Document Action: 'IPv6 Router Advertisement Guard' to Informational RFC

[The IESG <[e-mail]>]

The IESG has approved the following document:
- 'IPv6 Router Advertisement Guard'
  <draft-ietf-v6ops-ra-guard-08.txt> as an Informational RFC

This document is the product of the IPv6 Operations Working Group.

The IESG contact persons are Ron Bonica and Dan Romascanu.

A URL of this Internet Draft is:
http://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/



Technical Summary
 
It is particularly easy to experience "rogue" routers on an unsecured link
[reference4]. Devices acting as a rougue router may send illegitimate RAs.
Section 6 of SeND [RFC3971] provides a full solution to this problem, by
enabling routers certification. This solution does, however, require all
nodes on an L2 network segment to support SeND, as well as it carries some
deployment challenges. End- nodes must be provisioned with certificate
anchors. The solution works better when end-nodes have access to a
Certificate Revocation List server, and to a Network Time Protocol server,
both typically off-link, which brings some bootstrap issues.

When using IPv6 within a single L2 network segment it is possible and
sometimes desirable to enable layer 2 devices to drop rogue RAs before
they reach end-nodes. In order to distinguish valid from rogue RAs, the L2
devices can use a spectrum of criterias, from a static scheme that blocks
RAs received on un-trusted ports, or from un-trusted sources, to a more
dynamic scheme that uses SeND to challenge RA sources.

This document reviews various techniques applicable on the L2 devices to
reduce the threat of rogue RAs.

Working Group Summary 

Working group discussion was generally supportive.

Document Quality
 
The document is generally clear and concise. 

Personnel

Fred Baker is shepherd for this document.

RFC Editor Note

OLD TEXT:
>A device or interface in the RA-Guard "Learning" state is
>actively acquiring information about the IPv6 routing devices
>connected.

NEW TEXT:

>A device or interface in the RA-Guard "Learning" state is
>actively acquiring information about the IPv6 routing devices
>connected to its interfaces.

OLD TEXT:
> Once the L2-device has identified through "Learning" the valid
> IPv6 routers and hence also identified the valid RAs, it
> transtions each interface from "LEARNING" into either BLOCKING
> state if there was no valid IPv6 router discovered at the
> interface, or transitions the interface into FORWARDING state
> if there was a valid IPv6 router discovered.

NEW TEXT:

> When the L2-device reaches the end of the LEARNING state, it
> has a record of which interfaces are attached to links with
> valid IPv6 routers.  The L2-device transtions each interface
> from "LEARNING" into either BLOCKING state if there was no
> valid IPv6 router discovered at the interface, or transitions
> the interface into FORWARDING state if there was a valid IPv6
> router discovered.