Re: [v6ops] draft-xiao-v6ops-nd-deployment-guidelines discussion

Hi Nick,

Thank you very much for the review and suggestion.  We will incorporate them in the next revision.

XiPeng 

-----Original Message-----
From: Nick Buraglio <buraglio@es.net> 
Sent: Saturday, August 27, 2022 5:33 PM
To: Xipengxiao <xipengxiao@huawei.com>
Cc: Gyan Mishra <hayabusagsm@gmail.com>; Fred Baker <fredbaker.ietf@gmail.com>; v6ops list <v6ops@ietf.org>; Brian E Carpenter <brian.e.carpenter@gmail.com>
Subject: Re: [v6ops] draft-xiao-v6ops-nd-deployment-guidelines discussion

As requested here are my notes from the draft:

------

Section 1. Host isolation is not particularly well understood, this is a good breakdown.
---
Section 2.2:
Suggest rewording to ".....causing a victim's address configuration procedure to fail causing a denial of service to the host in question."

Suggest rewording :
Forged RAs: an attacker can send RAs to other hosts to claim to  be a router and also preempt the real router resulting in a redirect attack.
Forged Redirects: an attacker can pretend to be the router and send Redirects to other hosts to redirect their traffic to the router to itself resulting in a Redirect attack.

---
Section 2.3:
Suggest rewording: "The way ND does address resolution" to "The manner in which ND performs address resolution"

---
Section 3.2
FBBv6-P2MP bullet 2
Suggest re-wording: Trusting-all-host is only relevant to the router.
By applying some simple filtering at the router, e.g dropping RAs from the host, even malicious hosts cannot participate in most hijack attacks involved forged and erroneous RA or redirect attacks. --It further clarifies the benefit rather than a more general "security harm" statement that may not be universally accurate.

---
Section 3.3
Is it worthwhile to provide some of the details here? "RFC 8273 solves other ND issues discussed in Section 2."

----
nb

On Thu, Aug 25, 2022 at 12:00 PM Nick Buraglio <buraglio@es.net> wrote:
>
> Definitely agree that this is an important topic. I read over the 
> draft and believe it is a useful document that outlines the issues and 
> provides a roadmap for solutions. I have a few readability suggestions 
> in my notes, if there is interest. I support adoption - these are 
> real-world problems and solutions in a consumable and useful format.
>
>
> ----
> nb
>
> On Wed, Aug 24, 2022 at 4:48 PM Brian E Carpenter 
> <brian.e.carpenter@gmail.com> wrote:
> >
> > I agree on the importance of the topic. I don't have the time or expertise to comment in detail, but this is a topic the WG should tackle.
> >
> > Regards
> >     Brian Carpenter
> >
> > On 24-Aug-22 18:35, Gyan Mishra wrote:
> > >
> > >
> > > This draft had a tremendous amount of useful and highly valuable information for any operators looking at L2 and L3 host isolation.
> > >
> > > I support this work and I believe this work is ready for an adoption call.
> > >
> > > Kind Regards
> > >
> > > Gyan
> > > On Mon, Aug 22, 2022 at 11:01 AM Fred Baker <fredbaker.ietf@gmail.com <mailto:fredbaker.ietf@gmail.com>> wrote:
> > >
> > >     At IETF 114, XiPeng discussed the use of host isolation in the network to improve host behavior, and there was a discussion. Opinions?
> > >     _______________________________________________
> > >     v6ops mailing list
> > >     v6ops@ietf.org <mailto:v6ops@ietf.org>
> > >     https://www.ietf.org/mailman/listinfo/v6ops 
> > > <https://www.ietf.org/mailman/listinfo/v6ops>
> > >
> > > --
> > >
> > > <http://www.verizon.com/>
> > >
> > > *Gyan Mishra*
> > >
> > > /Network Solutions A//rchitect /
> > >
> > > /Email gyan.s.mishra@verizon.com 
> > > <mailto:gyan.s.mishra@verizon.com>//
> > > /
> > >
> > > /M 301 502-1347
> > >
> > > /
> > >
> > >
> > >
> > > _______________________________________________
> > > v6ops mailing list
> > > v6ops@ietf.org
> > > https://www.ietf.org/mailman/listinfo/v6ops
> >
> > _______________________________________________
> > v6ops mailing list
> > v6ops@ietf.org
> > https://www.ietf.org/mailman/listinfo/v6ops