rfc4193.txt

来自「非常好的dns解析软件」· 文本 代码 · 共 900 行 · 第 1/3 页

   where P is the probability of collision, N is the number of
   interconnected Global IDs, and L is the length of the Global ID.

   The following table shows the probability of a collision for a range
   of connections using a 40-bit Global ID field.

      Connections      Probability of Collision

          2                1.81*10^-12
         10                4.54*10^-11
        100                4.54*10^-09
       1000                4.54*10^-07
      10000                4.54*10^-05

   Based on this analysis, the uniqueness of locally generated Global
   IDs is adequate for sites planning a small to moderate amount of
   inter-site communication using locally generated Global IDs.

3.3.  Scope Definition

   By default, the scope of these addresses is global.  That is, they
   are not limited by ambiguity like the site-local addresses defined in
   [ADDARCH].  Rather, these prefixes are globally unique, and as such,
   their applicability is greater than site-local addresses.  Their
   limitation is in the routability of the prefixes, which is limited to
   a site and any explicit routing agreements with other sites to
   propagate them (also see Section 4.1).  Also, unlike site-locals, a
   site may have more than one of these prefixes and use them at the
   same time.







Hinden & Haberman           Standards Track                     [Page 6]

RFC 4193          Unique Local IPv6 Unicast Addresses       October 2005


4.  Operational Guidelines

   The guidelines in this section do not require any change to the
   normal routing and forwarding functionality in an IPv6 host or
   router.  These are configuration and operational usage guidelines.

4.1.  Routing

   Local IPv6 addresses are designed to be routed inside of a site in
   the same manner as other types of unicast addresses.  They can be
   carried in any IPv6 routing protocol without any change.

   It is expected that they would share the same Subnet IDs with
   provider-based global unicast addresses, if they were being used
   concurrently [GLOBAL].

   The default behavior of exterior routing protocol sessions between
   administrative routing regions must be to ignore receipt of and not
   advertise prefixes in the FC00::/7 block.  A network operator may
   specifically configure prefixes longer than FC00::/7 for inter-site
   communication.

   If BGP is being used at the site border with an ISP, the default BGP
   configuration must filter out any Local IPv6 address prefixes, both
   incoming and outgoing.  It must be set both to keep any Local IPv6
   address prefixes from being advertised outside of the site as well as
   to keep these prefixes from being learned from another site.  The
   exception to this is if there are specific /48 or longer routes
   created for one or more Local IPv6 prefixes.

   For link-state IGPs, it is suggested that a site utilizing IPv6 local
   address prefixes be contained within one IGP domain or area.  By
   containing an IPv6 local address prefix to a single link-state area
   or domain, the distribution of prefixes can be controlled.

4.2.  Renumbering and Site Merging

   The use of Local IPv6 addresses in a site results in making
   communication that uses these addresses independent of renumbering a
   site's provider-based global addresses.

   When merging multiple sites, the addresses created with these
   prefixes are unlikely to need to be renumbered because all of the
   addresses have a high probability of being unique.  Routes for each
   specific prefix would have to be configured to allow routing to work
   correctly between the formerly separate sites.





Hinden & Haberman           Standards Track                     [Page 7]

RFC 4193          Unique Local IPv6 Unicast Addresses       October 2005


4.3.  Site Border Router and Firewall Packet Filtering

   While no serious harm will be done if packets with these addresses
   are sent outside of a site via a default route, it is recommended
   that routers be configured by default to keep any packets with Local
   IPv6 addresses from leaking outside of the site and to keep any site
   prefixes from being advertised outside of their site.

   Site border routers and firewalls should be configured to not forward
   any packets with Local IPv6 source or destination addresses outside
   of the site, unless they have been explicitly configured with routing
   information about specific /48 or longer Local IPv6 prefixes.  This
   will ensure that packets with Local IPv6 destination addresses will
   not be forwarded outside of the site via a default route.  The
   default behavior of these devices should be to install a "reject"
   route for these prefixes.  Site border routers should respond with
   the appropriate ICMPv6 Destination Unreachable message to inform the
   source that the packet was not forwarded. [ICMPV6].  This feedback is
   important to avoid transport protocol timeouts.

   Routers that maintain peering arrangements between Autonomous Systems
   throughout the Internet should obey the recommendations for site
   border routers, unless configured otherwise.

4.4.  DNS Issues

   At the present time, AAAA and PTR records for locally assigned local
   IPv6 addresses are not recommended to be installed in the global DNS.

   For background on this recommendation, one of the concerns about
   adding AAAA and PTR records to the global DNS for locally assigned
   Local IPv6 addresses stems from the lack of complete assurance that
   the prefixes are unique.  There is a small possibility that the same
   locally assigned IPv6 Local addresses will be used by two different
   organizations both claiming to be authoritative with different
   contents.  In this scenario, it is likely there will be a connection
   attempt to the closest host with the corresponding locally assigned
   IPv6 Local address.  This may result in connection timeouts,
   connection failures indicated by ICMP Destination Unreachable
   messages, or successful connections to the wrong host.  Due to this
   concern, adding AAAA records for these addresses to the global DNS is
   thought to be unwise.

   Reverse (address-to-name) queries for locally assigned IPv6 Local
   addresses MUST NOT be sent to name servers for the global DNS, due to
   the load that such queries would create for the authoritative name
   servers for the ip6.arpa zone.  This form of query load is not
   specific to locally assigned Local IPv6 addresses; any current form



Hinden & Haberman           Standards Track                     [Page 8]

RFC 4193          Unique Local IPv6 Unicast Addresses       October 2005


   of local addressing creates additional load of this kind, due to
   reverse queries leaking out of the site.  However, since allowing
   such queries to escape from the site serves no useful purpose, there
   is no good reason to make the existing load problems worse.

   The recommended way to avoid sending such queries to nameservers for
   the global DNS is for recursive name server implementations to act as
   if they were authoritative for an empty d.f.ip6.arpa zone and return
   RCODE 3 for any such query.  Implementations that choose this
   strategy should allow it to be overridden, but returning an RCODE 3
   response for such queries should be the default, both because this
   will reduce the query load problem and also because, if the site
   administrator has not set up the reverse tree corresponding to the
   locally assigned IPv6 Local addresses in use, returning RCODE 3 is in
   fact the correct answer.

4.5.  Application and Higher Level Protocol Issues

   Application and other higher level protocols can treat Local IPv6
   addresses in the same manner as other types of global unicast
   addresses.  No special handling is required.  This type of address
   may not be reachable, but that is no different from other types of
   IPv6 global unicast address.  Applications need to be able to handle
   multiple addresses that may or may not be reachable at any point in
   time.  In most cases, this complexity should be hidden in APIs.

   From a host's perspective, the difference between Local IPv6 and
   other types of global unicast addresses shows up as different
   reachability and could be handled by default in that way.  In some
   cases, it is better for nodes and applications to treat them
   differently from global unicast addresses.  A starting point might be
   to give them preference over global unicast, but fall back to global
   unicast if a particular destination is found to be unreachable.  Much
   of this behavior can be controlled by how they are allocated to nodes
   and put into the DNS.  However, it is useful if a host can have both
   types of addresses and use them appropriately.

   Note that the address selection mechanisms of [ADDSEL], and in
   particular the policy override mechanism replacing default address
   selection, are expected to be used on a site where Local IPv6
   addresses are configured.

4.6.  Use of Local IPv6 Addresses for Local Communication

   Local IPv6 addresses, like global scope unicast addresses, are only
   assigned to nodes if their use has been enabled (via IPv6 address
   autoconfiguration [ADDAUTO], DHCPv6 [DHCP6], or manually).  They are




Hinden & Haberman           Standards Track                     [Page 9]

RFC 4193          Unique Local IPv6 Unicast Addresses       October 2005


   not created automatically in the way that IPv6 link-local addresses
   are and will not appear or be used unless they are purposely
   configured.

   In order for hosts to autoconfigure Local IPv6 addresses, routers
   have to be configured to advertise Local IPv6 /64 prefixes in router
   advertisements, or a DHCPv6 server must have been configured to
   assign them.  In order for a node to learn the Local IPv6 address of
   another node, the Local IPv6 address must have been installed in a
   naming system (e.g., DNS, proprietary naming system, etc.)  For these
   reasons, controlling their usage in a site is straightforward.

   To limit the use of Local IPv6 addresses the following guidelines
   apply:

      - Nodes that are to only be reachable inside of a site:  The local
        DNS should be configured to only include the Local IPv6
        addresses of these nodes.  Nodes with only Local IPv6 addresses
        must not be installed in the global DNS.

      - Nodes that are to be limited to only communicate with other
        nodes in the site:  These nodes should be set to only
        autoconfigure Local IPv6 addresses via [ADDAUTO] or to only
        receive Local IPv6 addresses via [DHCP6].  Note: For the case
        where both global and Local IPv6 prefixes are being advertised
        on a subnet, this will require a switch in the devices to only
        autoconfigure Local IPv6 addresses.

      - Nodes that are to be reachable from inside of the site and from
        outside of the site:  The DNS should be configured to include
        the global addresses of these nodes.  The local DNS may be
        configured to also include the Local IPv6 addresses of these
        nodes.

      - Nodes that can communicate with other nodes inside of the site
        and outside of the site: These nodes should autoconfigure global
        addresses via [ADDAUTO] or receive global address via [DHCP6].
        They may also obtain Local IPv6 addresses via the same
        mechanisms.

4.7.  Use of Local IPv6 Addresses with VPNs

   Local IPv6 addresses can be used for inter-site Virtual Private
   Networks (VPN) if appropriate routes are set up.  Because the
   addresses are unique, these VPNs will work reliably and without the
   need for translation.  They have the additional property that they
   will continue to work if the individual sites are renumbered or
   merged.



Hinden & Haberman           Standards Track                    [Page 10]

RFC 4193          Unique Local IPv6 Unicast Addresses       October 2005


5.  Global Routing Considerations

   Section 4.1 provides operational guidelines that forbid default
   routing of local addresses between sites.  Concerns were raised to
   the IPv6 working group and to the IETF as a whole that sites may
   attempt to use local addresses as globally routed provider-
   independent addresses.  This section describes why using local
   addresses as globally-routed provider-independent addresses is
   unadvisable.

5.1.  From the Standpoint of the Internet

   There is a mismatch between the structure of IPv6 local addresses and
   the normal IPv6 wide area routing model.  The /48 prefix of an IPv6
   local addresses fits nowhere in the normal hierarchy of IPv6 unicast
   addresses.  Normal IPv6 unicast addresses can be routed
   hierarchically down to physical subnet (link) level and only have to
   be flat-routed on the physical subnet.  IPv6 local addresses would
   have to be flat-routed even over the wide area Internet.

   Thus, packets whose destination address is an IPv6 local address
   could be routed over the wide area only if the corresponding /48
   prefix were carried by the wide area routing protocol in use, such as
   BGP.  This contravenes the operational assumption that long prefixes
   will be aggregated into many fewer short prefixes, to limit the table
   size and convergence time of the routing protocol.  If a network uses
   both normal IPv6 addresses [ADDARCH] and IPv6 local addresses, these
   types of addresses will certainly not aggregate with each other,
   since they differ from the most significant bit onwards.  Neither
   will IPv6 local addresses aggregate with each other, due to their
   random bit patterns.  This means that there would be a very
   significant operational penalty for attempting to use IPv6 local
   address prefixes generically with currently known wide area routing
   technology.