3

Netflix gave a public tech-talk explaining their network, and one specific design puzzled me. See Page 25 at this talk (Netflix's Migration into VPC), they seemed to choose to use 100.64.0.0/10 as their private network space, rather than 10.0.0.0/8 (or a subspace from it).

What's the purpose? I don't see any obvious benefit, but I may miss some key points there. Can someone give some thoughts on this?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 25, 2018 at 8:59

2 Answers 2

Reset to default
7

they seemed to choose to use 100.64.0.0/10 as their private network space, rather than 10.0.0.0/8 (or a subspace from it).

What's the purpose? I don't see any obvious benefit, but I may miss some key points there. Can someone give some thoughts on this?

The slide is very clear on why they are using this space. They are following the current best practice for performing CGN (carrier grade NAT or carrier grade network address translation) as defined by RFC 6598. The slide also notes this.

Why this address space and not another RFC 1918 space? Because this is the shared address space the IANA has reserved as a range expressly to be used for CGN. It is the one they should be using for CGN.

Let me turn your question on its head. Given an address space specifically dedicated to CGN and defined as a best current practice, if you are using CGN, why would you use anything besides 100.64.0.0/10, such as RFC 1918 space?

This is the relevant section from RFC 6598 that provides the need for this address space for providers rather than just using RFC 1918 space:

   A Service Provider can number the interfaces in question from
   [RFC1918] space if at least one of the following conditions is true:

   o  The Service Provider knows that the CPE/NAT works correctly when
      the same [RFC1918] address block is used on both its inside and
      outside interfaces.

   o  The Service Provider knows that the [RFC1918] address block that
      it uses to number interfaces between the CGN and CPE is not used
      on the subscriber side of the CPE.

   Unless at least one of the conditions above is true, the Service
   Provider cannot safely use [RFC1918] address space and must resort to
   Shared Address Space.  This is typically the case in an unmanaged
   service, where subscribers provide their own CPE and number their own
   internal network.

However once this shared space has been assigned for the purpose and this became a best practice, there is no reason that anyone performing CGN should not use this space for its intended purpose.

Improve this answer
6
  • 3
    Except they aren't doing "CGN" -- netflix isn't a service provider. They're using 6598 space as a block of address space they (a) won't encounter on the internet, and (b) are highly unlikely to encounter in partner networks. (except where others misuse the space as they are.)
    – Ricky
    Commented Jul 11, 2018 at 2:39
  • @RickyBeam, CGN isn't only used by traditional service providers. While they are not performing CGN in the traditional sense, they are using CGN. With their Netflix Open Connect service offering, they have many similarities to service providers and face many of the same challenges as defined in RFC 6269 which is a key foundation for RFC 6598. As such they have the same rights and responsibilities to follow best practices in their implementation of CGN as well.
    – YLearn
    Commented Jul 11, 2018 at 2:50
  • Specifically from section 4 of RFC 6598: Also, Shared Address Space can be used as additional non-globally routable space on routing equipment that is able to do address translation across router interfaces when the addresses are identical on two different interfaces.
    – YLearn
    Commented Jul 11, 2018 at 2:57
  • FWIW, this question seems to be off-topic (not his network), but it's innocuous enough
    – Mike Pennington
    Commented Jul 11, 2018 at 7:37
  • 1
    @MikePennington, Ron initially marked it as so, and it was my first glancing thought as well. I pushed to reopen as while this uses a network not under the OP's control as an example, it is really about a well defined and documented best practice with an IANA reserved shared address space.
    – YLearn
    Commented Jul 11, 2018 at 18:31
1

Shorthand: The '#.x' denotes a private address space or CGN

Tl;dr: No more remaining private address spaces with a large CIDR block. The CGN range was employed as a non-overlapping space for the purpose of VPC migration.

This was a time when Netflix core engineering (ops eng) was moving away from EC2-Classic to VPC. Classic EC2 was using the 10.x space. On top of that, many other teams were already experimenting in the 172.x space and had workloads in production. Also, If I remember correctly, 10.x was being used in the datacenter and those were moved to 192.x.

Anyway, what remained was the CGN range as a private range. Hence, to not have overlapping IP space, the CGN range fit the bill. Eventually, EC2-Classic was deprecated and the datacenter went away. Teams using 172.x moved to the 100.x.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.