[OPSEC] [Technical Errata Reported] RFC6192 (3906)
RFC Errata System <rfc-editor@rfc-editor.org> Sun, 02 March 2014 11:35 UTC
Return-Path: <wwwrun@rfc-editor.org>
X-Original-To: opsec@ietfa.amsl.com
Delivered-To: opsec@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E7111A0D61 for <opsec@ietfa.amsl.com>; Sun, 2 Mar 2014 03:35:25 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.449
X-Spam-Level:
X-Spam-Status: No, score=-2.449 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.547, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l92XHW5guC_8 for <opsec@ietfa.amsl.com>; Sun, 2 Mar 2014 03:35:23 -0800 (PST)
Received: from rfc-editor.org (rfc-editor.org [IPv6:2607:f170:8000:1500::d3]) by ietfa.amsl.com (Postfix) with ESMTP id 677B91A0D6E for <opsec@ietf.org>; Sun, 2 Mar 2014 03:35:23 -0800 (PST)
Received: by rfc-editor.org (Postfix, from userid 30) id EBEC87FC39B; Sun, 2 Mar 2014 03:35:20 -0800 (PST)
To: dave@juniper.net, cpignata@cisco.com, rodunn@cisco.com, bclaise@cisco.com, joelja@bogus.com, kk@google.com, gvandeve@cisco.com
From: RFC Errata System <rfc-editor@rfc-editor.org>
Message-Id: <20140302113520.EBEC87FC39B@rfc-editor.org>
Date: Sun, 02 Mar 2014 03:35:20 -0800
Archived-At: http://mailarchive.ietf.org/arch/msg/opsec/VEMszJvU7_YPPdS8tACU4WMa6CI
Cc: opsec@ietf.org, rfc-editor@rfc-editor.org, nick@foobar.org
Subject: [OPSEC] [Technical Errata Reported] RFC6192 (3906)
X-BeenThere: opsec@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: opsec wg mailing list <opsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/opsec>, <mailto:opsec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/opsec/>
List-Post: <mailto:opsec@ietf.org>
List-Help: <mailto:opsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/opsec>, <mailto:opsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 02 Mar 2014 11:35:26 -0000
The following errata report has been submitted for RFC6192, "Protecting the Router Control Plane". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=6192&eid=3906 -------------------------------------- Type: Technical Reported by: Nick Hilliard <nick@foobar.org> Section: A.1 Original Text ------------- [...] ip access-list extended DNS permit udp 198.51.100.0 0.0.0.252 eq domain any ipv6 access-list DNSv6 permit udp 2001:DB8:100:1::/64 eq domain any permit tcp 2001:DB8:100:1::/64 eq domain any ip access-list extended NTP permit udp 198.51.100.4 255.255.255.252 any eq ntp ipv6 access-list NTPv6 permit udp 2001:DB8:100:2::/64 any eq ntp ip access-list extended SSH permit tcp 198.51.100.128 0.0.0.128 any eq 22 ipv6 access-list SSHv6 permit tcp 2001:DB8:100:3::/64 any eq 22 ip access-list extended SNMP permit udp 198.51.100.128 0.0.0.128 any eq snmp [...] Corrected Text -------------- [...] ip access-list extended DNS permit udp 198.51.100.0 0.0.0.3 eq domain any ipv6 access-list DNSv6 permit udp 2001:DB8:100:1::/64 eq domain any permit tcp 2001:DB8:100:1::/64 eq domain any ip access-list extended NTP permit udp 198.51.100.4 0.0.0.3 any eq ntp ipv6 access-list NTPv6 permit udp 2001:DB8:100:2::/64 any eq ntp ip access-list extended SSH permit tcp 198.51.100.128 0.0.0.127 any eq 22 ipv6 access-list SSHv6 permit tcp 2001:DB8:100:3::/64 any eq 22 ip access-list extended SNMP permit udp 198.51.100.128 0.0.0.127 any eq snmp [...] Notes ----- The bitfield masks in the Cisco Configuration example in section A.1 look incorrect. The authors may have intended the following meanings: ip access-list extended DNS all hosts between 198.51.100.0 and 198.51.100.3 instead of all addresses in the range 198.51.100.0/24 which are evenly divisible by 4 ip access-list extended NTP all hosts between 198.51.100.4 and 198.51.100.7 instead of all addresses in the range 0.0.0.0/0 which are evenly divisible by 4 ip access-list extended SSH all hosts between 198.51.100.128 and 198.51.100.255 instead of 198.51.100.128/32 ip access-list extended SNMP all hosts between 198.51.100.128 and 198.51.100.255 instead of 198.51.100.128/32 Instructions: ------------- This errata is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party (IESG) can log in to change the status and edit the report, if necessary. -------------------------------------- RFC6192 (draft-ietf-opsec-protect-control-plane-06) -------------------------------------- Title : Protecting the Router Control Plane Publication Date : March 2011 Author(s) : D. Dugal, C. Pignataro, R. Dunn Category : INFORMATIONAL Source : Operational Security Capabilities for IP Network Infrastructure Area : Operations and Management Stream : IETF Verifying Party : IESG
- [OPSEC] [Technical Errata Reported] RFC6192 (3906) RFC Errata System
- Re: [OPSEC] [Technical Errata Reported] RFC6192 (… Carlos Pignataro (cpignata)
- [OPSEC] [Errata Verified] RFC6192 (3906) RFC Errata System