Re: [Fwd: I-D Action: draft-carpenter-6man-why64-00.txt]

[Lorenzo Colitti <[e-mail]>]

On Fri, Jan 10, 2014 at 1:21 AM, Ray Hunter <[e-mail]> wrote:

> The point is that people *could* trivially track and filter at /128 within
>> an enterprise *if* we give network infra people the ability to
>> control/register which /128(s) the end host uses.
>>
>
> Ideally, that ability to control/register active /128's should not rely on
> cooperation of L2 switches or other LAN functionality that requires
> purchasing new switches, or constant MIB scanning.
>
> I think that's a valid problem statement, and assigning >>/64
> (purposefully breaking SLAAC, whilst deploying stateful DHCPv6, or static
> addressing) is one way to address that problem.
>

In your network you are free to assign addresses exclusively using DHCPv6.

*However* - if you are doing this for the purpose of tracking, that only
makes any sense at all if the current switches you have (since you've
already said you're not going to buy new ones) can snoop DHCPv6 requests
for address assignments enforce IPv6-to-MAC address mappings.

Do they?

Because if they don't, disabling SLAAC gives you no security at all,
because malicious hosts on your network will still be free to create and
use arbitrary IPv6 addresses, which you will not be able to track. In fact,
this gives you the same level of security as you could by disabling privacy
addresses and using autoconf - malicious hosts can still do what they want,
and for well-behaved hosts, instead of having the MAC address in the IPv6
address, you now have to go and get it from the DHCPv6 server logs.
Lose/lose.

Or - as Tim points out, SNMP scraping will do this securely for you today,
and vendors are already building better and more scalable address
registration notification features (syslog, etc.) into switches.

And if you're not doing this for the purpose of tracking, then why are you
doing it? Is it just because it's what you do in IPv4? If so, then sorry,
that's not a valid technical argument.