Re: [v6ops] RFC7217 and flash renumbering and IID change

[Philip Homburg <[e-mail]>]

> > There are a numbering of things that could be done:
> > - Use DHCPv6 IA_NA instead of SLAAC
> 
> Could work, but obviously not for Android.

I assumed he had a server.

> > - Have a provisioning system that provides each host with a static address.
> 
> This assumes that:  * The firewall can filter based on an address/IID
> token -- which need not be the case * You're only setting rules
> for incoming connections (since temporary addresses will lead to
> changing addresses for outgoing connections)

I assume that the provisioning system would both generate the relevant
part of the firewall config and provide hosts with addresses.
There is no need to assume that addresses have a particular form.

> > - Bring back EUI-64. For systems with static addresses, EUI-64 works just
> >    fine.
> 
> *If* you wanted to do this sort of thing, you could configure the
> address based on a token (this is what windows does). This way the
> IID is stable, but you still mitigate address scans.
> 
> That said, I think EUI-64 are a bad idea.

EUI-64 works very well for this purpose. There is only the scare that you can
find out what hardware the devices is using.

> > - Define yet another pseudo-random IID. This time one where the IID remains
> >    constant over the lifetime of the system.
> 
> FWIW, this is what Windows does.

The question is whether this is also described in an RFC.

> Now, if the goal is to set fw rules for incoming connections, then
> it's likely that you'll access the boxes via DNS names. If the
> address changes, the DNS RRs need to be updated. So the hosts could
> update them, and the fw set the rules on a per-domain-name basis?

If the IID is constant then you can automatically generate a new DNS
zone file and the firewall config.

If the IID is not constant you would have to implement DNS update on all hosts.
And then generate the firewall config from that. So you have quite bit of
extra complexity for no good reason. If you automatically update DNS, then
changing the IID doesn't provide much privacy either. In addition, you don't
want your firewall to depend on whether DNS is working or not.