[ipv6-wg] IPv6 addressing for broadband-connected remote sites

Hi,

On Thu, Jun 13, 2013 at 11:28:15AM +0100, stuart.dale at ba.com wrote:
> Is anyone aware of any thinking that has been done on how IPv6 addressing
> would work for enterprises with remote sites that are broadband connected?
> In the IPv4 we would deploy a router terminating a VPN tunnel back to our
> datacentres, with selected traffic being broken out locally to the
> internet, reliant on NAT'ing the client source addresses.
> In an IPv6 world how would this work? 

Well, you could do that...

> Since there's no capability of
> NAT'ing an IPv6 address to another IPv6 address, would it be better to
> address the clients within sites using PA addressing from the local ISP?

I'm not mentioning RFC6296 now... :-)

6296 IPv6-to-IPv6 Network Prefix Translation. M. Wasserman, F. Baker.
     June 2011. (Format: TXT=73700 bytes) (Status: EXPERIMENTAL)

... so there's both network prefix translation, and also products that do
"classic" N:1 NAT with IPv6.  Whether this is the right thing to do is 
a religious debate.


Another approach that is more IPv6-ish is to use ULA space (RFC4913)
internally, and in the branch offices, give all machines *two* IPv6 
addresses - one global from their local provider, one ULA from your
internal network.  Source address selection will make the machines
source packets from ULA space if going to ULA-addressed servers inside
the VPN, and from global space if going "out to the internet" - so 
"it should just work"...

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 306 bytes
Desc: not available
URL: </ripe/mail/archives/ipv6-wg/attachments/20130613/cd70be63/attachment.sig>