Re: simple security

[Fred Baker <fred@cisco.com>]

The default table, as you point out, doesn't specifically reference FC00::/7; it prefers localhost to any IPv6 address, any IPv6 address to a 6to4 address, and 6to4 to any IPv4/IPv6 translation mechanism using a well known prefix. As such, the next rule will apply. The next rule, as I understand it, will be to order the available addresses by the length of their matching prefixes from longest to shortest.

I would expect, given that scenario, that if we are within the same edge network (the most common use of ULAs), we will have at least one and perhaps several prefixes that are longer than /48, and the exact choice will be specific to the address pair being compared but may choose the ULA. If we are not in the same network but share PA prefixes from an ISP, we are likely to use that ISP's prefix. if we do not share prefixes allocated by an ISP, your guess is as good as mine.

I would actually not suggest adding FC00::/7 to the default table; if some system on the other side of the world is advertising a ULA in DNS and you have one, you'll try ULA-to-ULA in preference and you won't be happy with the result. However, you might add your own ULA within your domain in preference to ::/0.

On Mar 29, 2010, at 9:37 AM, Mohacsi Janos wrote:

> 
> 
> 
> On Mon, 29 Mar 2010, Hemant Singh (shemant) wrote:
> 
>> 
>> -----Original Message-----
>> From: owner-v6ops@ops.ietf.org [mailto:owner-v6ops@ops.ietf.org] On
>> Behalf Of Mohacsi Janos
>> Sent: Monday, March 29, 2010 12:19 AM
>> To: Konrad Rosenbaum
>> Cc: v6ops@ops.ietf.org
>> Subject: Re: simple security
>> 
>>> The current RFC 3484 does not cope properly with ULA addresses,
>> 
>> What do you mean by not cope?  ULA and the GUA have global scope and the
>> longest prefix match works fine for packet forwarding if both a ULA and
>> a GUA are configured on a network interface.  I don't see any gotcha
>> with RFC 3484 with use of ULA or with use of ULA and a GUA on a network
>> interface.
> 
> Yes. You are right, but in the context, that I wrote I don't see it is enough. If you have two nodes with both GUA and ULA, but different subnets inside a site:
> 
> 
> [node1]----------[router]---------[node2]
> 
> 
> Both GUA and ULA addresses are configured in the DNS...
> 
> What to configure no node1 and node2 to prefer ULA communication between node1 and node2?
> 
> And contrary, if I want prefer GUA usage between nodes?
> 
> Can I do it with the current default RFC 3484?
> 
> In the default policy table
>      Prefix        Precedence Label
>      ::1/128               50     0
>      ::/0                  40     1
>      2002::/16             30     2
>      ::/96                 20     3
>      ::ffff:0:0/96         10     4
> 
> Best Regards,
> 		Janos Mohacsi
> 

http://www.ipinc.net/IPv4.GIF