Re: [v6ops] Operational Implications of IPv6 Packets with Extension Headers - Security as Functionality

[Vasilenko Eduard <[e-mail]>]

There is no any restriction in the name of this draft that "Enterprises should not read this draft".
Put this restriction, then I would agree that FW is out.

Something like "Operational Implications of IPv6 Packets with Extension Headers in Telco environment".

-----Original Message-----
From: Fernando Gont [mailto:[e-mail]] 
Sent: 27 июля 2020 г. 12:25
To: Vasilenko Eduard <[e-mail]>; IPv6 Operations <[e-mail]>
Cc: [e-mail]
Subject: Re: Operational Implications of IPv6 Packets with Extension Headers - Security as Functionality

Hello, Edward,

On 27/7/20 05:57, Vasilenko Eduard wrote:
> Hi Fernando,
> Security is sometimes functionality, not vulnerability or attack vector. The good example is Firewall. Firewall needs to parse all headers to be useful.
> Hence, I believe it is in the logic of this draft to have section 
> 5.1.5: one additional "use case" when parsing of ALL headers are 
> mandatory. FW, IDPS

It's indeed normally necessary for a firewall to parse all headers, and certainly this might be a motivation to drop packets at the edge of the network.

However, I'm not sure if it would make sense to cover IDPS/FW in this I-D, since we're mostly discussing the reasons for operators (as opposed to say, sys admins or security administrators) to drop them.

What do folks think?

Thanks,
--
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492