[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [69ATTENDEES] DHCP
Apologies to the list, this will be my last post on this subject.
Iljitsch van Beijnum wrote:
On 14-sep-2007, at 21:06, Kevin Loch wrote:
RA's are great in certain situations, and I use it on some subnets but
we must have a full set of tools that work with RA turned off.
Why?
There are situations where hosts on the same segment need to use
different gateways. There are many cases where self assigned
IPs (which might be used to source packets) are not desired. Firewall
rules, accounting, VPN SA's and load balancers are just the tip of the
iceberg. Convoluted topology due to mergers or migrations, customer
legacy designs or other odd requirements adds to the mess. We have
tools in IPv4 to deal with this and the shotgun approach of RA would
not help here.
Even in cases where RA could be used, it is often desirable to use
manually selected non EUI-64 addresses which tend to be simpler. This
also applies to ranges used by DHCP. People still have to type and work
with IP addresses in IPv6.
There are situations where I cannot have hosts (servers
in particular) autoconfigure addresses or gateways, even
accidentally.
>
Then they shouldn't listen to discovery protocols such as RA but also
DHCP (and VRRP in the sense that you were suggesting although VRRP isn't
designed to be that).
VRRP for failover of a statically configured gateway IP address is very
useful. I could use it today on my network if vendors supported it.
I can also see scenarios where VRRP + DHCP - RA could be useful in
mixed DHCP/static segments. DHCP allows fine control over which
hosts are allowed to use it as well as which features are used. You
don't always have administrative control over all hosts on a segment to
control behavior regarding RA's.
I'm not bashing RA completely. It's a small efficient design and is
very convenient in certain situations. It just isn't appropriate for
every situation and many times will need to be turned off. In those
cases we need other methods (like DHCP, VRRP).
- Kevin