"Fanboy" series - IPv6 and NATs

Like any joke - it may have some grain of truth in it. Or it may not.

The time will show.

Category:

Film & Animation

Tags:

• xtranormal

[foobarbuzz]

@foobarbuzz you seem to extrapolate your own situation on the whole world. Let's just finish it at this: there are various reasons, for some they may be valid, for some they may be not relevant. I'm seriously not willing to preach the IPv6 religion - but rather the pragmatic approach.

And I assert that in some scenarios IPv6 makes sense. In other scenarios, it does not make the sense right now.

Let's accept there is more than one answer. The world's more complex than we'd like it to be.

[foobarbuzz]

@securezone

Address changes are much less frequent (normally) than TCP/UDP port changes.

Anyway, the circumstances are always different - and I don't think it's worth our time to try to argue either end as The Only Right one. So I think we can agree to disagree on some things.

[foobarbuzz]

@securezone

- addressing: if you get to design the network. Think M&A.

- NAT scalable: think logging. Talk to your friendly SP with a few million subscribers.

As for NAT-compatible apps: sure. The root of the problem is the locator/id overloading for address. But this is even more holy matter than the NAT thing, I feel :)

[foobarbuzz]

@securezone: I do not attempt to take sides in this scenario. As I write in the description - the time will show.

As for your comment overall: I agree with every odd statement in it.

[dt9394]

Nat is not security, i use forward chain for filtering. :)

[foobarbuzz]

@dt9394 absolutely :-)

[apoc4223]

natsgood? weird video should publish the transscript

[fredbovy]

I will buy IPv6 if it has NAT, NAT is GOOD ! :-))))

[securezone]

@foobarbuzz I still have the same IPv4 for 18 days and it is likely to not change anytime soon.

Logging is not the challenge. In fact, even IPv6 will have very similar logging load because IPv6 will is still dynamically leased (due to easier management with dynamic leasing).

Logging was/is never a "sane" reason to switch to IPv6. This is bullshit.

You can ignore history (bullshit in the past decade), but the future will show you that something is badly fucked up.

[securezone]

@foobarbuzz that's not really heavy if you have sane translation timeouts. It doesn't happen frequently.

Plus, if a SP has millions of subscribers, then the actual "load" is not the NAT logs, but rather the bandwidth.

Trust me, you will hit other bottlenicks before you hit the loggin thing.

Plus, IPv6 also does the logging whenever a customer is assigned an IP address via (say) PPP/DHCP. They also do logging whenever a customer is Up/Down.

[securezone]

@skeetabomb

* A branch doesn't need a complete 10/8. Dumb. Hint: address heirarchy. E.g. you can have 256 branches, with each branch using 10.x/16 range internally. That's fucking enough.

* If you need more than 10.x/16 for a branch, then you can assign that branch multiple 10.x/16 ranges. However, if you have 256 branches already (extremely unrealistic), then you can use a 2nd-level NAT. It works. No need to upgrade the whole network.

* NAT is scalable. no worries on memory.

[skeetabomb]

@securezone It was immature and proud of me to call you 'immature'. I apologise for that. I count myself quite immature in some areas I consider more important . That said, there is still a problem. I admire your faith in the large corporates doing the 'right' thing and giving back un-used addressing. I don't think it wise to expect that, however. I agree, they ought to. I am geniunely interested to know if you have a solution, though.

[skeetabomb]

@securezone Ignoring ur language 4 a mo, say you're a Service Provider. U have 30 v.large (global) cust's, all use 10.x.x.x IP space. All have an approach to address allocation breaking the globe into 4 (e.g.) regions. They all say "we'll never use 16.7M IPs" so they allocate ClassB ranges to each site, allowing for growth (sound fair?). Now I've a prob: they all use IPs across all 10/8, I must 'sticky' NAT all hosts, all NAT GWs have session, memory or NAT object ID limits. Ur solution is?