NAT is not security. [1]
Why would you want to do NAT in IPv6? You can do all the things you mentioned with IPv6 without NAT.
Why would you want to do NAT in IPv6? You can do all the things you mentioned with IPv6 without NAT.
No, the things I mentioned cannot be done easily with IPv6. You cannot easily switch a router from using one WAN to another (with different IPs) without requiring IPv6 clients having to obtain new addresses via SLAAC (and hence downtime), or use NAT (which is what IPv4 does, but not well supported in IPv6).
You cannot easily have 2-3 levels of networks where router3 is attached to the lan of router2 which is attached to the lan of router1, which has internet access. This is because DHCP-PD is not well supported (see Comcast) or the prefix delegated is insufficiently sized (a /56 minimum should be standard but some will give a /60 or worse, just a /64!). This is bread and butter to do in IPv4.
Your router will advertise new routes immediately when it's given a new WAN address, there's no downtime incurred explicitly from IPv6 in that scenario: local connections will still route until the timeout anyway.
SLAAC issues (and can issue) more than a single IP per device, leading to interesting bugs like the ones Sam Bowne talks about in windows.[0]
Changing a WAN interface _does_ incur downtime on ipv4 too, unless you're assigning virtual NICs and then failing over: which IPv6 would support in identical ways.
Another issue with SLAAC/lack of NAT on the LAN clients is you can’t do policy based routing on the router, eg I’ve got a fast fibre but it’s costly to use, I’ve also got a cheap and cheerful cable/DSL line that I use for backups and FTP. I want to route all requests to my backup service (which has a domain that resolves to a public IPv6 address) via the cable/DSL and everything else via Fibre. Easy to do on IPv4.
I've no idea why SLAAC would prevent you from doing policy routing - the prefix is deterministic.
In IPv4 I presume you guessed who each host is by some sort of DHCP registration. For IPv6 you would use either NDP, or perhaps even way more secure SEND enhancement with PKI instead. Of course static assignment still just works, including in NDP/SEND. (e.g. by MAC address or per link)
RIPng/OSPFv3/IS-IS/EIGRP can also tell other hosts which route you prefer packets to return by with better granularity and dynamically. This works even better with v6 since global addresses are always available.
Also perhaps I missed something in your reply, but policy based routing - the definition I have of it - encompasses more than routing different subnets via different WANs. Ie routing based on destination port, IP DSCP flags, WAN utilisation etc rather than just by source.
And as I’ve mentioned elsewhere, the cost and complexity of running routing protocols is a non-starter for many small and/or low margin businesses. Think retail or fast food or fuel etc.
You cannot easily do that with NAT either.
Every single one of your TCP sessions will die, and likely every session going over UDP as well. Unless you're talking some special protocol specifically designed to handle clients changing IPs.
Your machine may not notice, but the machines responding to your packets sure will.
First - you can't actually get static IPv6 despite the claims that there is plenty of it as a home user in the US. This static IPv6 for everyone is basically a total lie.
It's super simple with IPv4 to setup an internal network with known hosts / DHCP lease reservations if needed / dns etc, and have all that stay totally unchanged as the WAN link bounces around. If you are supporting a bunch of users (who yes, will configure a printer using the printers IP etc) then this makes like simple. You can do this at home too easily etc.
There is a weird myopia in the IPv6 world about use cases for IP. It's like they just ignored what people need and want, and went a totally different direction.
We need IPv4+ with another octet and be done with this :)
I'm serious, anyone interested in trying to push this. Keep everything the same except with another octet at the front?
RFC4941 or similar privacy extension stuff might explain this.
And you are right BGP is a non-starter for smaller sites, especially where cellular is involved. Often small site businesses just need a backup internet connection to access the web and emails, which doesn’t need the overhead of BGP. Also there is a non-trivial cost to using BGP (equipment, expertise, and ISP will charge more for the privilege) which for smaller business doesn’t make economic sense.