT internally (for reasons I can't go
into) and another layer of NAT towards the outside.  When they merged
and had to connect the "hidden" internal systems this turned out a bit
of a problem for that contractor.

>> Your reasoning assumes that you can get both at the same cost.  NAT
>> gateways, proxies and NAT-PT stuff all cost significant money,
>> especially if you count the "opportunity costs" in when they fail.
>> And from the experience with large scale NAT gateways I have serious
>> doubts that these coses are negligible.
>
> But the costs and upgrade activity (read, pain) are all contained in
> one silo, the network administration group. Compared to the costs
> associated with rolling new things out to every desktop,
> re-architecting existing networks, etc.; whatever costs are involved
> with setting up IPv6 compatibility at the border of the internal
> network are minuscule.

Those "opportunity costs" (I hate these fancy biztalk words, but )
because of lost e-mails or unavailable webshops or whatever are
anything but minuscule.

Rolling out IPv6 to all desktops is another issue.  As far as Windows
is concerned, and that's the vast majority of desktop machines, the
approach I suggest to my customers is to leave XP and the odd Vista
machine on IPv4, set up servers dual-stacked, prepare a new network
infrastructure (read: VLANs) for IPv6 and deploy Windows 7 right into
the IPv6 infrastructure.

The costs you talk about are a penalty for those who first deploy
Windows 7, explicitly disable IPv6 as far as possible on those
machines, and then move to IPv6.

>> Yet another issue is actually running out of addresses.  That's not
>> much of an issue in the U.S., and not too much of an issue here in
>> central Europe, but the situation is worse in the LACNIC, AfriNIC and
>> APNIC regions.
>
> I'm talking internal networks here. Lots of 1918 space available.

In case you have missed it so far: Check your favourite search engine
for "Comcast IPv6 Alain Durand" (sorry I don't have a link handy).

Beyond that, the RFC 1918 address space is too small for a few other
reasons.  Mergers and acquisitions are costly to a significant degree
because they take some significant renumbering.  Less obvious, large
enterprises suffer from unnecessary organizational overhead because
they have to manage that address space centrally.


Cheers,

    Benedikt

-- 
			 Business Grade IPv6
		    Consulting, Training, Projects

Benedikt Stockebrand, Dipl.-Inform.   http://www.benedikt-stockebrand.de/


From me at benedikt-stockebrand.de  Sat May 29 22:39:33 2010
From: me at benedikt-stockebrand.de (Benedikt Stockebrand)
Date: Sat, 29 May 2010 20:39:33 +0000
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <4BFEF41D.7010307@dougbarton.us> (Doug Barton's message of
	"Thu, 27 May 2010 15:37:17 -0700")
References: <20100527140453.GW68820@Space.Net>
	<342151.92267.qm@web31811.mail.mud.yahoo.com>
	<20100527153837.GD68820@Space.Net>
	<79A66327-8B22-48A6-B902-28F72473A766@ed.ac.uk>
	<20100527155650.GG68820@Space.Net> <4BFEEBF9.8020204@dougbarton.us>
	<4BFEF067.8030307@timmins.net> <4BFEF41D.7010307@dougbarton.us>
Message-ID: <sa74ohqphmi.fsf@benedikt-stockebrand.de>

Hi Doug and list (again),

Doug Barton <dougb at dougbarton.us> writes:

>>> You still haven't answered the question, "Why should RA be _required_
>>> in IPv6 when DHCP is perfectly capable of doing everything that RA can
>>> do and more?"
>>
>> Because RA is way easier to develop embedded devices for than DHCP.
>
> A) This may have been true 15 years ago, but as it has already been
> pointed out numerous times the marginal coast of stateless DHCP
                                                   ^^^^^^^^^
Do you mean stateless or stateful here?

> vs. RA on today's devices is well into the noise.

That may be true down to the ARM class of embedded systems used for
smart phones, PDAs and similar gear.  But check the specs for any of
the smaller Atmel AVR microcontrollers (for starters, try "Atmel_AVR"
on Wikipedia).  These are roughly in the Commodore VC-20 class of 30
years ago, and they are actually used for embedded systems.  Beyond
that, think of RFID devices.

Add to that the extra cost of implementing both Autoconf and stateful
DHCP for address management, at a total resale price of less than
maybe Euro 20 (USD 30) for an entire product, then it does make a
significant difference.

I've done a few IPv6 training workshops with people building these
kinds of devices.  The simplifications IPv6 brings for them *are*
significant as much as making their products dual-stacked is a serious
pain for them.

> And B) even if it were
> true, I don't have these theoretical micro-devices on my network, so I
> ask again, why MUST I configure RA in order to have IPv6?

Why must they implement both Autoconf and stateful DHCP?

Implementing the same feature, i.e. network layer configuration, in
several independent ways, increases the overall complexity and cost of
networks.  In the SIP telephony world this non-orthogonality provides
a rather convenient customer lock-in to the vendors, but it doesn't
really help anyone else.


Cheers,

    Benedikt

-- 
			 Business Grade IPv6
		    Consulting, Training, Projects

Benedikt Stockebrand, Dipl.-Inform.   http://www.benedikt-stockebrand.de/


From me at benedikt-stockebrand.de  Sat May 29 23:29:40 2010
From: me at benedikt-stockebrand.de (Benedikt Stockebrand)
Date: Sat, 29 May 2010 21:29:40 +0000
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg> (Doug Barton's
	message of "Mon, 24 May 2010 12:50:43 -0700 (PDT)")
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
Message-ID: <sa7eiguo0qj.fsf@benedikt-stockebrand.de>

Hi Doug and list (again^2),

Doug Barton <dougb at dougbarton.us> writes:

> On Mon, 24 May 2010, Benedikt Stockebrand wrote:
>>
>> Maybe.  But maybe I've seen too many people who want IPv6 to be
>> nothing more than "IPv4 with longer addresses".
>
> I'm responding to this bit separately because I think it deserves its
> own topic. I hear this all the time, and I'm genuinely curious about
> the answer to this question.
>
> Given all the churn in network protocols that was happening in the
> 90's already I have a theory that if "we" had simply done "IPv4 with
> longer addresses" in the first place that IPNG would have been
> deployed almost immediately and all the energy and drama that's been
> spent on trying to make it more than that could have been better spent
> elsewhere.

I don't think so.  If we had stuck with IPv4 except for the address
size we'd still have, among other issues,

- a maximum of 60 bytes for header options, rather than flexible
  extension headers

- carrying around fragmentation information in every packet even
  though it is barely ever used, rather than a fragmentation extension
  header

- no standardized way to deal with address collisions, rather than
  duplicate address detection

- variable length netmasks as a common misconfiguration issue, rather
  than an implicit /64

- miscalculated netmasks due to the decimal notation, rather than the
  more simple hex-to-binary calculations

- obscure routing problems due to either these miscalculations or
  people trying to use non-monotonous netmasks, rather than using
  prefix lengths only

- IP header checksums that have to be recomputed at every router,
  rather than leaving it to the link layer and transport layer
  pseudo-header mechanisms

- Router side fragmentation as well as path MTU discovery, rather than
  pMTUd only

- An extremely small minimum MTU (296 bytes), rather than 1280

- No link-local scope and subsequent simplifications

- No generally usable anycast but somewhat kludgy or
  application-specific approaches

- Impractical multicast routing, rather than feasible enterprise-wide
  multicast routing.

- Non-global addresses used over and again, causing significant
  problems during mergers and acquisitions (among others), rather than
  unique-local addresses

- A dense address space which takes significantly more effort to
  manage

- A rather historically grown ICMP type/code allocation, rather than a
  cleaned-up one

- Loose source routing

- No jumbograms

- The need for VRRP, HSRP or passive routing daemons on all clients to
  set up redundant routers

and whatever else I would have found in the remaining two thirds of a
training presentation on IPv6 protocols I wrote for a
protocol-oriented customer.

Generally speaking, IPv6 gets rid of a significant number of
limitations of IPv4.  Many of them are "minor", but in sum they do
make a significant difference.  

The one many people find difficult to come to grips with is the sparse
address space, which simplifies configuration, gets rid of a number of
security issues and significantly simplifies address management.

> So my question is, other than longer addresses, what are the benefits
> to IPv6 that I can point clients to which will help them justify the
> expense of the upgrade?

The benefit I can point out to customers even without significant
technical background is this one: In the traditional telephony world
we are normally talking about an end-to-end availability around five
niners (99.999%, or ~4.5 minutes/year downtime) including scheduled
downtimes.  In the IP world we are a long way away from that.  IPv6
offers so many "minor" simplifications and improvements that offer a
significant increase in overall reliability.

Aside from that, once Microsoft stops supporting XP the majority of
machines will take extra effort and cost to be run with IPv4 while at
the same time some new functionality won't be available.


Cheers,

    Benedikt

-- 
			 Business Grade IPv6
		    Consulting, Training, Projects

Benedikt Stockebrand, Dipl.-Inform.   http://www.benedikt-stockebrand.de/


From nick-lists at netability.ie  Sat May 29 23:39:44 2010
From: nick-lists at netability.ie (Nick Hilliard)
Date: Sat, 29 May 2010 22:39:44 +0100
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <sa7eiguo0qj.fsf@benedikt-stockebrand.de>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
	<sa7eiguo0qj.fsf@benedikt-stockebrand.de>
Message-ID: <4C0189A0.4030509@netability.ie>

On 29/05/2010 22:29, Benedikt Stockebrand wrote:
> I don't think so.  If we had stuck with IPv4 except for the address
> size we'd still have, among other issues,
[...]
> - The need for VRRP, HSRP or passive routing daemons on all clients to
>   set up redundant routers

This statement makes it quite clear that you have never managed ipv6 in a
reliable production environment on an ongoing basis.

Nick

From dougb at dougbarton.us  Sun May 30 01:07:38 2010
From: dougb at dougbarton.us (Doug Barton)
Date: Sat, 29 May 2010 16:07:38 -0700
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <sa7eiguo0qj.fsf@benedikt-stockebrand.de>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
	<sa7eiguo0qj.fsf@benedikt-stockebrand.de>
Message-ID: <4C019E3A.9060403@dougbarton.us>

On 5/29/2010 2:29 PM, Benedikt Stockebrand wrote:
>
> I don't think so.  If we had stuck with IPv4 except for the address
> size we'd still have

... all the things we have now, which work just fine except for the
upcoming free address pool exhaustion.

I've already said, I understand that there are some things about IPv6
that are "better" than IPv4 in addition to the longer addresses. However
at this point I don't see any new information entering the discussion,
which is what I was really hoping to see. Thanks to everyone who
participated in any case. :)


Doug

-- 

	... and that's just a little bit of history repeating.
			-- Propellerheads

	Improve the effectiveness of your Internet presence with
	a domain name makeover!    http://SupersetSolutions.com/


From me at benedikt-stockebrand.de  Sun May 30 12:05:45 2010
From: me at benedikt-stockebrand.de (Benedikt Stockebrand)
Date: Sun, 30 May 2010 10:05:45 +0000
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <4C0189A0.4030509@netability.ie> (Nick Hilliard's message of
	"Sat, 29 May 2010 22:39:44 +0100")
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
	<sa7eiguo0qj.fsf@benedikt-stockebrand.de>
	<4C0189A0.4030509@netability.ie>
Message-ID: <sa7mxvh7lhi.fsf@benedikt-stockebrand.de>

Hi Nick and list,

Nick Hilliard <nick-lists at netability.ie> writes:

> On 29/05/2010 22:29, Benedikt Stockebrand wrote:
>> I don't think so.  If we had stuck with IPv4 except for the address
>> size we'd still have, among other issues,
> [...]
>> - The need for VRRP, HSRP or passive routing daemons on all clients to
>>   set up redundant routers
>
> This statement makes it quite clear that you have never managed ipv6 in a
> reliable production environment on an ongoing basis.

Sorry Nick, but that's not true.  Have you ever seen anything
outside large scale enterprises or data center environments with
specialized technical staff?

I've seen way too many jack-of-all-trade sysadmins, the kind who know
way more about toner cartridges and Microsoft Office end user problems
than both of us together, trying to keep a number of small business
networks up and running.  And their colleagues, doing much the same
work within large enterprises with a huge number of points of sale or
home office users in rather remote locations.

Using Autoconf and Network Unreachability Detection for router
failover doesn't give you the fastest failover time, but at least it
gives these people a chance.

For the same reason, in these environments I'd rather use RIP{v2,ng}
over OSPFv[23].  You always have to find the balance between
easy-to-handle simplicity and ultimate-performance complexity on an
individual basis, and in all these cases it largely depends on the
people involved rather than the technology as such.


Cheers,

    Benedikt

-- 
			 Business Grade IPv6
		    Consulting, Training, Projects

Benedikt Stockebrand, Dipl.-Inform.   http://www.benedikt-stockebrand.de/


From fw at deneb.enyo.de  Sun May 30 20:49:10 2010
From: fw at deneb.enyo.de (Florian Weimer)
Date: Sun, 30 May 2010 20:49:10 +0200
Subject: Mysterious missing DHCPv6 feature,
	was Re: How does one obtain an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <sa7hbm5v8v4.fsf@benedikt-stockebrand.de> (Benedikt Stockebrand's
	message of "Tue, 18 May 2010 09:48:15 +0000")
References: <alpine.DEB.1.10.1005170804200.28457@uplift.swm.pp.se>
	<20100517.084430.78711679.sthaug@nethelp.no>
	<20100518075150.404fd6a6@opy.nosense.org>
	<20100518.073644.23028119.he@uninett.no>
	<sa7hbm5v8v4.fsf@benedikt-stockebrand.de>
Message-ID: <874ohpns2h.fsf@mid.deneb.enyo.de>

* Benedikt Stockebrand:

> I disagree here.  From what I've seen so far the key problem with
> regard to IPv6 is that a lot of people try to make IPv6 an "IPv4 with
> larger addresses", preserving all the workarounds they have come to
> get used to.  "We've always used DHCP", "I want my NAT back", "I've
> always written IP addresses in decimal", "There can't be multiple
> default routes in a routing table" and so on.

On the other hand, increased familiarity helps to cut down training
and documentation costs, and generally makes things easier to run.

From nanog at 85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org  Mon May 31 14:58:54 2010
From: nanog at 85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org (Mark Smith)
Date: Mon, 31 May 2010 22:28:54 +0930
Subject: [ipv6-ops]  Re: So why is "IPv4 with longer addresses" a
	problem anyway?
In-Reply-To: <67FDAEC4-6755-46BC-9A95-8E17F15D4817@cisco.com>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
	<9AAE6366-7974-4F42-9707-FF9A1CF28E87@nosignal.org>
	<20100526184532.GB14781@trace.bind.com>
	<20100527070205.690e8cdb@opy.nosense.org>
	<67FDAEC4-6755-46BC-9A95-8E17F15D4817@cisco.com>
Message-ID: <20100531222854.7188fff8@85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org>

Hi Fred,

On Wed, 26 May 2010 17:01:08 -0700
Fred Baker <fred at cisco.com> wrote:

> 
> On May 26, 2010, at 2:32 PM, Mark Smith wrote:
> 
> > IMHO, if the Internet was running IPX (32 bit network number, 48 bit node address), we'd still be running it, and wouldn't now have the problem of running out of addresses. 
> 
> well, yes, but we might have some issues with route scaling. IPX enumerates LANs, not edge networks or the ISPs that serve them. 
> 

My understanding, based on what Radia Perlman says about IPX in
"Interconnections", is that IPX network look up was actually longest
match, rather than exact match. In the time I worked with IPX, I never
saw or heard of anybody aggregating IPX networks, however it would seem
the spec might have allowed it.

A quick google search seems to show IOS supported specifying a mask on
an IPX static route, so that also suggests that IPX routing is longest
match:

http://www.cisco.com/en/US/docs/ios/12_2/atipx/command/reference/2rfipx3.html#wp1024096

> We could make the same comment about CLNS and NSAPs; CLNS enumerates networks, and within them, subnets and hosts. The networks would be the edge networks, not the ISPs that serve them.
> 
> IPv6 isn't perfect. The nice thing about it is that we can reasonably enumerate hosts, subnets (/64), edge networks (/48 or longer), and ISPs (/32 or thereabouts). 

Regards,
Mark.


From nick at foobar.org  Mon May 31 15:34:23 2010
From: nick at foobar.org (Nick Hilliard)
Date: Mon, 31 May 2010 14:34:23 +0100
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <sa7mxvh7lhi.fsf@benedikt-stockebrand.de>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>	<sa7eiguo0qj.fsf@benedikt-stockebrand.de>	<4C0189A0.4030509@netability.ie>
	<sa7mxvh7lhi.fsf@benedikt-stockebrand.de>
Message-ID: <4C03BADF.3080902@foobar.org>

On 30/05/2010 11:05, Benedikt Stockebrand wrote:
> Using Autoconf and Network Unreachability Detection for router
> failover doesn't give you the fastest failover time, but at least it
> gives these people a chance.

Depending on RA means:

- loss of service measured in (by default) minutes in the case of router
failure
- serious security problems due to rogue RA announcements by unauthorised
network clients

Either of these problems on their own makes RA unsuitable for most
applications other than enthusiast / home / playpen.

But, if you want to operate your network with lousy availability
characteristics and where any arbitrary client can hijack the network, then
by all means, please go ahead and do so.  Just don't pretend that it's
going to be reliable.

Nick

From elmi at 4ever.de  Mon May 31 15:40:55 2010
From: elmi at 4ever.de (Elmar K. Bins)
Date: Mon, 31 May 2010 15:40:55 +0200
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <4C03BADF.3080902@foobar.org>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
	<sa7eiguo0qj.fsf@benedikt-stockebrand.de>
	<4C0189A0.4030509@netability.ie>
	<sa7mxvh7lhi.fsf@benedikt-stockebrand.de>
	<4C03BADF.3080902@foobar.org>
Message-ID: <20100531134055.GV88261@ronin.4ever.de>

Re Nick,

nick at foobar.org (Nick Hilliard) wrote:

> On 30/05/2010 11:05, Benedikt Stockebrand wrote:
> > Using Autoconf and Network Unreachability Detection for router
> > failover doesn't give you the fastest failover time, but at least it
> > gives these people a chance.
> 
> Depending on RA means:
> 
> - loss of service measured in (by default) minutes in the case of router failure
> - serious security problems due to rogue RA announcements by unauthorised network clients

It gets more interesting if you try to really help your users with
an anycast gateway address. How do you propagate this one, and not
the routers', with RAs?

(Still, for workstation networks, DHCPv6 doesn't seem to really work
and RA is the "builtin" solution)


But basically, I believe the discussion comes from two very different
standpoints/outlooks, and while Benedikt is right in hammering into
our brains that "normal admins" will have to use the whole crap, I
want to remind you guys that this list is for the clueful (aren't we
all?)...

;-)

Elmar.



From phrickman at upcbroadband.com  Mon May 31 15:45:47 2010
From: phrickman at upcbroadband.com (Rickman, Phil)
Date: Mon, 31 May 2010 15:45:47 +0200
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <4C03BADF.3080902@foobar.org>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
	<sa7eiguo0qj.fsf@benedikt-stockebrand.de>	<4C0189A0.4030509@netability.ie>
	<sa7mxvh7lhi.fsf@benedikt-stockebrand.de>, <4C03BADF.3080902@foobar.org>
Message-ID: <C118CB386E772145997A81F7A8B7258F28693A2C37@AMS2PMS3001.upcit.ds.upc.biz>

SEND
http://www.ietf.org/rfc/rfc3971.txt

- loss of service measured in (by default) minutes in the case of router
failure ..............."untrue"
Please show reference documentation providing this or the specific platforms/vendors.
RAs are refreshed no on lifetime but on next receipt.

http://www.cisco.com/en/US/docs/security/fwsm/fwsm31/configuration/guide/ipv6_f.html#wp1056298

    Configuring the Router Lifetime Value

    The router lifetime value specifies how long nodes on the local link should consider FWSM as the default router on the link.

    To configure the router lifetime value in IPv6 router advertisements on an interface, enter the following command:

    hostname(config-if)# ipv6 nd ra-lifetime seconds

    Valid values range from 0 to 9000 seconds. The default is 1800 seconds. Entering 0 indicates that FWSM should not be considered a default router on the selected interface.


    Configuring the Router Advertisement Transmission Interval

    By default, router advertisements are sent out every 200 seconds. To change the interval between router advertisement transmissions on an interface, enter the following command:

    ipv6 nd ra-interval [msec] value 

    Valid values range from 3 to 1800 seconds (or ******500****** to 1800000 milliseconds if the msec keyword is used). "note you can now drop this on most vendors to 300 ms"

    The interval between transmissions should be less than or equal to the IPv6 router advertisement lifetime if FWSM is configured as a default router by using the ipv6 nd ra-lifetime command. To prevent synchronization with other IPv6 nodes, randomly adjust the actual value used to within 20      percent of the desired value.


- serious security problems due to rogue RA announcements by unauthorised
network clients ........."untrue"
there are numerous mechanisms to prevent unauthorized RA suppression upstream towards CMTS bundles, enterprise & ISP topologies.
Again please provide proof as I am tired of giving you information you should already know if stating you are an authority


Phil Rickman
NDA

DD - +31 207 789 969
Mob:  +31 610847604
________________________________________
From: ipv6-ops-bounces+ipv6=aorta.net at lists.cluenet.de [ipv6-ops-bounces+ipv6=aorta.net at lists.cluenet.de] On Behalf Of Nick Hilliard [nick at foobar.org]
Sent: 31 May 2010 15:34
To: Benedikt Stockebrand
Cc: ipv6-ops at lists.cluenet.de
Subject: Re: So why is "IPv4 with longer addresses" a problem anyway?

On 30/05/2010 11:05, Benedikt Stockebrand wrote:
> Using Autoconf and Network Unreachability Detection for router
> failover doesn't give you the fastest failover time, but at least it
> gives these people a chance.

Depending on RA means:

- loss of service measured in (by default) minutes in the case of router
failure
- serious security problems due to rogue RA announcements by unauthorised
network clients

Either of these problems on their own makes RA unsuitable for most
applications other than enthusiast / home / playpen.

But, if you want to operate your network with lousy availability
characteristics and where any arbitrary client can hijack the network, then
by all means, please go ahead and do so.  Just don't pretend that it's
going to be reliable.

Nick

From phrickman at upcbroadband.com  Mon May 31 15:50:15 2010
From: phrickman at upcbroadband.com (Rickman, Phil)
Date: Mon, 31 May 2010 15:50:15 +0200
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <4C03BADF.3080902@foobar.org>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
	<sa7eiguo0qj.fsf@benedikt-stockebrand.de>	<4C0189A0.4030509@netability.ie>
	<sa7mxvh7lhi.fsf@benedikt-stockebrand.de>, <4C03BADF.3080902@foobar.org>
Message-ID: <C118CB386E772145997A81F7A8B7258F28693A2C39@AMS2PMS3001.upcit.ds.upc.biz>

Nick,

one final point.
I am curious how you wish to dynamic assign 2,000 clients, for an examples, gateways if DHCPv6 does not support it?
Planning to run around statically configuring them all?

RA prefix suppression is one thing , gateway assignment suppression kinda breaks your network by suppressing all gateways is another, MTU & best path data is another.
Please keep your comments less emotive


Phil 
________________________________________
From: ipv6-ops-bounces+ipv6=aorta.net at lists.cluenet.de [ipv6-ops-bounces+ipv6=aorta.net at lists.cluenet.de] On Behalf Of Nick Hilliard [nick at foobar.org]
Sent: 31 May 2010 15:34
To: Benedikt Stockebrand
Cc: ipv6-ops at lists.cluenet.de
Subject: Re: So why is "IPv4 with longer addresses" a problem anyway?

On 30/05/2010 11:05, Benedikt Stockebrand wrote:
> Using Autoconf and Network Unreachability Detection for router
> failover doesn't give you the fastest failover time, but at least it
> gives these people a chance.

Depending on RA means:

- loss of service measured in (by default) minutes in the case of router
failure
- serious security problems due to rogue RA announcements by unauthorised
network clients

Either of these problems on their own makes RA unsuitable for most
applications other than enthusiast / home / playpen.

But, if you want to operate your network with lousy availability
characteristics and where any arbitrary client can hijack the network, then
by all means, please go ahead and do so.  Just don't pretend that it's
going to be reliable.

Nick

From david.freedman at uk.clara.net  Mon May 31 15:58:27 2010
From: david.freedman at uk.clara.net (David Freedman)
Date: Mon, 31 May 2010 14:58:27 +0100
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <C118CB386E772145997A81F7A8B7258F28693A2C39@AMS2PMS3001.upcit.ds.upc.biz>
Message-ID: <C8297F13.3456C%david.freedman@uk.clara.net>


> one final point.
> I am curious how you wish to dynamic assign 2,000 clients, for an examples,
> gateways if DHCPv6 does not support it?

Yes, I think the point here is "Make DHCPv6 support it" , folk should have
the choice to use the lightweight, insecure RA or not.

You keep mentioning "suppression" with regards to RA and confusing it with
some form of security, I think Nick is alluding to the ability of parties to
inject rogue RA into a network and for it to be accepted, one possible
solution to this is
<http://tools.ietf.org/html/draft-ietf-v6ops-ra-guard-05> which has yet to
be implemented in mainstream equipment.

Dave.




From phrickman at upcbroadband.com  Mon May 31 15:59:25 2010
From: phrickman at upcbroadband.com (Rickman, Phil)
Date: Mon, 31 May 2010 15:59:25 +0200
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <C8297F13.3456C%david.freedman@uk.clara.net>
References: <C118CB386E772145997A81F7A8B7258F28693A2C39@AMS2PMS3001.upcit.ds.upc.biz>,
	<C8297F13.3456C%david.freedman@uk.clara.net>
Message-ID: <C118CB386E772145997A81F7A8B7258F28693A2C3A@AMS2PMS3001.upcit.ds.upc.biz>

aye I did link the SEND RFC for him


Phil 
________________________________________
From: David Freedman [david.freedman at uk.clara.net]
Sent: 31 May 2010 15:58
To: Rickman, Phil; Nick Hilliard; Benedikt Stockebrand
Cc: ipv6-ops at lists.cluenet.de
Subject: Re: So why is "IPv4 with longer addresses" a problem anyway?

> one final point.
> I am curious how you wish to dynamic assign 2,000 clients, for an examples,
> gateways if DHCPv6 does not support it?

Yes, I think the point here is "Make DHCPv6 support it" , folk should have
the choice to use the lightweight, insecure RA or not.

You keep mentioning "suppression" with regards to RA and confusing it with
some form of security, I think Nick is alluding to the ability of parties to
inject rogue RA into a network and for it to be accepted, one possible
solution to this is
<http://tools.ietf.org/html/draft-ietf-v6ops-ra-guard-05> which has yet to
be implemented in mainstream equipment.

Dave.




From phrickman at upcbroadband.com  Mon May 31 16:00:35 2010
From: phrickman at upcbroadband.com (Rickman, Phil)
Date: Mon, 31 May 2010 16:00:35 +0200
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <C8297F13.3456C%david.freedman@uk.clara.net>
References: <C118CB386E772145997A81F7A8B7258F28693A2C39@AMS2PMS3001.upcit.ds.upc.biz>,
	<C8297F13.3456C%david.freedman@uk.clara.net>
Message-ID: <C118CB386E772145997A81F7A8B7258F28693A2C3B@AMS2PMS3001.upcit.ds.upc.biz>

And Dave one more item.
Suppress of receipt as well as delivery, which I think was his point originally.

Phil 
________________________________________
From: David Freedman [david.freedman at uk.clara.net]
Sent: 31 May 2010 15:58
To: Rickman, Phil; Nick Hilliard; Benedikt Stockebrand
Cc: ipv6-ops at lists.cluenet.de
Subject: Re: So why is "IPv4 with longer addresses" a problem anyway?

> one final point.
> I am curious how you wish to dynamic assign 2,000 clients, for an examples,
> gateways if DHCPv6 does not support it?

Yes, I think the point here is "Make DHCPv6 support it" , folk should have
the choice to use the lightweight, insecure RA or not.

You keep mentioning "suppression" with regards to RA and confusing it with
some form of security, I think Nick is alluding to the ability of parties to
inject rogue RA into a network and for it to be accepted, one possible
solution to this is
<http://tools.ietf.org/html/draft-ietf-v6ops-ra-guard-05> which has yet to
be implemented in mainstream equipment.

Dave.




From nick at foobar.org  Mon May 31 17:19:06 2010
From: nick at foobar.org (Nick Hilliard)
Date: Mon, 31 May 2010 16:19:06 +0100
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <C118CB386E772145997A81F7A8B7258F28693A2C37@AMS2PMS3001.upcit.ds.upc.biz>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>	<sa7eiguo0qj.fsf@benedikt-stockebrand.de>	<4C0189A0.4030509@netability.ie>	<sa7mxvh7lhi.fsf@benedikt-stockebrand.de>,
	<4C03BADF.3080902@foobar.org>
	<C118CB386E772145997A81F7A8B7258F28693A2C37@AMS2PMS3001.upcit.ds.upc.biz>
Message-ID: <4C03D36A.2050903@foobar.org>

On 31/05/2010 14:45, Rickman, Phil wrote:
> SEND
> http://www.ietf.org/rfc/rfc3971.txt

SEND is not supported by Windows or OS/X.  I understand that there are
implementations for linux, freebsd and on the switch side, Cisco - and only
on one or two platforms.

> - loss of service measured in (by default) minutes in the case of router
> failure ..............."untrue"
> Please show reference documentation providing this or the specific platforms/vendors.
> RAs are refreshed no on lifetime but on next receipt.

RFC 2461, section 6.3.4:

"the receipt of a Router Advertisement MUST NOT invalidate all information
received in a previous advertisement or from another source.  However, when
received information for a specific parameter (e.g., Link MTU) or option
(e.g., Lifetime on a specific Prefix) differs from information received
earlier, and the parameter/option can only have one value, the most
recently-received information is considered authoritative."

... and the rest of section 6.3.4, which provides the mechanism for RA
Default Router List timeout.

Please read this section carefully.  You are simply not guaranteed quick
failover when using RA.  Yes, you can tune things down, but it's never
going to be anything like a router failover protocol.

> - serious security problems due to rogue RA announcements by unauthorised
> network clients ........."untrue"
> there are numerous mechanisms to prevent unauthorized RA suppression
> upstream towards CMTS bundles, enterprise & ISP topologies.

As Dave Freedman noted, this was a reference to draft-ietf-v6ops-ra-guard.
 None of the vendors that I deal with support this feature explicitly
(although, as I noted previously, some of them have indicated that in some
of their higher-end L3 switching kit, you can kludge workarounds).

> Again please provide proof as I am tired of giving you information you
> should already know if stating you are an authority

I'd be happy to retract a statement like that if you can provide a
reference.  If you can't find where you think I stated this (and I have no
memory of ever saying or implying anything of the sort), then the
gentlemanly thing to do would be to retract your allegation.

Nick

From nick at foobar.org  Mon May 31 17:38:02 2010
From: nick at foobar.org (Nick Hilliard)
Date: Mon, 31 May 2010 16:38:02 +0100
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <C118CB386E772145997A81F7A8B7258F28693A2C39@AMS2PMS3001.upcit.ds.upc.biz>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>	<sa7eiguo0qj.fsf@benedikt-stockebrand.de>	<4C0189A0.4030509@netability.ie>	<sa7mxvh7lhi.fsf@benedikt-stockebrand.de>,
	<4C03BADF.3080902@foobar.org>
	<C118CB386E772145997A81F7A8B7258F28693A2C39@AMS2PMS3001.upcit.ds.upc.biz>
Message-ID: <4C03D7DA.5020006@foobar.org>

On 31/05/2010 14:50, Rickman, Phil wrote:
> one final point.
> I am curious how you wish to dynamic assign 2,000 clients, for an
> examples, gateways if DHCPv6 does not support it?
> Planning to run around statically configuring them all?

This is the irony, isn't it?  One of the selling points of ipv6 was that it
supported auto-configuration from day 1.  13 years later, we only recently
have functional protocol support for auto-configuration / auto-assignment,
and even at that, the client side support is still pretty immature.

At least Windows vista/7, Linux and FreeBSD all support dhcpv6.  I look
forward to seeing os/x support some time soon.

Nick

From mtinka at globaltransit.net  Mon May 31 18:47:19 2010
From: mtinka at globaltransit.net (Mark Tinka)
Date: Tue, 1 Jun 2010 00:47:19 +0800
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <sa7mxvh7lhi.fsf@benedikt-stockebrand.de>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
	<4C0189A0.4030509@netability.ie>
	<sa7mxvh7lhi.fsf@benedikt-stockebrand.de>
Message-ID: <201006010047.26322.mtinka@globaltransit.net>

On Sunday 30 May 2010 06:05:45 pm Benedikt Stockebrand 
wrote:

> For the same reason, in these environments I'd rather use
>  RIP{v2,ng} over OSPFv[23].  You always have to find the
>  balance between easy-to-handle simplicity and
>  ultimate-performance complexity on an individual basis,
>  and in all these cases it largely depends on the people
>  involved rather than the technology as such.

I probably wouldn't go around saying RIP is better to deploy 
than a link-state routing protocol (despite the "balance 
between easy-to-handle simplicity and ultimate performance 
complexity" quote), but I gather that isn't the gist of this 
thread.

Mark.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
Url : http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20100601/fe5ca04d/attachment.bin 

From nick at foobar.org  Mon May 31 18:57:04 2010
From: nick at foobar.org (Nick Hilliard)
Date: Mon, 31 May 2010 17:57:04 +0100
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <201006010047.26322.mtinka@globaltransit.net>
References: <alpine.BSF.2.00.1005241244190.3582@qbhto.arg>
	<4C0189A0.4030509@netability.ie>
	<sa7mxvh7lhi.fsf@benedikt-stockebrand.de>
	<201006010047.26322.mtinka@globaltransit.net>
Message-ID: <4C03EA60.4040905@foobar.org>

On 31/05/2010 17:47, Mark Tinka wrote:
> I probably wouldn't go around saying RIP is better to deploy 
> than a link-state routing protocol (despite the "balance 
> between easy-to-handle simplicity and ultimate performance 
> complexity" quote), but I gather that isn't the gist of this 
> thread.

Ironically, there is little difference between a router multicasting RA
"hello, i'm a candidate default gateway" notifications every 300ms - 1800s
and a RIP router broadcasting "hello, i'm a candidate default gateway"
every 30s.

We learned in the 1980s that it was a bad idea to have uncontrolled
announcements like this with RIP.  I don't understand why we forgot that
lesson.

Nick

From dougb at FreeBSD.org  Thu May 27 23:59:27 2010
From: dougb at FreeBSD.org (Doug Barton)
Date: Thu, 27 May 2010 14:59:27 -0700
Subject: Mysterious missing DHCPv6 feature, was Re: How does one obtain
	an IPv6 DNS server when VPNing to an ASA?
In-Reply-To: <4BFEC479.3030005@ipinc.net>
References: <464482.57725.qm@web31805.mail.mud.yahoo.com>	<sa7d3wtv5nv.fsf@benedikt-stockebrand.de>	<4BF33252.1070103@dougbarton.us>	<sa78w7917fq.fsf@benedikt-stockebrand.de>	<alpine.BSF.2.00.1005241223170.3582@qbhto.arg>	<20100527135346.GV68820@Space.Net>
	<4BFEC479.3030005@ipinc.net>
Message-ID: <4BFEEB3F.7060602@FreeBSD.org>

On 5/27/2010 12:14 PM, Ted Mittelstaedt wrote:
>
> On 5/27/2010 6:53 AM, Gert Doering wrote:
>> Hi,
>>
>> On Mon, May 24, 2010 at 12:42:30PM -0700, Doug Barton wrote:
>>> I'm talking internal networks here. Lots of 1918 space available.
>>
>> I wonder why there's so much address collisions between VPN sites and
>> at enterprise mergers and acquisitions...
>>
>
> Because everyone uses 192.168.1.X since that's the default on
> most translators.

Right-O. Or 10.0.0.0/24, or what have you. At $SEVERAL_JOBS_AGO when we 
were talking about setting up subnets for an isolated internal project I 
suggested using 172.16/12 since we weren't using any of that space at 
the time, and I wanted the new thing to be clearly identifiable as 
"other." I was told that we couldn't do that because those were public 
addresses. Another time we were dealing with reorganizing some internal 
networks for local and remote offices I suggested that we _start_ our 
organizational plan at 10.200 and give each site their own /16. They 
looked at me like I had 3 heads.

> The solution - renumbering - isn't going to go away after IPv6.
> When you have a merger you may get away with not immediately
> renumbering as a result of IPv6 but you almost certainly are going
> to be changing ISP's used at the acquired entity, and when you
> do that you will have to renumber the inside network.

... or it's just easier to have everyone under the same prefix, etc. 
I've been on both sides of the M&A equation, so I think I understand the 
issues there pretty well.

My point being that IPv6 doesn't magically fix the renumbering problems 
(such as they are) that exist in IPv4 today. It does make some things 
easier, but it comes at a cost. The important thing is to do a 
_realistic_ assessment of both the costs and the benefits.


Doug

-- 

	... and that's just a little bit of history repeating.
			-- Propellerheads

	Improve the effectiveness of your Internet presence with
	a domain name makeover!    http://SupersetSolutions.com/


From LTosolini at upcbroadband.com  Mon May 31 16:10:34 2010
From: LTosolini at upcbroadband.com (Tosolini, Luca)
Date: Mon, 31 May 2010 16:10:34 +0200
Subject: So why is "IPv4 with longer addresses" a problem anyway?
In-Reply-To: <C8297F13.3456C%david.freedman@uk.clara.net>
References: <C118CB386E772145997A81F7A8B7258F28693A2C39@AMS2PMS3001.upcit.ds.upc.biz>,
	<C8297F13.3456C%david.freedman@uk.clara.net>
Message-ID: <81D49719B798A4429C3958475FCDF2F362117C7BC6@AMS2PMS4001.upcit.ds.upc.biz>

an interesting proposal is to convey the default-router in DHCP only; thus making RA less of a requirement:

http://tools.ietf.org/html/draft-dec-dhcpv6-route-option-03

Luca.
________________________________________
From: ipv6-ops-bounces+ipv6=aorta.net at lists.cluenet.de [ipv6-ops-bounces+ipv6=aorta.net at lists.cluenet.de] On Behalf Of David Freedman [david.freedman at uk.clara.net]
Sent: Monday, May 31, 2010 3:58 PM
To: Rickman, Phil; Nick Hilliard; Benedikt Stockebrand
Cc: ipv6-ops at lists.cluenet.de
Subject: Re: So why is "IPv4 with longer addresses" a problem anyway?

> one final point.
> I am curious how you wish to dynamic assign 2,000 clients, for an examples,
> gateways if DHCPv6 does not support it?

Yes, I think the point here is "Make DHCPv6 support it" , folk should have
the choice to use the lightweight, insecure RA or not.

You keep mentioning "suppression" with regards to RA and confusing it with
some form of security, I think Nick is alluding to the ability of parties to
inject rogue RA into a network and for it to be accepted, one possible
solution to this is
<http://tools.ietf.org/html/draft-ietf-v6ops-ra-guard-05> which has yet to
be implemented in mainstream equipment.

Dave.