All,
As you may be aware, the DNS root zone will be updated on Monday,
February 4, with AAAA resource records for six of the root servers.
(Please see http://iana.org/reports/root-aaaa-announcement.html for
IANA's official announcement.) In preparation for this change, we have
noticed that some sites seem to be having reachability problems to the
new root server IPv6 addresses that are located in critical
infrastructure Micro-allocations (/47s or /48s), but not to the root
servers located in /32s. Further testing has shown that we can ping
these sites experiencing reachability problems when sourcing the
provider allocated (PA) space on our links that aggregates up to a /32,
but not when sourcing from the provider independent (PI) /48s of our
root servers.
With the AAAA RRs going into the root zone on Monday, now is a good time
to check your IPv6 route filters. To prevent reachability problems,
network operators should update IPv6 route filters to permit up to at
least /48s from the appropriate RIR Micro-allocation blocks.
I tried to gather as many of these blocks as I could find from the RIRs.
Notably, I wasn't able to identify anything from AfriNIC -- hopefully
someone on the list will be able to fill in that gap. This list is not
meant to be complete nor authoritative, but it does cover all of the
root server IPv6 addresses that are going live on Monday (that we are
aware of) and that are in blocks allocated as /47s or 48s.
That being said, please accept at least /48s from these blocks ASAP, or
your network may experience reachability problems to the IPv6 root
servers.
ARIN (http://www.arin.net/reference/micro_allocations.html,
http://www.arin.net/policy/nrpm.html#six10)
2001:0500::/30
RIPE
(https://www.ripe.net/ripe/docs/ripe-ncc-managed-address-space.html)
2001:7F8::/29
APNIC (http://www.apnic.net/db/min-alloc.html)
2001:0C00:/23
2001:07FA:/32
LACNIC (http://lacnic.net/en/registro/index.html)
2001:12f8:0000::/35
2001:12f8:4000::/35
If you are having IPv6 reachability problems to the V6 IP addresses for
a.root-servers.net and j.root-servers.net (2001:503:BA3e::2:30 and
2001:503:C27::2:30) please feel free to contact us. We may be able to
assist in getting filters updated or working around any connectivity
issues.
Thank you,
Frank Scalzo
VeriSign