Re: [secdir] Secdir review of draft-ietf-opsec-ipv6-implications-on-ipv4-nets-03

[Fernando Gont <[e-mail]>]

Hi, Joseph,

Thanks so much for your review! -- Please find my comments in-line....

On 04/16/2013 03:43 PM, Joseph Salowey (jsalowey) wrote:
> draft-ietf-opsec-ipv6-implications-on-ipv4-nets-03 discusses issues
> with IPv6 running on networks that have incomplete security controls
> (firewall and IDS) for IPv6.    It basically describes what you need
> to filter on to filter out IPv6 traffic and tunneling technologies.
> This seems like mostly useful information, however its not clear to
> me if you implement all the controls in the document if you would not
> still have a problem form IPv6 on a local link 

This is discussed in the "native IPv6 section"


> or IPv6 tunneled
> through some non-standard means.

How about adding this a the end of Section 3:

"We note that this document covers standardized IPv6 tunneling
mechanisms, but does not aim to cover non-standard tunneling mechanisms
nor that of IPsec-based or SSL/TLS-based tunneling of IPv6 packets".

?


> It seems the document should at
> least mention this risk in the security considerations since hosts on
> these networks may be IPv6 enabled.    One related issue I have seen
> is in end host configuration where a host based firewall is
> configured with IPv4 rules and left silent on IPv6 with varying
> results.   I don't recall seeing any discussion of this in the
> document, but it might also be worth covering in security
> considerations as well.

Isn't this covered in the "native ipv6" section?

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492