[HN Gopher] Thinking about our passive exposure to IPv6 issues
___________________________________________________________________
Thinking about our passive exposure to IPv6 issues
Author : jesprenj
Score : 34 points
Date : 2023-04-25 05:21 UTC (1 days ago)
(HTM) web link (utcc.utoronto.ca)
(TXT) w3m dump (utcc.utoronto.ca)
| ehPReth wrote:
| I am now supreme leader, IPv6 is mandatory for everyone with at
| least a /48 prefix available per location by 2025 or we'll break
| down your doors and take over; no IPv6 NAT allowed.
|
| ..if only. :(
| icedchai wrote:
| IPv4 started like that. I worked at several ISPs, one of which
| had a ton of address space, and we gave every dedicated
| customer site a /24 by default. We had public IPs on all the
| desktops, no NAT, and generally no firewalls. The good old
| days...
| greyface- wrote:
| What are you going to do when your students need to access an
| IPv6-only service? How do the instructors of your networks
| courses feel about this approach? Do you think the lack of
| exposure to IPv6 puts your students at an advantage or
| disadvantage compared to those graduating from an institution
| running dual stacks?
| fafqg wrote:
| Something they will have to think about the day that there are
| IPv6-only services. Which is not today or anytime soon.
| eqvinox wrote:
| > Something they will have to think about the day that there
| are IPv6-only services. Which is not today or anytime soon.
|
| Let me guess, you live in and/or operate setups in the US?
|
| Yeah, the US has disproportionately many IPv4 addresses.
|
| Meanwhile if one of our services doesn't need IPv4, it
| doesn't get IPv4. And if it does need IPv4, it's increasingly
| common to be IPv6 behind an IPv4 reverse proxy.
|
| And as a result, due to the extra reverse proxy, you'll
| increasingly just get worse performance on IPv4 than native
| IPv6.
| fafqg wrote:
| What you call the "extra reverse proxy" is cgnat and cgnat
| doesn't add more latency than any other host in the path to
| the destination server.
| eqvinox wrote:
| It's called CGNAT when you do it near the end user /
| eyeballs and do it generically for all services on the
| internet.
|
| When you do it near the service being provided, and only
| for your own services, it's called a Reverse Proxy.
|
| You are right that these two things are similar, but they
| aren't identical; CGNAT attempting to handle you trying
| to talk to _who knows what_ on the Internet (e.g. game
| servers, VoIP) is a much harder problem to solve than a
| Reverse Proxy handling a known set of protocols you want
| to expose.
|
| And, yes, an unloaded CGNAT or Reverse Proxy is not
| noticable in terms of performance. However, both of them
| have load limits where you need to scale them up, and
| particularly CGNAT frequently degrades (due to larger
| tracking tables) before completely falling over.
| Arnt wrote:
| Well, I've seen several. Nothing for the general public. But
| things like the CMS/admin interface of a big web site. The
| site itself is on v4, the admin interface not.
| hippich wrote:
| There were (haven't checked for awhile) very cheap vps
| offerings that come only with ipv6 with no possibility to
| obtain ipv4 at all. While not useful for typical stuff, I've
| successfully used a swarm of these for personal project. I
| expect these things to become more common as companies like
| ovh start charging $10+ for a small fallback ipv4 address
| range.
| pantalaimon wrote:
| IoT networks come to mind. There is nothing like 6LoWPAN for
| IPv4
| yrro wrote:
| A brand new UK ISP, YouFibre, is providing FttP in many UK
| cities. It's incredible being able to get a symmetric 1 Gbit
| connection for PS30 pcm.
|
| It's also incredible that, despite putting all their users behind
| CGNAT, they don't provide IPv6.
|
| I mean technically they are no _worse_ than their major
| competition here (Virgin Media which has failed to move on IPv6
| for 20 years, why start now). But it's baffling that a _new_
| network would be built without IPv6 provision!
| ignoramous wrote:
| Perhaps, the IPv4 space is easier to police?
|
| _IPv6 Transition /Co-existence Security Considerations_,
| https://datatracker.ietf.org/doc/rfc4942/
|
| _Operational Security Considerations for IPv6 Networks_ ,
| https://datatracker.ietf.org/doc/rfc9099/
| radicaldreamer wrote:
| This behavior was rare in the US market, but it is very common
| now that our wireless providers are entering the home internet
| market. T-Mobile and Verizon both use CGNAT (but do issue
| individual ipv6 addresses to end user devices).
| throw0101b wrote:
| > _T-Mobile and Verizon both use CGNAT (but do issue
| individual ipv6 addresses to end user devices)._
|
| More specifically, T-Mobile US only assigns IPv6 addresses to
| devices, and to reach the IPv4 world you have to go through a
| translation mechanism.
|
| Presentations from T-Mobile at NANOG and Rocky Mountain IPv6
| Taskforce:
|
| * https://www.youtube.com/watch?v=d6oBCYHzrTA
|
| * https://www.youtube.com/watch?v=nNMNglk_CvE
| sjcoles wrote:
| It's been a nightmare for my org. We have several people with
| T-Mobile and Verizon home internet and it's always a game of
| "What shenanigans will I have to use this week to get VPNs to
| work?" Sometimes it seems like their 6to4 implementation is
| just broken but I'm not a network engineer.
| gormandizer wrote:
| > _T-Mobile and Verizon both use CGNAT_
|
| FWIW Verizon FWA does NOT use CGNAT for IPv4.
| fpanzer wrote:
| Same thing here in Germany, Fibre ISP in my hometown (80k
| population). Started 5 years ago, widely used already, but
| still no ipv6.
| sidewndr46 wrote:
| I have IPv6 available through one of my ISPs at my home, but it
| doesn't work properly. Packets are just dropped for random
| intervals here and there.
| chinaman425 wrote:
| [dead]
| nubb wrote:
| ipv6 has been "around the corner" since 2010 and it sucks we're
| trying to force a protocol everyone hates. i get all the reasons
| it's great but when everyone on earth hates a single thing all
| together maybe it's a sign???
| blacksmith_tb wrote:
| Hmm, in the US at least it's pretty much ubiquitous on cell
| networks? My home ISP also at least does 6rd, not as nice as
| native, but a start.
| pantalaimon wrote:
| https://www.google.com/intl/en/ipv6/statistics.html
| nikanj wrote:
| 1) When was the last time you fixed networking issues by turning
| on IPv6?
|
| 2) When was the last time you fixed networking issues by turning
| off IPv6?
|
| For me, the answer to 1) remains "never", the answer to 2) is
| currently "Late winter"
| icedchai wrote:
| I've been running IPv6 since roughly 2007, starting with SiXXS
| tunnels, then HE.net tunnels, then moving to native. In that
| time, all problems "due to IPv6" were fixable. Turning off IPv6
| was never the actual answer.
| eqvinox wrote:
| 3) When was the last time you fixed networking issues by
| turning on IPv4?
|
| About a year ago, when I noticed wikipedia still doesn't have
| IPv6 reachable DNS resolvers.
|
| 4) When was the last time you fixed networking issues by
| turning off IPv4?
|
| A few weeks ago, IPv4 was just slow for some reason I couldn't
| quite determine.
| lolc wrote:
| I frequently "turn on" IPv6 by disconnecting from my company
| VPN. Some things work better that way.
| jeroenhd wrote:
| 1. Yesterday, actually!
|
| 2. Never, because altering my network in a way that I'm no
| longer able to reach my own servers isn't really a "solution".
| patrakov wrote:
| > 1) When was the last time you fixed networking issues by
| turning on IPv6?
|
| In 2017. The problem was that file copying via scp was very
| slow between the servers (one in Germany, one in China). I set
| up a he.net tunnel in China, got an IPv6 address, and it went
| much faster via IPv6.
| toast0 wrote:
| > 1) When was the last time you fixed networking issues by
| turning on IPv6?
|
| I've used IPv6 to help users behind CGNAT; enabling IPv6 for
| client -> server often means those clients no longer go through
| carrier stateful firewalls and their sometimes tragically low
| idle timeouts (I've seen timeouts as low as 10 seconds).
|
| I've also used IPv6 to help in a proxy config when I couldn't
| get the upstream servers configured for more listening ports;
| it's super easy to get extra v6 source addresses for the proxy
| servers and harder to get v4 addresses. With high volumes and
| low session times, you run into port reuse issues at around
| 10k-20k sessions per {source ip, dest ip, dest port} tuple;
| theoretically you can get to 64k, but TIME_WAIT takes time to
| clear and you don't want to be too aggressive.
|
| Probably less going forward, but v6 and v4 often have different
| routed paths, and sometimes you want to get off of one path and
| onto another. If you're using a tunneled v6 connection, you
| almost certainly have a different path for most destinations.
|
| > 2) When was the last time you fixed networking issues by
| turning off IPv6?
|
| My previous DSL modem would crash when receiving fragmented
| IPv6 packets. My current one doesn't crash, but adds a lot of
| internal latency. Temporarily fixed by disabling IPv6;
| permanently fixed by using the modem in bridge mode and doing
| PPPoE on my own personal equipment (at great cost to my own
| sanity, PPPoE is gross, and I built a multi-node redundancy
| setup, so PPPoE sessions can be transferred between my
| redundant routers, bleh)
| doodlesdev wrote:
| 1) Last week
|
| 2) Never
| imoverclocked wrote:
| IPv6 is pretty great. You don't run out of numbers locally, you
| don't run out of numbers globally. Most software and OSs just
| support it these days... many embedded things still don't.
|
| I think the biggest pain point with IPv6 adoption is probably the
| large number of customers with a little netgear router that
| doesn't know how to pass IPv6 through it. I also think local
| administrators that still purchase stuff that doesn't support
| IPv6 are just shooting themselves in the foot. After all, the
| writing has been on the wall for over two decades.
| fafqg wrote:
| >IPv6 is pretty great. You don't run out of numbers locally,
| you don't run out of numbers globally.
|
| If that's everything IPv6 has going for it it's no wonder its
| adoption is still so low.
| anecdotal1 wrote:
| Based on the way IPv6 is currently allocated we only leverage
| about 56 bits of usable address space but IPv4 with NAT gives
| us a max of 96 bits of address space
|
| Edit: don't know why I'm being downvoted, I guess the network
| gurus here don't research
|
| https://www.potaroo.net/ispcol/2017-09/natdefence.html
| ElectricalUnion wrote:
| > IPv4 with NAT gives us a max of 96 bits of address space
|
| But then you need NAT piercing everywhere for even "basic
| use". How is not being able to connect to things "usable"?
|
| By that same metric, you also get a bare minimum, naive
| count of of 144 bits of IPv6 address with 2 layers of link-
| local address + all ports.
|
| 144 is much larger that 96.
|
| Even the naive 64 bits "just use one layer of link-local"
| is still larger that the entire current 32-bits of IPv4.
| yjftsjthsd-h wrote:
| I think the point is that 96 is quite enough to not run
| out. Which is plausibly fair, if you can actually get
| that many bits (or close enough to actually cover
| everyone) and can deal with the ugliness of NAT. It's
| especially fair, I think, to argue that the reason that
| IPv6 adoption has been so slow is because IPv4+NAT is
| good enough for most people. Just because IPv6 is
| _better_ doesn 't mean that people will want it if the
| old option can be hacked up to keep working.
| labcomputer wrote:
| So is 56. That's about 9 million addresses for every
| human on earth.
|
| And, of course OP is wrong about 56 anyway, but so it
| goes
| yjftsjthsd-h wrote:
| Oh, sure; arguing that IPv6 doesn't, in any way shape or
| form, have enough addresses would be extremely misguided.
| I was reading it as "IPv4 already has enough address
| space (if we include NAT) so we don't need to deal with
| v6".
| eqvinox wrote:
| FYI: After skimming the article, I'm downvoting because you
| conflated what the article calls "This 96-bit NAT address
| space is a highly theoretic ceiling, [...]" became a plain
| unqualified "96 bits of address space" in your comment.
| Which you're then comparing with the "56 bits of usable
| address space" in IPv6.
|
| Also, that sentence continues in the article with: "[...]
| but the pragmatic question is how much of this space can be
| exploited in a cost-effective manner such that the marginal
| cost of exploitation is lower than the cost of an IPv6
| deployment."
| anecdotal1 wrote:
| Pretty much anything is lower than the cost of IPv6
| deployment if you already have a large IPv4 deployment.
| lmm wrote:
| CGNAT routers aren't cheap. At some point you're spending
| more keeping your IPv4 running than it would take to
| replace it.
| JohnFen wrote:
| > If that's everything IPv6 has going for it it's no wonder
| its adoption is still so low
|
| IPv6 has numerous things going for it. But it also has
| numerous downsides. I suspect that's why the adoption is so
| slow.
| kps wrote:
| > many embedded things still don't.
|
| For home IoT, Matter uses IPv6, and may start picking up this
| year. (I worked on some IPv6-related things for it for my then-
| employer.)
| JohnFen wrote:
| > After all, the writing has been on the wall for over two
| decades.
|
| That IPv6 has been around so long and is still not ubiquitous
| means that writing is faded and partially obscured by graffiti.
| imoverclocked wrote:
| Anything as large and hodgepodge as the Internet isn't going
| to change in a day. I'd say that the writing has been kept
| fresh [1] and the underlying need hasn't gone away.
|
| [1] https://www.google.com/intl/en/ipv6/statistics.html
| RealStickman_ wrote:
| A real pain point with IPv6 is being unable to make subnets
| smaller than /64. So much wasted space and hassle to get more
| than one network going.
| jeroenhd wrote:
| There's no technical reason why you can't if you use active
| DHCPv6 and other such tricks. They make life harder than
| standard IPv6, but there's no reason why you can't turn one
| of your /64s into /120s. With a /56 being the standardised
| assignment for ISP customers (=256 subnets), I think there's
| more than enough space for a home network. /48s used to be
| the recommended space assignment but I think these days you
| can only get those as a business customer or through an
| independent party (i.e. Tunnelbroker).
| icedchai wrote:
| IPv6 subnets are supposed to be super cheap. As an
| individual, through a RIPE LIR, I was able to get a /44 (2^20
| /64 subnets), no questions asked. I have these tunneled into
| my home lab and a couple other locations. I realize my setup
| is unusual: I have my own ASN and am running BGP.
| zamadatix wrote:
| Are you looking to deploy 100 subnets at your house or
| something? I just don't follow the relation to the /64 size
| and any hassle.
| labcomputer wrote:
| This sounds like and A/B problem. You're asking how to do A
| but what you really want is B. But you're asking about A
| because that's how you think you'd get B in the ipv4 world.
|
| Your ISP should give your router a /56 prefix via PD, which
| you can divvy up into 256 networks internally. Alternatively,
| if you don't need globally-routable addresses, just pick a
| ULA prefix and have your router advertise it internally.
| drpixie wrote:
| I was somewhat amazed that a significant university _doesn 't_
| handle IPv6 - sigh.
| throw0101b wrote:
| UToronto does:
|
| * https://bgp.he.net/AS239#_prefixes6
|
| It's just that particular department may not have bothered.
| UpToTheSky wrote:
| This is one of the reasons I do not support IPv6 anywhere. It
| would take a _lot_ more work to support two types of network
| requests.
|
| I hope I can ignore it up to the point where I can make a
| complete switch, use _only_ IPv6 and stop supporting IPv4
| everywhere.
|
| I wouldn't be surprised if that point never comes and I can be a
| happy "IPv4 only infrastructure" person forever.
|
| Or IPv7 comes out before running an IPv4-only infrastructure
| becomes a problem.
|
| I think the mistake of IPv6 was to not be a superset of IPv4.
| elevation wrote:
| It does take more work to run dual stack. I wanted to avoid
| duplicating efforts when I set out to learn ipv6, so I disabled
| ipv4 routing on my network and just ran ipv6 with DNS64/NAT64
| to provide my clients access to legacy services. In this
| configuration, most of my traffic was end-to-end ipv6. I tested
| iOS, Android, Windows, and Ubuntu clients with no issues, even
| my aging printers support it!
|
| The only issue I have is the same issue found in the article,
| but in reverse: now that I have a securely configured ipv6
| network, how can I ensure that my hosts are fully prevented
| from communicating over a rogue ipv4 net?
| jeroenhd wrote:
| Does it? If you pretend IPv6 doesn't exist, sure, but that's
| like pretending UDP doesn't exist because all of your
| applications use TCP, or only logging traffic going to port 80
| because you don't have HTTPS yet.
|
| Every firewall I've come across has a default deny rule for
| incoming IPv6 traffic, giving the firewall the same properties
| as any IPv4 network. Host firewalls are the same; anything
| ranging from Windows Firewall to UFW and firewalld have presets
| to block all traffic except for the applications you've
| whitelisted. Once you get to huge enterprise routers managing
| routable IPv4 addresses and IPv6 addresses the situation may
| become different, but it's still not that much overhead.
|
| The biggest problem with securing IPv6 seems to be ignoring it
| assuming that makes it disappear. If you configure your
| firewall to drop all IPv4 traffic not on a whitelist but
| somehow manage to forget to add the same rule for IPv6, you
| should re-evaluate your networking knowledge and maybe get up
| to speed with how the internet has changed since 2015.
| UpToTheSky wrote:
| Its not just firewalls.
|
| Its also all kinds of code that interacts with the internet
| in all kinds of ways. Extending all that code to two kinds of
| IPs, writing tests, setting up two types of IPs in
| development, staging and production, monitoring real life
| implications ... that would be a huge cost with no benefit at
| all.
| jeroenhd wrote:
| If you're writing code, you'll be either manually
| specifying the IP address family (so there's no real IPv6
| risk) or you're probably using middleware that does all the
| hard parts for you anyway. If anything, I'm annoyed how
| hard it is to get a socket listening on both IPv4 and IPv6
| in many low level libraries. I just want a socket to
| receive data on, who cares what address family it's from.
|
| In my experience, IPv6 Just Works (tm) with modern
| software. There are some mid 00's frameworks for
| blacklisting abusive hosts that can't parse IPv6 addresses,
| or don't understand the /64 subnet you need to treat as a
| single IP address, but that's all I've ever run into. If
| anything, that gave me an excuse to finally get rid of an
| old Perl network filter running on my server.
|
| I'm not sure how many tests the average piece of software
| needs that deals with the type of address family
| connecting. I suppose it matters if you want to test your
| rate limiting middleware or your logging library? That
| should only matter for the vendored code of course because
| modern libraries all have those tests themselves already.
| It's not like you need to run and write every test twice,
| only one or two very specific subcomponents if any.
|
| If you're writing firewalls or kernels or router firmware
| then yeah you'll have your hands full with this stuff, but
| that's far from the standard developer experience. In those
| cases, IPv6 is a reality as much as TCP and UDP are.
| znpy wrote:
| > if you're writing code, you'll be either manually
| specifying the IP address family (so there's no real IPv6
| risk)
|
| AF_ANY is a thing, and it's a best practice.
|
| gethostaddr (iirc) was the old interface, but nowadays
| getaddrinfo is almost the default and supports AF_ANY.
| znpy wrote:
| To add a trivial example: if an application is coded well,
| it's ready to connect to hosts both on ipv4 and ipv6, in
| the sense that when resolving a dns name, it will ask for
| addresses of any kind (unless it supports being explicitly
| told to only use ipv4).
|
| So now you're getting a record with multiple ip addresses,
| some of which are ipv6, but ipv6 is blocked... there you go
| with random connection delays and possibly timeouts.
|
| Ipv6 exists and it's getting more and more adoption, no
| matter if some people keep their head under the sand...
| kps wrote:
| > multiple ip addresses, some of which are ipv6, but ipv6
| is blocked... there you go with random connection delays
| and possibly timeouts.
|
| RFC6555 "Happy Eyeballs" discusses this.
| xemdetia wrote:
| A/AAAA records are a special sort of hell to debug
| remotely. "My browser can find it but I can't ping it!
| What do you mean ping6?"
|
| In some environments that is maddening and I don't blame
| people for just deciding not to either at all or only
| translating at WAN.
| ElectricalUnion wrote:
| > that would be a huge cost with no benefit at all.
|
| Internet facing IPv6 infrastructure is usually much cheaper
| that their equivalent IPv4 enabled peers.
|
| So supporting IPv4 can be the huge cost with no benefit at
| all, if all your clients/peers can use IPv6
| yjftsjthsd-h wrote:
| > if all your clients/peers can use IPv6
|
| Including the case where you have something else in the
| middle already - for example, if you're fronting a
| website through cloudflare, then you can only have IPv6
| on your server and still support dual-stack for clients:)
| nubinetwork wrote:
| Why firewall it when you can straight up turn it off?
|
| net.ipv6.conf.all.disable_ipv6 = 1
| net.ipv6.conf.default.disable_ipv6 = 1
| tux2bsd wrote:
| [dead]
| idatum wrote:
| My fiber provider inherited network equipment that is preventing
| them from deploying IPv6. On their subreddit they responded from
| multiple inquiries that they are ready to provide a /60 once they
| upgrade their equipment.
|
| I imagine this may be a problem for other providers.
|
| Thankfully no CGNAT, so I have a couple VLANS that use he.net in
| the meantime.
| schoen wrote:
| I'm working on a project to increase the supply of IPv4
| addresses, and people often complain that attempting to do so
| undermines confidence in (or, allegedly, the pressure to adopt)
| IPv6, thereby harming the IPv6 transition.
|
| I don't think we could possibly be anywhere near the top of the
| things harming the transition when we regularly encounter people
| _actively encouraging others not to use IPv6_ for either security
| or convenience reasons!
| bell-cot wrote:
| > people often complain that attempting to do so undermines
| confidence in...
|
| A miserably common human behavior pattern.
|
| Anyone have a copy of the DSM-5 handy, to tell us the technical
| name for it?
| AndyMcConachie wrote:
| IPv6 is such a mess. If I could go back in time to 1995 I would
| kick some people at IETF meetings. All they had to do was
| increase the number of octets from 32 to 64. Instead they
| redesigned almost everything about how IP works and IMHO made
| things much more complicated than they needed to be.
| icedchai wrote:
| So any increase in address size meant updates on all hosts and
| routers. If you're going to do a huge, global infrastructure
| update, it better be worth it. The changes made with IPv6
| actually _simplified_ deployment compared to IPv4.
| eqvinox wrote:
| So... you have learned from this and are now actively
| monitoring and participating at the IETF, so your expertise can
| be taken into account to prevent similar messes in the future?
|
| (An octet is a byte btw, so it'd be an increase from 4 to 8.)
| viraptor wrote:
| We'd likely be in the same situation right now, just with fewer
| extra features which are actually good. The C API would have to
| change in almost the same way. The network hardware would have
| to have separate paths anyway. Rules would still have to cover
| both cases separately.
|
| Sure, we'd save a little bit of time from the extra features,
| but I don't see how anyone's deployment approach would be
| different.
| AnIdiotOnTheNet wrote:
| Hindsight is 20/20. It is easy to see now all the reasons IPv6
| is not widely adopted, but back then they probably figured that
| adding more features would make it more attractive or
| something.
|
| If I had a time machine and had to take a relatively naive
| crack at the problem, I'd make IPv6 really really simple: it'd
| just be IP-in-IP.
|
| On the internet you're routed with an outer address, and the
| local router forwards it using the inner address. Speaking v6
| over v4 is free because v4 routers ignore the inner packet.
| Speaking v4 over v6 just doesn't include the inner packet.
| Other local hosts are just contacted through v4.
| teddyh wrote:
| > _IPv6 is such a mess._
|
| Maybe.
|
| > _If I could go back in time to 1995 I would kick some people
| at IETF meetings._
|
| Sure.
|
| But how is any of that relevant enough to bring up _today_?
| Now, IPv6 is what we have, and the standards are what they are,
| flaws and all.
|
| The only reason I can think of is psychological: People don't
| want to learn new things, so they find reasons to dislike the
| new thing to be able to pretend they don't need to learn it.
|
| 1. https://news.ycombinator.com/item?id=29594017
|
| 2. https://news.ycombinator.com/item?id=11137430
| jesprenj wrote:
| I have an example from my ISP. While it theoretically started
| with IPv6 all the way back in around 2012, their IPv6
| infrastructure still remains quite crippled -- they won't even
| assign you static prefixes, all you get is a DHCPv6 /56 (meaning
| you can't set a PTR).
|
| And the example revolves exactly around filtering and firewalls
| -- on IPv4 they drop outgoing packets whose source address isn't
| a part of their subnet -- they prevent source spoofing of other
| addresses.
|
| But on IPv6 they do not do that. I noticed this when their router
| somehow lost the prefix route to me -- I was informed that their
| DHCP server adds router dynamically to routers -- and I could
| still send packets. But I couldn't just send packets from my
| prefix, but also from any other address, including stuff like
| 2000::.
| jeroenhd wrote:
| That's pretty silly. I wouldn't have much faith in my ISP if
| they'd mess up that badly.
|
| Perhaps the good network engineer that got IPv4 working right
| left before they could implement IPv6? Or maybe they don't
| provide enough of a training budget for their engineers to stay
| up to date on networking technology?
|
| Either way, if their core business is doing networking, I'd
| expect them to be better at this!
| eqvinox wrote:
| > their router somehow lost the prefix route to me -- I was
| informed that their DHCP server adds router dynamically to
| routers
|
| for the curious, that's (in most cases) DHCPv6-PD relay agent
| operation, https://www.rfc-editor.org/rfc/rfc8987.html#name-
| general "Delegating relay": Delegating relay:
| A delegating relay acts as an intermediate device, forwarding
| DHCPv6 messages containing IA_PD and IAPREFIX options between
| the client and server. The delegating relay does not
| implement a DHCPv6 server function. The delegating
| relay is also responsible for routing traffic for the
| delegated prefixes.
|
| It's generally done by having the relay be a passive observer
| of the DHCPv6-PD packets it is relaying between client and
| server, installing and updating routes for prefixes as needed.
|
| That RFC also goes into detail on problems with these setups.
| What you experienced was probably the loss of state described
| in section 3.2.
| jesprenj wrote:
| Thank you!
| dopylitty wrote:
| The IPv6 Buzz podcast had a recent episode[0] making the claim
| that IPv6 is happening on your network whether you intentionally
| enable/control it or not these days and I had a similar reaction
| to the one in the post. Definitely something to think about
| though if you're in a position to worry about such things.
|
| 0: https://packetpushers.net/podcast/ipv6-buzz-123-why-you-
| need...
___________________________________________________________________
(page generated 2023-04-26 23:01 UTC)