6 ms·

why would an enterprise turn to IPv6? everything fit's nicely in the 10.0.0.0/8 range in my many decades of enterprise infrastructure, no-one has ever mention

why would an enterprise turn to IPv6? everything fit's nicely in the 10.0.0.0/8 range in my many decades of enterprise infrastructure, no-one has ever mentioned IP6 either. why would they, whats the business case?

arccy 9mo ago
one poorly made decision and oops you're out of 10/8 addresses if you've never run in to this, then sorry, you've not been in an enterprise, you're in a mom 'n pop shop cosplaying as enterprise.
baq 9mo ago
you haven't had to set up intercompany vpns I see
- einpoklum 9mo ago
  Indeed I have not. But I suspect most people, and most companies, have not either. I don't claim IPv6 isn't used anywhere, or even that it's not used a lot.
  - pixl97 9mo ago
    Pretty much every fortune 500 company does, which counts for millions of people on their networks every day. The troubleshooting calls for VPN routing vs internal LAN routing are fun endeavors of who is actually willing to take responsibility for things they don't understand.
    - formerly_proven 9mo ago
      Somehow still easier than v6.
      - bigstrat2003 9mo ago
        It is not in the least easier than v6. IPv6 isn't even difficult.
      - p_l 9mo ago
        I've spent half a year getting nowhere on a discussion involving VPN-ing parts of the company just to have connectivity for specific services where part of the problem was lots and lots of overlapping 10./8 allocations - partially because everyone setting a "VPC" or some local dc network was doing individual 10./8, often "in name of simplicity". With subnetting needs, possibly dealing with VPNs to other networks that might use 10./8, ISPs that might use 10./8 instead of CGNAT space (100.64./10), even the total incompetence of some contractors was not reducing how IPv4 was a problem. And that's before you hit the part where Microsoft products have been IPv6 First since ~2008 and there are entire feature sets that are very interesting to bigger companies (like well integrated always-on vpn for laptops) that require working v6
t_tsonev 9mo ago
The problem with private address ranges is that everyone thinks they're available. In a large enough enterprise you're bound to have conflicts. They usually pop up at the most inconvenient time and suddenly you're cosplaying ARIN in your IT department.
throw0101a 9mo ago
> everything fit's nicely in the 10.0.0.0/8 range Except during a merger/acquisition and both companies have 10.0.0.0/24 in their OSPF or IS-IS topology.
alphager 9mo ago
Grow large enough and you hit the limit pretty fast. NAT complicates things.
- pixl97 9mo ago
  The best one is async routing. You have a NAT, they have a NAT, you VPN together and think you have different IP address ranges, but unknown to the operator there's a little internal network with an overlap at the end of some slow line that is now getting flooded with internal traffic that's trying to go to a completely different network.
- einpoklum 9mo ago
  I've worked for companies with over 50,000 employees and they didn't seem to need it. Now, sure, there are larger companies, or ones that employ huge farms of machines, but those are the exception rather than the rule.
PunchyHamster 9mo ago
if both you and companies you have site to site vpn with have IPv6 there is no IP conflict or NAT to worry about.... and that's about end of the advantages
patmorgan23 9mo ago
Unless you get to big. Or you merge with another company and have to combine your internal networks and oops, all the subnets are overlapping. Or you need to serve mobile clients who get better connectivity over v6.
thayne 9mo ago
> everything fit's nicely in the 10.0.0.0/8 range Except for when it doesn't. If you just use that space as a flat range, it is almost certainly more than enough. But if you split it up in multiple levels of subnets, you can run into difficulties balancing having enough subnets and having enough space in each subnet.
- yyyk 9mo ago
  240/4 is private and more than sufficient.
  - chungy 9mo ago
    It is not private, it is merely "reserved". If/when that range opens up for Internet address, you'll be in a world of hurt for having used it. IPv6 is much more stable on what you can use. fc00::/7 is actually private use.
    - yyyk 9mo ago
      That will never ever happen. Making 240/4 public will break Amazon (and many others) which do use it privately. The software updates to route it across the net would have been taxing. When making it public was suggested years ago, IETF saw the proposition as encouraging IPv4 and refused to entertain it. In short: The market has already decided and it's private. It's far from the first time an unofficial arrangement is the de facto standard.
malwrar 9mo ago
We burned thru pretty much all of our public /8, RFC1918, and have begun digging into RFC6589 (a /10 I didn’t even know existed prior to job). Still shocks me. Hardly an expert in the space, but I think the issue comes from subnetting to distribute ranges to teams that need a consistent IP address space for some project or another. Lots of inefficiency & hoarding over time. We’ve had legitimate outages and impending platform death staved off by last minute horse-trading & spooky technical work due to such things. IPV6 has always been a distant aspiration.

arccy 9mo ago

one poorly made decision and oops you're out of 10/8 addresses if you've never run in to this, then sorry, you've not been in an enterprise, you're in a mom 'n pop shop cosplaying as enterprise.

baq 9mo ago

you haven't had to set up intercompany vpns I see

einpoklum 9mo ago
Indeed I have not. But I suspect most people, and most companies, have not either. I don't claim IPv6 isn't used anywhere, or even that it's not used a lot.
- pixl97 9mo ago
  Pretty much every fortune 500 company does, which counts for millions of people on their networks every day. The troubleshooting calls for VPN routing vs internal LAN routing are fun endeavors of who is actually willing to take responsibility for things they don't understand.
  - formerly_proven 9mo ago
    Somehow still easier than v6.
    - bigstrat2003 9mo ago
      It is not in the least easier than v6. IPv6 isn't even difficult.
    - p_l 9mo ago
      I've spent half a year getting nowhere on a discussion involving VPN-ing parts of the company just to have connectivity for specific services where part of the problem was lots and lots of overlapping 10./8 allocations - partially because everyone setting a "VPC" or some local dc network was doing individual 10./8, often "in name of simplicity". With subnetting needs, possibly dealing with VPNs to other networks that might use 10./8, ISPs that might use 10./8 instead of CGNAT space (100.64./10), even the total incompetence of some contractors was not reducing how IPv4 was a problem. And that's before you hit the part where Microsoft products have been IPv6 First since ~2008 and there are entire feature sets that are very interesting to bigger companies (like well integrated always-on vpn for laptops) that require working v6

t_tsonev 9mo ago

The problem with private address ranges is that everyone thinks they're available. In a large enough enterprise you're bound to have conflicts. They usually pop up at the most inconvenient time and suddenly you're cosplaying ARIN in your IT department.

throw0101a 9mo ago

> everything fit's nicely in the 10.0.0.0/8 range Except during a merger/acquisition and both companies have 10.0.0.0/24 in their OSPF or IS-IS topology.

alphager 9mo ago

Grow large enough and you hit the limit pretty fast. NAT complicates things.

pixl97 9mo ago
The best one is async routing. You have a NAT, they have a NAT, you VPN together and think you have different IP address ranges, but unknown to the operator there's a little internal network with an overlap at the end of some slow line that is now getting flooded with internal traffic that's trying to go to a completely different network.
einpoklum 9mo ago
I've worked for companies with over 50,000 employees and they didn't seem to need it. Now, sure, there are larger companies, or ones that employ huge farms of machines, but those are the exception rather than the rule.

PunchyHamster 9mo ago

if both you and companies you have site to site vpn with have IPv6 there is no IP conflict or NAT to worry about.... and that's about end of the advantages

patmorgan23 9mo ago

Unless you get to big. Or you merge with another company and have to combine your internal networks and oops, all the subnets are overlapping. Or you need to serve mobile clients who get better connectivity over v6.

thayne 9mo ago

> everything fit's nicely in the 10.0.0.0/8 range Except for when it doesn't. If you just use that space as a flat range, it is almost certainly more than enough. But if you split it up in multiple levels of subnets, you can run into difficulties balancing having enough subnets and having enough space in each subnet.

yyyk 9mo ago
240/4 is private and more than sufficient.
- chungy 9mo ago
  It is not private, it is merely "reserved". If/when that range opens up for Internet address, you'll be in a world of hurt for having used it. IPv6 is much more stable on what you can use. fc00::/7 is actually private use.
  - yyyk 9mo ago
    That will never ever happen. Making 240/4 public will break Amazon (and many others) which do use it privately. The software updates to route it across the net would have been taxing. When making it public was suggested years ago, IETF saw the proposition as encouraging IPv4 and refused to entertain it. In short: The market has already decided and it's private. It's far from the first time an unofficial arrangement is the de facto standard.

malwrar 9mo ago

We burned thru pretty much all of our public /8, RFC1918, and have begun digging into RFC6589 (a /10 I didn’t even know existed prior to job). Still shocks me. Hardly an expert in the space, but I think the issue comes from subnetting to distribute ranges to teams that need a consistent IP address space for some project or another. Lots of inefficiency & hoarding over time. We’ve had legitimate outages and impending platform death staved off by last minute horse-trading & spooky technical work due to such things. IPV6 has always been a distant aspiration.