distributed vs centralized approaches to ND security

[Michael Richardson <[e-mail]>]

Vasilenko Eduard <[e-mail]> wrote:
    > Yes, I have made comment below that if Address Allocation would be
    > changed to Centralized, then it is probably not SLAAC anymore. Then it
    > is better to adopt DHCPv6.

SLAAC has the features that it is seems completely stateless for the routers.
One can as many add routers to the network as desired to deal with whatever
resilience issues one has.   Many IPv4 experienced people are startled to
realize that one does not need VRRP or anything to have redundant routers in
IPv6.

Full stateful DHCPv6, can also be made resilient through redundancy, but it
seems significantly less popular, and it isn't particularly more secure when
it comes to ND, just to controlling address allocation.

There are things in between, as Pascal keep repeating: RFC8505 provides for
statefulness ND.  It's not mutually exclusive with SLAAC, as it does not deal
with assignment, just defense (DAD).

    > I have read your https://datatracker.ietf.org/doc/draft-ietf-6lo-backbone-router
    > Proxy is not universal solution and should not be mainstream. It is
    > complicated: IP subnet is split for many broadcast domains, proxy
    > stitch it back.

But, the database which is the proxy is present in almost every single ethernet system today.
It's just that it exists at the layer-2 in the form of MAC address forwarding
tables.  We don't get to see them, don't get to securely update them, and
they are impossible to debug.  These are what I call layer-2 games.
We need to stop playing them, and architecture our layer-3 around the real
physical topology.  We need to do this for security, latency and efficiency
reasons.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-