> > Enterprises of non-trivial size will likely use RFC4193 (and I > > fear we will notice PRNG returning 0 very often) and then NAT it to > > provider provided public IP addresses.
Eventually ARIN (or someone else will do it for them) may create a site you can register your address and know that it really is unique among participating registrants. Random is fine, unique is better. Such a site would be the seed for when (if) we come up with the tech for everyone to have PI and lose all the restrictions imposed so far. > > I'm just hoping that we'll at least > > see 1:1 NAT instead of NAPT being used. I think that will be a common PI alternative. If people really don't want NAT then we shouldn't provide reasons for it to exist. RFC4193 seems to be the best enterprise plan. They can link to other enterprises and change ISPs easily or multihome. They are not beholden to any ISP or numbering authority. The global table doesn't explode. > Why on earth would you do that? Why not just put the provider-assigned > addresses on the interfaces along side the ULA addresses? Using ULA > in that manner is horribly kludgy and utterly unnecessary. Enterprises tend to want only one identifier to manage per device and that it be unique and mostly permanent. With several PA and ULA on each device, links to ISPs and other enterprises, the combinations of addresses and paths to manage flows and security over become too hard (if it's not simple it's probably not secure). Every device becomes a router and firewall and the staff who manage those aren't cheap. > > This is to facilitate easy and cheap way to change provider. Getting PI > > address is even harder now, as at least RIPE will verify that you are > > multihomed, while many enterprises don't intent to be, they just need low > > cost ability to change operator. > > > Why is that easier/cheaper than changing your RAs to the new provider and > letting the old provider addresses time out? And changing all the ACLs based on the old providers addresses And allowing for all the 5 - 15 year old kit that predates this and won't be upgraded (we have that problem with NT embedded in systems with 10year+ refresh cycle) brandon