Re: A Plea for Architectural & Specification Stability with IPv6

[Glen Turner <[e-mail]>]

Hemant Singh wrote:

> ACL and source address for protocols should use the network interface of the card to be immune to card replacement.

ACLs could use interface names, but none of the vendors I know offer a facility like:
  ipv6 access-list ILLUSTRATIVE-EXAMPLE
   permit My_IP(Ethernet0)

I can understand that from a vendor's point of view. It does seem like a rather fragile feature (you've got to remember to rewrite ACLs into the line card ASIC or TCAM every time a interface flaps and every time a SLAAC or DHCP address expires). Having said that, "permit My_IP(*)" would be a godsend to anyone writing code to protect the router from abuse.

>  It is also realistic that if a card is replaced, some configuration may need to change

Firstly, card swaps and router configuration changes are not done by the same people. Involving two groups of people in a card change leads to considerably more cost. Secondly, there's the issue of certainty: were all ACLs, etc updated? This gives a card swap a risk which didn't previously exist.

>  The router interface can also use SLAAC to obtain its ipv6 global address.

No point, you have to predict the SLAAC address to be able to protect the router against attacks on that address and then use that address in ACLs. So you get all the fragility and vulnerability to SLAAC-based attacks but don't get automated configuration of the entire interface-referencing configuration.

> mac-address 0000.0101.9843

Using locally-administered MAC addresses does seem the only reasonable way forward, but again this increases the cost of deployment of IPv6 compared with other protocols (now we need a scheme for assigning local MAC addresses).

Of course there is an Internet-Draft in the works to remove the relationship between MAC address and the interface ID. I would have liked that draft or draft-gont-6man-deprecate-eui64-based-addresses to SHOULD allow the static configuration of interface IDs within a subnet of host using draft-ietf-6man-stable-privacy-addresses.

I do take Brian's point:

> Regardless, there's no recent spec change that "MUST NOT"s small integer IIDs, afaik.

and so I will take this up with the vendor and ask which specification they were relying upon.

Best wishes to all,
glen