Re: ping-pong phenomenon with p2p links & /127 prefixes

[Truman Boyes <truman@suspicious.org>]

On 17/08/2010, at 8:42 PM, Seiichi Kawamura wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Eric Vyncke (evyncke) wrote:
>> [Changing slightly to a different angle]
>> 
>> I agree with most people that pingable interfaces on all core routers are very useful/interesting to say the least (even if I do not operate a SP network, I get the idea :-)).
>> 
>>> From the security perspective, having hidden/not reachable router interfaces is also very useful :) 
>> 
>> There are a couple of ways of achieving this: from an infrastructure ACL deployed at the edge (easier to do in IPv6 thanks to new addressing plan), to using ULA on the interfaces (+ a global as ICMP source), to using only LLA (and a few other techniques).
>> 
>> Which technique is used nowadays in IPv6 network?  I guess that infra ACL are used (parity with IPv4) or am I wrong?
> 
> Some enterprise customers using VPNs(IPsec and SSL) have this requirement.
> In many cases NAT plus some evil routing technique is used to hide,
> and ACL is used to deny reachability.
> This is in IPv4 world. In IPv6 world, nobody has requested
> VPN services and many VPN boxes still run only IPv4 so
> I really don't have a clue yet to what we'll do.
> We probably will not use ULA though.
> 
> Regards,
> Seiichi
> 
>> 
>> Regards
>> 
>> -éric
>> 

<snip>

Hiding the internal addresses of infrastructure links in service provider networks is generally done when the SP uses MPLS and TTL propagation or decrementing is disabled. This works with ipv6 vpns in MPLS today and is very common. 

Truman