Yes, tonnes of benefits. If you've ever been through a merger, you'll know the pain of dealing with getting the everything working when merging networks. That issue doesn't exist with IPv6 to anywhere near the degree because you don't have overlapping RFC1918 space to deal with. IPAM with IPv4 is a massive pain in the backside once you get up to a certain scale, even if you're allocating from 10/8. If you have multiple DCs, you're in for a world of pain. $WORK is having to use internal NATting for some stuff due to us running low on RFC1918 space, but guess what: even that doesn't quite work because there's a lot of software used in DCs that doesn't play at all nice with NAT.

> IPAM with IPv4 is a massive pain in the backside once you get up to a certain scale, even if you're allocating from 10/8.

Comcast (an US cable ISP) starting deploying IPv6 because they have so many CPE devices that they are out of IPv4 addresses to do management on them. Story from 2010:

* https://arstechnica.com/tech-policy/2010/01/comcast-running-...

It's also why Apple mandated at some points that iOS apps had to work on IPv6-only networks: it was a requirement from mobile phone companies, as IPv4 addresses are getting scarce, and mobile telcos don't want to shell out cash, so they use IPv6 on phones and do NAT64.

Well - you may have overlapping RFC 4193, but if your network engineers have done their job well, you are randomly choosing from a big honking FD/8 address space, and the odds of a collision are statistically very unlikely.

FD/8 space? You mean 10.0.0.0/8? No the odds of a collision on 10.0.0.0/8 are high because:

- Both corporations probably started allocating from the top

- Both corporations probably allocated huge subnets.

No, FD00::/8. Read RFC 4193. He's talking about the IPv6 solution, not the IPv4 problem.

Exactly - the engineers who authored RFC 4193 were super familiar with the problems of RFC 1918 space - and so they were super, super clear on exactly how you needed to allocate space from the FD/8 network. The details are very clear, and the RFC is an awesome read - but the net-net is you can generate a /48 - which means you have 2^16 sub-networks to work with (each subnetwork having effectively unlimited number of hosts allowed on it) - and you can connect with 1,000 other companies that have done the same thing, and there is only a 4.54*10^-07 chance of collision.

I know IPv6 network engineers despise RFC 4193 - but, it offers extraordinary flexibility around addressing - particularly if you have large networks that you want full control over. At my last gig, we deployed over 25 million nodes in RFC 4193 space, and it worked like a charm.

If only everyone were using IPv6... but we're talking about IPv4 here.

The idea that NAT is in any way related to security needs so badly to die. You don't need NAT for a firewall or access control. NAT is a hack to stretch IPv4 and that's it.

Nearly all security intrusions today are "pulled" in anyway via the web, e-mail, update channels, etc., or are injected by human beings via large scale or targeted phishing.

I did netsec for a while and during my tenure all the incidents we had were caused by phishing of one form or another.

Once you are inside the network, any tiny bit of defense in depth supplied by NAT becomes irrelevant.

Security is so full of mindless cargo cultism...

Yes. It offers better scalability! E.g. at my university, our institute has its own IPv4 /24. That means a maximum of ~253 or so devices. We have exhausted that number and for every new client, an old one has to go. Now with a /64 this would be no problem at all. To mitigate this the IT department is currently using VLAN-tagging for some of the devices. But it gets convoluted. And the more convoluted it gets, the higher is the chance for misconfiguration, errors, and security issues. Yet, they don't want to make the switch to IPv6 already.

In IPv4-land, it's not an 'internal network' if every device must have an externally routable address - if it is required, IPv6 has an obvious advantage.

In the requested scenario (internal Enterprise network), the proper comparison should involved IPv4's 16 million private addresses; I can't see any practical advantage to IPv6 there.

It's an internal network if it's inside your networking perimeter. The type of addresses you use on it are irrelevant to that.

Most enterprise networks need to be routed to other networks -- either other networks inside the enterprise, networks inside other enterprises or the internet. To make that work sanely all of the networks involved need to use address ranges that don't overlap. RFC1918 is pretty much the definition of overlap, and using it makes things way more complicated than they would otherwise be.

It's fine for IPv6 engineers to want to make everything directly routable, but in IPv4 the difference still matters, and therefore that's the scenario we need to compare against.

The IPv6 enterprise argument is 'You might one day have to renumber some devices because some other enterprise might have set up overlapping addresses, therefore you definitely have to renumber everything now, and oh, every time the ISP decides they don't like you, because private addresses are icky'. Obviously that's a hard sell.

I’m confused why would this happen?

> The IPv6 enterprise argument is 'You might one day have to renumber some devices because some other enterprise might have set up overlapping addresses, therefore you definitely have to renumber everything now, and oh, every time the ISP decides they don't like you, because private addresses are icky'. Obviously that's a hard sell.

If you’re an enterprise you would just get your own IPv6 block assignment. It’s not like they’re expensive or hard to get hold of.

Companies already buy and manage domains, this is no different. Using a domain you don’t own is just plain stupid, same applies to IPv6 ranges.

> It’s not like they’re expensive or hard to get hold of.

For context, apparently a block of 79,228,162,514,264,337,593,543,950,336 addresses (/48) is about 100$ a year.

79 octillion addresses ought to be enough for anybody.

Or you could just say screw it, and use RFC4193, and then all you need to ever worry about is prefix remapping at a few key touch points. Particularly if you don't care about external routing in the first place.

16 million is way too few because of collisions and the birthday paradox. Even with a tiny corporate network, you are likely to connect to other companies’ networks, and, with private addresses, no one coordinates allocations. Collisions are quite likely.

Also, the major players probably have more than 16 million devices, especially if you could VMs.

Every sane large internal network is segmented. I doubt all the "more than 16 million devices" need to talk to every other device. The IPv4 limit is an annoyance, but not a big one for the typical internal networks.

When my internal network connects, via any non-NATed means, to a vendor’s internal network, there is a chance that my addresses conflict with theirs. If the vendors have even a few tens of clients, this risk is quite high.

This is especially true because people tend to use the same private addresses over and over. How many devices are 192.168.1.1 vs. 192.168.52.123 ?

At very least it might cure them of that delusion, and prompt them to use a proper firewall.

You don't have to futz around with /24 (or /23) subnets anymore, especially for wireless if you want seamless roaming.

The default /64 prefix length can fit the 2^32 public Internet addresses 2^32 times, i.e., 4B Internets can fit in one IPv6 subnet.