This is a question about multihomed systems, systems attached to multihomed
networks, or systems providing services to both public and private
resources.
I'm considering a scenario that looks like this[1], where a multihomed HQ
has unique PA /48s and delegates them throughout the enterprise. The HQ
network admins deploy a pair of /56s per remote site, each prefix coming
from a different provider. This may be a bad assumption and I'm asking for
help.
What does a public service hosted at site 4 look like? If I query the AAAA
record, do I get a pair of addresses and DNS round robin them in the
classic way? Are there well defined best practices for this kind of thing
to ensure availability? How does this support resilient services? I want my
webserver to be accessible during ISP failure. DNS round robin doesn't do
that. It requires intervention to update the record and restore service.
What if I change the diagram a bit, like this[2]? In this case the Private
WAN subnet is not publicly advertised. My remote sites want to talk to the
web server. My web server also wants to be publicly accessible. My web
server now has two addresses and two AAAA records, one public and one
private. Is this how IPv6 multiaddressing is intended to be used?
What is the routing behavior for source address selection in the second
case? How does the web server know to talk to the internet using its public
address and site to site using its private address for connections it
initiates? Are these things clearly defined and figured out in literature
and BCPs? Do we really rely on host based routing and security in IPv6
rather than transit nodes?
[1]https://i.imgur.com/Jzvj2sz.png
[2]https://i.imgur.com/XB416tT.png
Jason
networks, or systems providing services to both public and private
resources.
I'm considering a scenario that looks like this[1], where a multihomed HQ
has unique PA /48s and delegates them throughout the enterprise. The HQ
network admins deploy a pair of /56s per remote site, each prefix coming
from a different provider. This may be a bad assumption and I'm asking for
help.
What does a public service hosted at site 4 look like? If I query the AAAA
record, do I get a pair of addresses and DNS round robin them in the
classic way? Are there well defined best practices for this kind of thing
to ensure availability? How does this support resilient services? I want my
webserver to be accessible during ISP failure. DNS round robin doesn't do
that. It requires intervention to update the record and restore service.
What if I change the diagram a bit, like this[2]? In this case the Private
WAN subnet is not publicly advertised. My remote sites want to talk to the
web server. My web server also wants to be publicly accessible. My web
server now has two addresses and two AAAA records, one public and one
private. Is this how IPv6 multiaddressing is intended to be used?
What is the routing behavior for source address selection in the second
case? How does the web server know to talk to the internet using its public
address and site to site using its private address for connections it
initiates? Are these things clearly defined and figured out in literature
and BCPs? Do we really rely on host based routing and security in IPv6
rather than transit nodes?
[1]https://i.imgur.com/Jzvj2sz.png
[2]https://i.imgur.com/XB416tT.png
Jason