I am working on an IPv6 migration project for our group. Our solution will include:
IPv6 to IPv4 proxy servers to a Private internal IPv4 address space
Some native IPv6 support where it is easy
White listing of some IPv4 services where the above two solutions do not work
I suspect our solution is fairly typical for most Internet portals considering IPv6.
Two big issues with Carrier Grade NAT (CGN) or Large Scale NAT (LSN) that will have to be resolved are geolocation and denial of service protection.
Geo-location is the mapping of a browser's IP address to a physical location. Most of the large portals are fairly accurate about this. Although I move around from Hayward to Pleasanton and sometimes they get it right with Palo Alto. The problem with CGN is that many browsers for many different users will be NATed behind a single IP address. So if you are on the left coast you might be mapped to the Silicon Valley, if you are on the right coast it might be DC or New York, and people in the middle might be Omaha, Nebraska. As long as the ISPs hide big regions behind a single set of IP addresses, geolocation is going to have problems.
HTML 5 has a separate geolocation protocol built in, but that is going to have to wait for browser upgrades. A logical solution might be to have the ISPs map their old POPs to a single fixed IPv6 address so all traffic from Palo Alto has one IPv6 address and all the traffic from Redwood City has another IPv6 address. But this is entirely to logical and would require effort on the part of the ISPs
The other big problem is Denial Of Service protection. My company has tools to block traffic from IP addresses that are determined to be abusers of the site: to many account creation requests, to many emails sent, to many login failures, etc. With CGN this becomes a real problem. First how do you determine how many is to many. With thousands of hosts NATed behind a single address a thousand emails an hour is entirely reasonable and ten thousand an hour is not outrageous. The other problem is that when you block the IP address you block all of the customers, not just the one causing the problem. A logical solution for this would be to give each customer their own IPv6 address that they are NATed behind. This could also work well with geolocation. But again it entirely to logical and it requires work on the part of the ISPs. Without the unique per browser IP addresses DOS protection becomes a really hard problem.
RLH
"IPv6, too much, too soon" -- Someone