Re: [secdir] Secdir review of draft-ietf-opsec-ipv6-implications-on-ipv4-nets-03

["Joseph Salowey (jsalowey)" <[e-mail]>]

On Apr 16, 2013, at 4:06 PM, Fernando Gont <[e-mail]>
 wrote:

> Hi, Joseph,
> 
> Thanks so much for your review! -- Please find my comments in-line....
> 
> On 04/16/2013 03:43 PM, Joseph Salowey (jsalowey) wrote:
>> draft-ietf-opsec-ipv6-implications-on-ipv4-nets-03 discusses issues
>> with IPv6 running on networks that have incomplete security controls
>> (firewall and IDS) for IPv6.    It basically describes what you need
>> to filter on to filter out IPv6 traffic and tunneling technologies.
>> This seems like mostly useful information, however its not clear to
>> me if you implement all the controls in the document if you would not
>> still have a problem form IPv6 on a local link 
> 
> This is discussed in the "native IPv6 section"
> 

[Joe] Yes.  I might have chosen to include a stronger statement about"you are not going to be able to filter out all IPv6 attacks" in the security considerations section, but the first paragraph pretty much says this.  

> 
>> or IPv6 tunneled
>> through some non-standard means.
> 
> How about adding this a the end of Section 3:
> 
> "We note that this document covers standardized IPv6 tunneling
> mechanisms, but does not aim to cover non-standard tunneling mechanisms
> nor that of IPsec-based or SSL/TLS-based tunneling of IPv6 packets".
> 

[Joe] OK

> ?
> 
> 
>> It seems the document should at
>> least mention this risk in the security considerations since hosts on
>> these networks may be IPv6 enabled.    One related issue I have seen
>> is in end host configuration where a host based firewall is
>> configured with IPv4 rules and left silent on IPv6 with varying
>> results.   I don't recall seeing any discussion of this in the
>> document, but it might also be worth covering in security
>> considerations as well.
> 
> Isn't this covered in the "native ipv6" section?

[Joe]  I was thinking of having some text that is a bit more host centric.   Currently the text reads more oriented towards network devices.  THere is some discussion on disabling IPv6 in extreme circumstances.  Would it be useful to recommend that IP filters on IPV6 end hosts be configured to apply controls to IPv6 as well as IPv4 since there is a fair chance that the hosts services may be listening on an IPv6 address as well?  

> 
> Thanks!
> 
> Best regards,
> -- 
> Fernando Gont
> SI6 Networks
> e-mail: [e-mail]
> PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
> 
> 
> 
>