Re: Distributing site-wide RFC 3484 policy

[itojun@itojun.org (Jun-ichiro itojun Hagino)]

> > 	do you plan to have source addresses with different reachabilty with
> > 	VPN and stuff, even with IPv6 where no private address would be
> > 	deployed hopefully?
> 
> I wouldn't design things that way, but I believe that corporate notions
> of security and business partnerships will cause this to happen.
> In fact I agree with Phill Hallam-Baker that the *best* way to solve
> this is by applications-level strong security such as Web Services Security,
> but I am not optimistic that this will be adopted by everybody.

	if you agree with Phill, you should make efforts to that direction!

> > 	of course you can run IPsec tunnels or other VPN technologies by using
> > 	global IPv6 addresses.
> 
> Yes, but you may still have complexity because only some hosts in company A
> can reach only some hosts in B via the VPN. DNS gets complex and messy too.

	yeah, there are various ways to solve DNS issues, i don't think there
	is a perfect solution.  but DNS issue does not have to do things with
	IP-layer reachability.

itojun