Re: Distributing site-wide RFC 3484 policy

[Brian E Carpenter <brian.e.carpenter@gmail.com>]

Pref
> Hm, could it be that the problem you foresee is where www.example.com 
> has both global::/128 and ula::/128 where people from outside are 
> supposed to connect to the global address and people from the inside to 
> the ula address?
>
> Although I can see one or two cases where people may want this, I would 
> agree that such a setup is a bad idea.

Normally the security people would dislike this - the globally available
boxes will be in the DMZ, not in the intranet. If you decide to trust
end-system security and run without a DMZ, I suppose this could happen,
and we certainly need to assume it will happen.

> However, if you have 
> www.example.com with global::/128 and secret-internal-only.example.com 
> with ula::/128 that would make sense and not cause problems.

Indeed, I think this will be common practice for servers. But for
clients (employee desktops) both ula and global addresses are needed,
or you will rapidly need a ULA-to-Global NAT. (P2P would be the same.)

(ASCII art, view in Courier)


             ULA to ULA  -----------
 --------  <..........> | internal  |
|employee|              | server    |
|desktop |               -----------                ----------
 --------  <..........................{ DMZ }....> | external |
              Global to Global                     | server   |
                                                    ----------

    Brian