Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread Fred Templin
Whoops! I sent this before seeing the similar note from Christian. Not meaning to belabor the point or otherwise come down too hard on you, Eric. You are certainly not the only one involved in these discussions who could benefit from a read of the documents. Fred [EMAIL PROTECTED] Fred Templin wrot

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread Fred Templin
Eric, EricLKlein wrote: To be honest, as stated in another e-mail, I have not read the draft-ietf-ipv6-unique-local-addr-01.txt, I am catching up on drafts and will read it soon. I'm a bit perplexed that you seem to have time to engage in the e-mail discussions but have not yet found the time to

RE: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread Christian Huitema
> ...prefer to say it the other way ... if your evidence is actual, > it shows the other groups are disconnected with this one. > > I agree, but either way there is a disconnect. Eric, One simple way to cure the disconnect would be to actually read the drafts that you are quoting, starting with

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread EricLKlein
Mark Smith wrote > > If there are this many new drafts coming out in November 2003, even with a > > WG decision to not do NAT IPv6 then there should be a big red flag that > > there is a disconnect between what this WG says and what others are doing. > > > > I would prefer to say it the other way .

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread Brian E Carpenter
EricLKlein wrote: > > Christian Huitema wrote: > > > Andrew, the draft has provision for both "registered unique local > > addresses" and "probably unique local addresses". The registered unique > > addresses are not valid on the Internet, but they definitely will not > > collide with other addre

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread Mark Smith
On Mon, 24 Nov 2003 14:54:41 +0200 "EricLKlein" <[EMAIL PROTECTED]> wrote: > > Can you explain why are we allocating another range for locally assigned > prefixes, rather than reusing the FEC8:; FEC9:: spaces that were used this > way and are now going to stay unallocated? Why tie up a second r

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread Mark Smith
On Mon, 24 Nov 2003 15:00:46 +0200 "EricLKlein" <[EMAIL PROTECTED]> wrote: > Tim Chown wrote: > > > On Mon, Nov 24, 2003 at 10:03:44AM +0200, EricLKlein wrote: > > > > > This may be true, but no one is proposing green cow become an IETF standard. > The list I provided is recently proposed IETF d

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread EricLKlein
Tim Chown wrote: > On Mon, Nov 24, 2003 at 10:03:44AM +0200, EricLKlein wrote: > > > > The list of IPv6 plus NAT is over 140 documents long, with many of them > > being proposed in the last 5 days. The look up list I ran is: > > http://search.ietf.org/cgi-bin/htsearch?config=htdig&restrict=http%3A

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread EricLKlein
Brian Haberman wrote: > I'm curious, have you read draft-ietf-ipv6-unique-local-addr-01.txt? > The locally assigned prefixes come out of the FD00::/8 range and > the centrally assigned prefixes come out of the FC00::/8 range. Can > you explain to me why you think they will collide at some point? >

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread Brian E Carpenter
EricLKlein wrote: > > Andrew White wrote > > The problem with these people's arguments is that it's not the address > range > > that gives the security, it's the fact that you have an isolated network > > connected to the global network via only a proxy (NAT) and firewall. > > > > You can use any

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread EricLKlein
Mark Smith wrote > > I am still have 2 concerns with these concepts: > > 1. People do not want to register their secure internal network nodes (bank > > central computes etc) so the "registered unique local addreses" may not meet > > their needs. They do not want to have even theoritically reachabl

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread Brian Haberman
Eric, EricLKlein wrote: 2. For the "approxiamtely" or "probably" unique local addresses I am concerned that these addresses will eventually be assigned as part of the registered addresses and can then be in conflict with "legitimate" nodes. I'm curious, have you read draft-ietf-ipv6-unique-local-

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread Ignatios Souvatzis
On Mon, Nov 24, 2003 at 06:02:48PM +1030, Mark Smith wrote: > Probably not going to happen in the next 200 years or more, and more > likely it will never happen. By the time that becomes a possibility, > IPv7 already proposed at least twice: TP/IX (RFC 1475) or CATNIP (RFC 1707)? Regards,

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread Mark Smith
On Mon, 24 Nov 2003 10:58:43 +0200 "EricLKlein" <[EMAIL PROTECTED]> wrote: > Tim Chown wrote > > > > It is not unlikely that people will be lazy and just use fd00::/48 for > sites, > > and thus add back in great ambiguity to the probabilisticly unique address > > space. > > First you ask a quest

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread Mark Smith
On Mon, 24 Nov 2003 10:33:41 +0200 "EricLKlein" <[EMAIL PROTECTED]> wrote: > > Mark Smith wrote > > > I am still have 2 concerns with these concepts: > > > 1. People do not want to register their secure internal network nodes > (bank > > > central computes etc) so the "registered unique local addr

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread EricLKlein
Tim Chown wrote > > So they can use addresses from the probabilistically unique range under > the space fd00::/8. There is, in terms of raw usage, no difference between > using fd00::/8 or fec0::/10. External networks would still have to route > the prefixes back to you for you to be reachable,

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread Tim Chown
On Mon, Nov 24, 2003 at 08:37:39AM +0200, EricLKlein wrote: > > I am still have 2 concerns with these concepts: > 1. People do not want to register their secure internal network nodes (bank > central computes etc) so the "registered unique local addreses" may not meet > their needs. They do not wa

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread EricLKlein
> Mark Smith wrote > > I am still have 2 concerns with these concepts: > > 1. People do not want to register their secure internal network nodes (bank > > central computes etc) so the "registered unique local addreses" may not meet > > their needs. They do not want to have even theoritically reacha

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread Leif Johansson
> > Probably not going to happen in the next 200 years or more, and more likely it will never happen. By the time that becomes a possibility, IPv7 or IPv8 will be ready, with, based on the IPv4 32 bit -> Ipv6 128 bit trend, 512 bit addresses ... of course, every bit added doubles the size of th

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-24 Thread Mark Smith
On Mon, 24 Nov 2003 08:37:39 +0200 "EricLKlein" <[EMAIL PROTECTED]> wrote: > Christian Huitema wrote: > > > Andrew, the draft has provision for both "registered unique local > > addresses" and "probably unique local addresses". The registered unique > > addresses are not valid on the Internet, bu

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-23 Thread EricLKlein
Christian Huitema wrote: > Andrew, the draft has provision for both "registered unique local > addresses" and "probably unique local addresses". The registered unique > addresses are not valid on the Internet, but they definitely will not > collide with other addresses. I am still have 2 concerns

RE: Local addresses and security? (was: SL deprecation draft)

2003-11-23 Thread Christian Huitema
> > You can get verifiably unique addresses if you go through the > > registration procedure. So, if you follow the good housekeeping rules, > > you should never encounter the bug you mention. > > Though I'd also ask: "Claim portions of WHAT network?" I'm talking about > *local* addresses, which

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-23 Thread Andrew White
Christian Huitema wrote: > > > This would work, and would be acceptiable to most people if there was > > a simple rule that worked, and would continue to work as the network > > grows. > > My concern is that an 'approximately unique' local address could at > > some point become less than unique an

RE: Local addresses and security? (was: SL deprecation draft)

2003-11-23 Thread Christian Huitema
> This would work, and would be acceptiable to most people if there was a > simple rule that worked, and would continue to work as the network grows. > My > concern is that an 'approximately unique' local address could at some > point > become less than unique and could cause routing problems when

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-23 Thread EricLKlein
Andrew White wrote > The problem with these people's arguments is that it's not the address range > that gives the security, it's the fact that you have an isolated network > connected to the global network via only a proxy (NAT) and firewall. > > You can use any address range you like inside the N

Re: Local addresses and security? (was: SL deprecation draft)

2003-11-20 Thread Andrew White
EricLKlein wrote: > This is not the first time that I have heard that someone was willing to > skip IPv6 because of the percieved pain and security threat that > standards compliance would entail. But then again these are all people > that take security and network administration very personal and