Re: [v6ops] RFC7217 and flash renumbering and IID change

[Fernando Gont <[e-mail]>]

On 14/12/20 08:04, Philip Homburg wrote:
>> So we're back to each host deciding on the security policy for the network - n
>> ot a network admin (as a proxy for the owners of the site/network).
>>
>> I make a point of disabling upnp as one of the first steps when setting up a n
>> etwork. Who wants ${random device which may or may not be "friendly"} to be ab
>> le to determine what traffic is allowed into the network - it's not like there
>> is anyone out there in the wild west of the internet who'd have any hostile i
>> ntent :-/
> 
> There are a numbering of things that could be done:
> - Use DHCPv6 IA_NA instead of SLAAC

Could work, but obviously not for Android.


> - Have a provisioning system that provides each host with a static address.

This assumes that:
* The firewall can filter based on an address/IID token -- which need 
not be the case
* You're only setting rules for incoming connections (since temporary 
addresses will lead to changing addresses for outgoing connections)



> - Bring back EUI-64. For systems with static addresses, EUI-64 works just
>    fine.

*If* you wanted to do this sort of thing, you could configure the 
address based on a token (this is what windows does). This way the IID 
is stable, but you still mitigate address scans.

That said, I think EUI-64 are a bad idea.


> - Define yet another pseudo-random IID. This time one where the IID remains
>    constant over the lifetime of the system.

FWIW, this is what Windows does.


Now, if the goal is to set fw rules for incoming connections, then it's 
likely that you'll access the boxes via DNS names. If the address 
changes, the DNS RRs need to be updated. So the hosts could update them, 
and the fw set the rules on a per-domain-name basis?

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492