- Previous message: Gaurab Raj Upadhaya: "APRICOT 2008: Call for Papers"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
|
|
|
From: Eliot Lear (no email)
Date: Mon Jul 02 2007 - 03:29:57 EDT
Steven M. Bellovin wrote:
> Randy is right. It's very simple from 30,000 feet; it's a lot messier
> in detail if done at scale. I'll give just example, using your
> suggestion of converting DMZ: how do you keep your firewall rules
> consistent between v4 and v6 addresses and prefixes?
We actually cover some of this ground in RFC 4192, which talks about v6
renumbering. Also not fun, but v4 is somewhat less fun. This having
been said, and as Simon has noted in a later message, you need to
abstract addresses to make all of this stuff work smoothly. That has to
happen both in the network management tools and within the operating
system. I know that scares the hell out of some people but there is a
high price being paid for not doing it.
Eliot
|
|
|