> 2. In many situations, we dont want devices on the internet at all, and on private only networks. ... Unique Local Addressing (RFC 4193) solves this problem

> 2. In many situations, we dont want devices on the internet at all, and on private only networks. ... Unique Local Addressing (RFC 4193) solves this problem and requires no coordination with outside parties. The network admin gets to choose the scope of the ULA prefix, so you can trivially make your ULA traverse multiple LANs if you wish. (This addresses your first point, too.) > 3. There is a lack of clearly communicated best practices for the industry. Eh? This is the first hit for "IPv6 BCP": https://www.apnic.net/community/ipv6-program/ipv6-bcp https://www.apnic.net/community/ipv6-program/ipv6-bcp > 4. Knowing how heavily the NSA was involved in ipv6 (in particular ipv6 ipsec)... Then -uh- don't use IPSec and block IPSec connection establishment attempts at your border firewalls. Or, because implementation of IPSec is -sadly- not a requirement for IPv6 implementers, use an IPv6 implementation that doesn't implement it. Edit: You are aware that OpenVPN uses TLS for session authentication and IPSec for transport of tunnelled data? :) > 5. As the admin, I want to be able to see non encrypted traffic and metdata traversing my exit points. I am having a harder and harder time diagnosing IPv6 because of how often it wants to tunnel to some ipv4 address that I dont trust (read: microsoft). Are you talking about IPv6 over Teredo tunnels? If you are, then get a packet dump and fire up Wireshark... Teredo doesn't encrypt the traffic that it tunnels. If you aren't, and you're talking about something that's wrapping traffic in TLS, then -well- that doesn't have anything to do with IPv6.