[106581] in North American Network Operators' Group
RE: was bogon filters, now "Brief Segue on 1918"
daemon@ATHENA.MIT.EDU (Blake Pfankuch)
Wed Aug 6 09:39:32 2008
From: Blake Pfankuch <bpfankuch@cpgreeley.com>
To: "Darden, Patrick S." <darden@armc.org>, "nanog@nanog.org" <nanog@nanog.org>
Date: Wed, 6 Aug 2008 07:39:20 -0600
In-Reply-To: <CBE22E5FF427B149A272DD1DDE1075240236876A@EX2K3.armc.org>
Errors-To: nanog-bounces@nanog.org
Where I work we are more aimed towards the SMB market, and we do run into t=
hat issue a lot. Of course a lot of the problem we run into is that the "e=
ngineers" who set up these SMB clients, even getting into some of the large=
r businesses just use what they always do. I can think of one specific eng=
ineer who everything he does is 192.168.1.0/24 .254 gateway .1 server which=
has cause issues. We have one particular client who has nearly 40 VPN's b=
etween partners and they have actually had to do a lot of natting at the vp=
n endpoint as they have 3 clients they connect to that are 10.0.1.0/24 and =
several that are 192.168.0.0/24 however a lot of the newer VPN firewalls th=
at we work with actually do a pretty slick job. SonicWall NSA series devic=
es have a "NAT VPN range" checkbox when you build the VPN and you just give=
it the range to use, as do the Fortinet devices.
-----Original Message-----
From: Darden, Patrick S. [mailto:darden@armc.org]
Sent: Wednesday, August 06, 2008 7:26 AM
To: nanog@nanog.org
Subject: was bogon filters, now "Brief Segue on 1918"
Was looking over 1918 again, and for the record I have only run into one
network that follows:
"If two (or more) organizations follow the address allocation
specified in this document and then later wish to establish IP
connectivity with each other, then there is a risk that address
uniqueness would be violated. To minimize the risk it is strongly
recommended that an organization using private IP addresses choose
*randomly* from the reserved pool of private addresses, when
allocating
sub-blocks for its internal allocation."
I added the asterisks.
Most private networks start at the bottom and work up: 192.168.0.X++,
10.0.0.X++, etc. This makes
any internetworking (ptp, vpn, etc.) ridiculously difficult. I've seen
a lot of hack jobs
using NAT to get around this. Ugly.
--Patrick Darden
-----Original Message-----
From: Darden, Patrick S.
Sent: Wednesday, August 06, 2008 9:19 AM
To: 'Leo Bicknell'; nanog@nanog.org
Subject: RE: Is it time to abandon bogon prefix filters?
Yes. 1918 (10/8, 172.16/12, 192.168/16), D, E, reflective (outgoing
mirroring), and as always individual discretion.
--Patrick Darden
-----Original Message-----
From: Leo Bicknell [mailto:bicknell@ufp.org]
Sent: Wednesday, August 06, 2008 9:10 AM
To: nanog@nanog.org
Subject: Is it time to abandon bogon prefix filters?
"Bogon" filters made a lot of sense when most of the Internet was
bogons. Back when 5% of the IP space was allocated blocking the
other 95% was an extremely useful endevour. However, by the same
logic as we get to 80-90% used, blocking the 20-10% unused is
reaching diminishing returns; and at the same time the rate in which
new blocks are allocated continues to increase causing more and
more frequent updates.
Have bogon filters outlived their use? Is it time to recommend people
go to a simpler bogon filter (e.g. no 1918, Class D, Class E) that
doesn't need to be updated as frequently?
--
Leo Bicknell - bicknell@ufp.org - CCIE 3440
PGP keys at http://www.ufp.org/~bicknell/
