Re: PCP, and 6434bis (was Re: IPv6 only host NAT64 requirements?)

[Ca By <[e-mail]>]

On Thu, Nov 16, 2017 at 7:26 AM Tim Chown <[e-mail]> wrote:

> > On 16 Nov 2017, at 12:42, Ca By <[e-mail]> wrote:
> >
> > On Thu, Nov 16, 2017 at 1:53 AM Tim Chown <[e-mail]> wrote:
> > Hi,
> >
> > > On 15 Nov 2017, at 23:04, james woodyatt <[e-mail]> wrote:
> > >
> > > On Nov 15, 2017, at 13:47, Ole Troan <[e-mail]> wrote:
> > >>
> > >>>> IMHO the optimal solution is:
> > >>>> - the network SHOULD provide a host with NAT64 prefix information
> in RA;
> > >>>
> > >>> Disagree. If the network has NAT64, then it should deploy RFC 7225.
> Ye gods, this is the very last thing that should be jammed into RA messages.
> > >>
> > >> Do we really want PCP in IPv6?
> > >
> > > If we have any kind of NAT, then we need PCP. Using NAT without PCP
> considered harmful. That goes for NAT64 and NAT66.
> >
> > And PCP is still needed to negotiate firewall holes in a pure IPv6
> scenario, isn’t it?  Assuming the host with PCP is behind Simple Security.
> >
> > A question: is this something we should conducer for RFC6434-bis, or
> should we be silent on PCP?
> >
> > No
> >
> > >> Is PCP successful in IPv4?
> > >
> > > Well, there was this: <
> https://www.ietf.org/proceedings/88/slides/slides-88-pcp-5.pdf>
> > >
> > >> Or does it even work well with A+P based solutions?
> > >
> > > Designed expressly for it.
> >
> > I assumed PCP was designed with an eye firmly on future routed home
> networks where firewall holes need to be opened. What is the alternative?
> >
> > The alternative is secure host and no firewall. There is no firewall at
> the ietf conference right now, right?  Are you secure ? Is there a malware
> outbreak?
>
> Yet in practice pretty much every ISP deploying IPv6 to residential is
> doing so with RFC 6092, or stricter. Perhaps with a toggle to turn off
> firewalling, but that’s the reality.
>

Yes, security FUD marketing is very real

Speaking for one largish mobile network ipv6 deployment, we have not hand
any issues related to lack of stateful traffic inspection in the last 4
years of ipv6 deployment. So if we are doing a science experiment, we have
a control group which has faired the same as the experimental group.

I will accept landlines are a slightly different animal.


> OTOH it seems that PCP support in hosts / CPEs isn't exactly widespread.
>
> > The fatal flaw in PCP (aside from the name) is that it assumes the host
> needs protection yet it gives the host the power to control the firewall.
> Next gen malware will come via email (just like today), it will encrypt
> your hard drive, and then setup and c2 network on your pc via pcp
> controls.  Sad!
>
> True, and that happens with UPnP today...
>
> Tim