Re: [secdir] SecDir Review of draft-ietf-opsec-dhcpv6-shield

[Fernando Gont <[e-mail]>]

Hi, Hannes,

Thanks so much for your feedback! Please find my comments in-line....

On 12/05/2014 07:47 AM, Hannes Tschofenig wrote:
> 
> The document is well-written and I don't see any problems with the 
> write-up. While specifying packet filtering firewall rules is an 
> implementation / configuration dependent task that does not
> require standardization as such this work follows earlier patterns,
> namely the RA-Guard mechanism for the protection against rogue
> router advertisements.

Other than following earlier patterns, the goal is to avoid
implementation flaws (such as those described in RFC7113.



> The only question I have whether the document type (currently set
> to 'Best Current Practice') is appropriate.

The idea is that this document specifies the best current way of
implementing the filtering rules for such packets




> PS: Minor editorial nit:
> 
> " Finally, we note that the security of a site employing DHCPv6
> Shield could be further improved by deploying [I-D.ietf-savi-dhcp],
> to mitigate IPv6 address. spoofing attacks. ^^^ "

Will do.

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492