Re: [v4tov6transition] Ways to break IPv6

["Yiu L. Lee" <[e-mail]>]

This is expected behavior. Since IPv6 provides e2e connectivity, this is
required to enable FW by default. I think the FW is doing the right thing.
Despite the correct behavior, this will create a lot of confusion in the
beginning of launching IPv6. Education is needed to train the users to
realize the changes and this isn't going to be easy.


On 10/12/10 10:40 PM, "Ed Jankiewicz" <[e-mail]> wrote:

> 
>   this is not a surprise, it is something that has been predicted by
> many as one of the "growing pains" of IPv6 transition.  Firewalls and
> other security software will "support" IPv6 initially by just blocking
> it - too much work (and too little demand) for a real implementation.
> 
> Just loaded an updated version of the commercial anti-virus package that
> I've been using, let it remain nameless, it is certainly not the only
> offender in this area.  Unlike the previous version this includes an
> enhancement - it blocks all IPv6 and IPv6 over IPv4 traffic by default.
> The firewall rule can be disabled.
> 
> If you are a network operator, there is a lot of mischief that can be
> done by software that the end-user downloads onto their machines that
> can make IPv6 appear broken.  This is another area that should get some
> attention - how will customer service and help desk people be trained to
> deal with "connectivity" problems the user can cause themselves?
> 
> It took me a while to figure this out, and I'm one of the people who
> frequently predicted this would happen.  Imagine your average end-user
> who knows nothing about IPv6 and expects that "it just works".  Also,
> many books, websites and other security advice says "when in doubt, turn
> off IPv6".  At least in the foreseeable future, this will continue to be
> impedance against the uptake of IPv6.
>