Egregoros

> There is also a significant set of use cases that currently work better, or at least more easily, with NAT.

> The most common example is small branch sites with dual ISP uplinks. There are a vast number of these sites deployed using two small provider-assigned (PA) NAT pools. This setup is widely understood, simple to implement, and reliable.

> Moving these sites to IPv6 via BGP is often not feasible. Many ISP circuits do not support BGP, and the teams operating these sites lack the time to navigate that complexity. Furthermore, other IPv6 dual-homing options often don't align with enterprise requirements or expected complexity (or really simplicity) levels.

> In my view, this is a core reason why IPv6 adoption remains low in the enterprise space: it requires fundamental paradigm shifts rather than a simple protocol update.

so true

> Then we get to IPv6.

> Each router has a prefix from its upstream provider via DHCPv6-PD. Each downstream interface gets an address from that upstream's delegated prefix.

> Each host now has prefix information coming from two different routers, and installs two different prefixes. Hosts that use SLAAC or DHCPv6 get addresses dynamically, one from each upstream router.

> Devices that need static addresses like NFS servers have two addresses, one from each upstream provider's delegated prefix.

> Default route information is handed out dynamically to autoconfiguring hosts via RAs, since DHCPv6 isn't allowed to pass along default route information.

> For statically addressed hosts, a static default gateway can be configured to a VRRPv6 link-local v6 address, with all the chaos involved in having to statically assign link-local addresses.

> Now, when [ISP 1]'s link goes away, VRRPv6 can change priorities so that the default gateway flips to [ISP 2]'s router. Yay!

> Unfortunately, there's nothing that tells the downstream host "hey, stop using that address as a source address for connections". So, the host continues trying to use [ISP 1]'s prefixed address as a source IP for connections, even though the default gateway is now going out through [ISP 2]. [ISP 2], being a good network, sees what looks like IP spoofing going on, and drops the outbound packets.

> Host keeps trying ineffectively to establish an outbound connection using the [ISP 1] prefix address, because there's no way to signal the statically addressed host "hey, stop using that prefix as a source address, use the other address you have instead"

> Eventually, after enough failures, the user gives up and turns off IPv6.


☝️☝️☝️☝️☝️☝️☝️☝️☝️

> You seem to be denying the existence of all the small businesses in the world.

> Given that Google estimates there are 200 to 400 million enterprises with less than 50 employees worldwide, that's a pretty big chunk of the business world to ignore.

> Or are you suggesting that 400 million small businesses should get their own ASNs and provider independent IPv6 space, and use BGP to gain redundancy for their businesses?

> (talk about driving a demand for more router RAM for the DFZ core! 😜 )