Re: [OPSEC] comment on 'draft-ietf-opsec-ipv6-implications-on-ipv4-nets'

"Templin, Fred L" <Fred.L.Templin@boeing.com> Fri, 01 March 2013 16:15 UTC

From: "Templin, Fred L" <Fred.L.Templin@boeing.com>
To: Fernando Gont <fgont@si6networks.com>
Thread-Topic: [OPSEC] comment on 'draft-ietf-opsec-ipv6-implications-on-ipv4-nets'
Thread-Index: Ac4VGLawnms/XfNvRyuAsQEKPKG3yQBZVngAAAYI8AA=
Date: Fri, 01 Mar 2013 16:15:32 +0000
Message-ID: <2134F8430051B64F815C691A62D98318015445@XCH-BLV-504.nw.nos.boeing.com>
References: <2134F8430051B64F815C691A62D9831801380F@XCH-BLV-504.nw.nos.boeing.com> <51303822.50108@si6networks.com>
In-Reply-To: <51303822.50108@si6networks.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "opsec@ietf.org" <opsec@ietf.org>
Subject: Re: [OPSEC] comment on 'draft-ietf-opsec-ipv6-implications-on-ipv4-nets'
Precedence: list

Hi Fernando,

> -----Original Message-----
> From: Fernando Gont [mailto:fgont@si6networks.com]
> Sent: Thursday, February 28, 2013 9:10 PM
> To: Templin, Fred L
> Cc: opsec@ietf.org
> Subject: Re: [OPSEC] comment on 'draft-ietf-opsec-ipv6-implications-on-
> ipv4-nets'
> 
> Hi, Fred,
> 
> On 02/27/2013 03:31 PM, Templin, Fred L wrote:
> >
> >   "As a result, blocking ISATAP by preventing hosts from
> >    successfully performing name resolution for the
> >    aforementioned names and/or by filtering packets with
> >    specific IPv4 destination addresses is both difficult
> >    and undesirable."
> >
> > I would like to understand this better. In particular, the
> > ISATAP service is by design disabled by disabling name
> > resolution for the name "isatap.domainname" and/or by
> > disabling the ISATAP router advertisement service. Can
> > you say why this would be difficult and undesirable?
> 
> Preventing name resolution is virtually impossible, since Windows nodes
> not only try to perform such resolution with DNS, but also with LLMNR.
> In order to block the latter, you should be able to achieve such
> filtering at layer 2 -- and that would be a bit onerous (not to mention
> how difficult that would be if fragmentation is employed).

Nodes that send RAs in response to LLMNR queries for ISATAP
when they shouldn't are rogue IPv6 "routers" that have somehow
gained access to what should be a protected link. The concern
is no different than for any rogue IPv6 router that gains access
to an ordinary link. In the case of ISATAP, the router can be
located by its IPv4 address. For ordinary routers, the router
can be located by its MAC address. The mitigations for the
attack profile are the same in either case.

Thanks - Fred
fred.l.templin@boeing.com

> Since you never know what the isata domain names may resolve to, it's
> essentially impossible to block isatap packets based on a specific
> destination address (you'd need to know such address in advance in order
> to create the ACL).
> 
> Please do let me know if this clarification has been of any help.
> 
> Thanks,
> --
> Fernando Gont
> SI6 Networks
> e-mail: fgont@si6networks.com
> PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
> 
> 
>

[OPSEC] comment on 'draft-ietf-opsec-ipv6-implica… Templin, Fred L
Re: [OPSEC] comment on 'draft-ietf-opsec-ipv6-imp… Fernando Gont
Re: [OPSEC] comment on 'draft-ietf-opsec-ipv6-imp… Templin, Fred L