Re: [OPSEC] Draft: draft-gont-opsec-ipv6-implications-on-ipv4-nets Review

Regarding the filtering of Teredo 'data' packets, several IPS are actually dropping all UDPv4 packets where 2001:0::/32 appears at the right place with also another IPv6 address as well as the IPv6 version indicator. So, this is one way to block Teredo

But, the most efficient (often used unknowingly) is to use only application proxies ;)

> -----Original Message-----
> From: opsec-bounces@ietf.org [mailto:opsec-bounces@ietf.org] On Behalf Of
> Fernando Gont
> Sent: mardi 14 août 2012 14:02
> To: Panos Kampanakis (pkampana)
> Cc: opsec@ietf.org
> Subject: Re: [OPSEC] Draft: draft-gont-opsec-ipv6-implications-on-ipv4-nets
> Review
> 
> Hi, Panos,
> 
> While trying to address your feedback, I came up with additional comments.
> Please do let me know what you think...
> 
> On 08/13/2012 05:52 PM, Panos Kampanakis (pkampana) wrote:
> > - I see that you are mentioning RA-Guard for SLAAC-based attacks. Is
> > the ND-Shield worth mentioning for L2 attacks?
> 
> I ended up referencing DHCPv6-Shield rather than ND-Shield, since the goal
> here is to prevent attackers from enabling "global IPv6 connectivity" -- ND-
> Shield, on the other hand mitigates Neighbor Cache sppofing attacks, which
> is not the subject of this section.
> 
> 
> > - In 6to4 subsection, a couple of protections state "(embedded in the
> > IPv4 payload)". This is not our traditional ACL filtering. It requires
> > equipment that can look and inspect the encapsulated packet, or match
> > on specific fields of the packet payload, or actually understand 6 in
> > 4 encapsulation in order to be able to filter. Maybe it would be worth
> > the put a sentence to clarify that to prevent readers from think this
> > is traditional ACL filtering.
> 
> I've added a clarification about this. Additionally, I added a note
> mentioning that an attacker might fragment its 6to4 packets into tiny
> fragments such that the filtering device does not really have access to the
> embedded IPv6 Addresses.
> 
> 
> 
> > - For Teredo, would it be worth mentioning that blocking UDP packets
> > with embedded IPv6 addresses 2001::/32 on a device that can
> > match/"understand"/inspect Teredo encapsulation is another mitigation
> > option (as in 6to4 "(embedded in the IPv4 payload)")?
> 
> The problem here is that, IIRC (and of the top of my head), no specific UDP
> port numbers are used for the "data" packets, and hence you cannot really
> tell to which UDP packets you should apply these filtering rules.
> 
> Does this make sense?
> 
> As a result, I have not yet added any text regarding filtering Teredo
> packets based on the embedded IPv6 addresses. But please do let me know if
> you feel otherwise.
> 
> Thanks!
> 
> Best regards,
> --
> Fernando Gont
> SI6 Networks
> e-mail: fgont@si6networks.com
> PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
> 
> 
> 
> _______________________________________________
> OPSEC mailing list
> OPSEC@ietf.org
> https://www.ietf.org/mailman/listinfo/opsec