IETF Logo Mail Archive

RE: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03

"Dan Wing" <dwing@cisco.com> Tue, 26 August 2008 00:30 UTC

Return-Path: <owner-v6ops@ops.ietf.org>
X-Original-To: ietfarch-v6ops-archive@core3.amsl.com
Delivered-To: ietfarch-v6ops-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EA1EF28C104 for <ietfarch-v6ops-archive@core3.amsl.com>; Mon, 25 Aug 2008 17:30:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.185
X-Spam-Level:
X-Spam-Status: No, score=-4.185 tagged_above=-999 required=5 tests=[AWL=0.310, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4, RDNS_NONE=0.1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G3C3TWEy7eW7 for <ietfarch-v6ops-archive@core3.amsl.com>; Mon, 25 Aug 2008 17:30:42 -0700 (PDT)
Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id DECC93A6A7E for <v6ops-archive@lists.ietf.org>; Mon, 25 Aug 2008 17:30:41 -0700 (PDT)
Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from <owner-v6ops@ops.ietf.org>) id 1KXmRV-000KjN-0L for v6ops-data@psg.com; Tue, 26 Aug 2008 00:29:53 +0000
Received: from [171.71.176.117] (helo=sj-iport-6.cisco.com) by psg.com with esmtps (TLSv1:RC4-SHA:128) (Exim 4.69 (FreeBSD)) (envelope-from <dwing@cisco.com>) id 1KXmRQ-000Kfk-Bv for v6ops@ops.ietf.org; Tue, 26 Aug 2008 00:29:50 +0000
X-IronPort-AV: E=Sophos;i="4.32,266,1217808000"; d="scan'208";a="146301911"
Received: from sj-dkim-2.cisco.com ([171.71.179.186]) by sj-iport-6.cisco.com with ESMTP; 26 Aug 2008 00:29:47 +0000
Received: from sj-core-1.cisco.com (sj-core-1.cisco.com [171.71.177.237]) by sj-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id m7Q0Tl3v013315; Mon, 25 Aug 2008 17:29:47 -0700
Received: from dwingwxp01 ([10.32.240.194]) by sj-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id m7Q0TlGA024084; Tue, 26 Aug 2008 00:29:47 GMT
From: Dan Wing <dwing@cisco.com>
To: 'Truman Boyes' <truman@suspicious.org>, 'Brian E Carpenter' <brian.e.carpenter@gmail.com>
Cc: 'Mark Smith' <ipng@69706e6720323030352d30312d31340a.nosense.org>, jhw@apple.com, 'IPv6 Operations' <v6ops@ops.ietf.org>
References: <20080824204553.08131c65.ipng@69706e6720323030352d30312d31340a.nosense.org> <48B1CCE8.1070305@gmail.com> <01af01c9065b$b4602440$c2f0200a@cisco.com> <48B23391.1090503@gmail.com> <01cd01c90672$a57c8790$c2f0200a@cisco.com> <48B31DA3.6080001@gmail.com> <07d201c906f7$50a85e30$c2f0200a@cisco.com> <48B32B43.5010103@gmail.com> <084c01c906fe$f9bf1840$c2f0200a@cisco.com> <48B33430.40704@gmail.com> <A31EB889-2BD9-4283-A408-AB6DCC1D568A@suspicious.org>
Subject: RE: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03
Date: Mon, 25 Aug 2008 17:29:47 -0700
Message-ID: <08be01c90712$d876cd40$c2f0200a@cisco.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook 11
Thread-Index: AckHEhRoRb4NMUH9SSCAJRZ4jyqgDAAAJt9g
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
In-Reply-To: <A31EB889-2BD9-4283-A408-AB6DCC1D568A@suspicious.org>
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=696; t=1219710587; x=1220574587; c=relaxed/simple; s=sjdkim2002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=dwing@cisco.com; z=From:=20=22Dan=20Wing=22=20<dwing@cisco.com> |Subject:=20RE=3A=20Some=20suggestions=20for=20draft-ietf-v 6ops-cpe-simple-security-03 |Sender:=20; bh=nJZIMU2FOGdp+gsiqMS3KvYiXZJ2ZIPUYhyoCgvD/uk=; b=aRpDg8BBoyLPiXHsFSXTVDKzQbdMnmZYYnsxE0Myk6/4nh/oWf61M5rInx LDQMUt2j6WXar776PiEJCTs3Kec+RkiT8+fmfWyPkekZUDjSfxxulHN0liUP B69t4YjOnl;
Authentication-Results: sj-dkim-2; header.From=dwing@cisco.com; dkim=pass ( sig from cisco.com/sjdkim2002 verified; );
Sender: owner-v6ops@ops.ietf.org
Precedence: bulk
List-ID: <v6ops.ops.ietf.org>

> On 25/08/2008, at 6:37 PM, Brian E Carpenter wrote:
> > But blocking tunnels by default, although it's simple, also
> > blocks innovation. That worries me.
> >
> >    Brian
> 
> I agree with this stance. Blocking tunnels, although possibly more  
> secure is going to make it very difficult to solve real world  
> problems. We have enough trouble today with IPv4 Port forwarding in  
> CPEs and the fact that some devices do not by default pass VPN  
> traffic. I believe internal to external tunnel flow/solicitation  
> should be permitted by default.

Internalt to external is permitted, by default, in the current document.

We are discussing external to internal.  

-d

v2.23.0 | Report a Bug | By Email