Re: ULA (was Re: ARIN Board Advises Internet Community on Migration to IPv6)

[Fred Baker <fred@cisco.com>]

On May 23, 2007, at 1:17 AM, Brian E Carpenter wrote:
> With the difference that ULAs should be filtered by default in  
> shipping products, IMHO.

there is a fundamental problem with that. Shipping products don't  
generally *change* their customer's configurations. Since BGP  
filtering is something that is set up a little differently every time  
a BGP peering relationship is established, I would be very hesitant  
to presume to add something that changed an existing filter designed  
by that administration.

As far as Cisco products go, Cisco route maps, like its ACLs, refuse  
what they don't explicitly allow. "permit" means to include something  
in what one will send or believe on receipt, and deny is the  
opposite. So a typical configuration says something like

     route-map <map name> permit
	match <this set of prefixes>
	match <that set of prefixes>
	...
[default] deny <everything else>

That would preclude the ULA because it is not listed in the contract  
between two companies and is therefore not listed as something that  
would be permitted - not because it is a ULA, but because it is not  
in the [addendum to the] contract. This breaks down between two  
larger networks, where such a list becomes impractical. In such  
cases, it becomes a multistep procedure - multiple route maps with  
the same name are supplied successively to a prefix until one of them  
matches it, at which point we know whether to use it or not, or we  
run out, in which case we don't.

     route-map <map name> permit 1
	match <this specific thing>
	match <that specific thing>
	...
     route-map <map name> deny 2
	match <this more general thing>
	match <that more general thing>
	...
     route-map <map name> permit 3
        match <everything else>
[default] deny <everything else>

One never actually gets to the default case because it is explicitly  
overridden. Clearly, in such a case one wants to permit zero or more  
mutually agreed ULAs, and then deny ULAs as a class. One of the  
things the "deny" route map wants to do is deny ULAs as a class,  
along with various bogon prefixes, prefixes longer than a certain  
length, and so on.

In SoBGP there is a cute side-effect that could be brought into play.  
If SoBGP is used to preclude advertisements that aren't authorized by  
the relevant registry, and ULAs aren't listed as authorized, ULAs  
will be precluded. So will global prefixes assigned by the RIR but  
tagged as "unroutable" if the registry chooses to list such in a  
separate list that SoBGP doesn't look at.

At any rate, I don't think the products should be doing classful  
things on prefixes. IPv6 operates under CIDR rules, not classful  
rules. The fact that it is a ULA is guidance to the guy setting up  
the filters, not something the product should slip in sideways when  
he's not looking and screw up the filter he wrote.