IETF Logo Mail Archive

[v6ops] Re: rfc7084bis, L-21 Router Advertisement Guard

Ted Lemon <mellon@fugue.com> Fri, 07 November 2025 15:59 UTC

Return-Path: <mellon@fugue.com>
X-Original-To: v6ops@mail2.ietf.org
Delivered-To: v6ops@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id CFDDA856C5AC; Fri, 7 Nov 2025 07:59:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.798
X-Spam-Level:
X-Spam-Status: No, score=-2.798 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=fugue.com header.b="anFEIacX"; dkim=pass (2048-bit key) header.d=messagingengine.com header.b="dRnNHrWX"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IMw_t0enFulH; Fri, 7 Nov 2025 07:59:08 -0800 (PST)
Received: from fout-a1-smtp.messagingengine.com (fout-a1-smtp.messagingengine.com [103.168.172.144]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256)) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id B8244856C411; Fri, 7 Nov 2025 07:57:45 -0800 (PST)
Received: from phl-compute-02.internal (phl-compute-02.internal [10.202.2.42]) by mailfout.phl.internal (Postfix) with ESMTP id A413AEC0243; Fri, 7 Nov 2025 10:57:45 -0500 (EST)
Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-02.internal (MEProxy); Fri, 07 Nov 2025 10:57:45 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue.com; h=cc :cc:content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm1; t=1762531065; x=1762617465; bh=g69uRsfgpO kM4CRnOosOwd+7L+WPPfPHkG4so/EXQLU=; b=anFEIacX0f3DWufC5KEGIy1ofB dS5l5mBZR2U5+8RrWcLjLObUE5iET9U7ncuVPIhVgQMrwO/aqFQ1TmJBt7Io03Z4 9RkH97TSUWGr7vT2c36cE7Z/ZBIOwMKnuOes62SxPwfNytNxTxS4YXmZyzTPccnc ehBkZIY9LJY2p5G36pWL7KYMF6T5U931ZKRuyiE7wFD1izOj31iGf0YztmTlPsd0 u9fTDiCmEYNzNxUMQulFBunYzzEoPhU0NJp2HuD+UA/8vF113OeerdvlzVKOV71O L5a8koO2kbsf7PqsZ45IL/Dip3Hc9yBTK8wSq1V6/q1KBMrMu1tssDSTgPoQ==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t= 1762531065; x=1762617465; bh=g69uRsfgpOkM4CRnOosOwd+7L+WPPfPHkG4 so/EXQLU=; b=dRnNHrWXAVDy3UHbIGfHG/R2W1e7ozAQ73bPzL1mm8eE1XmTdqm Fniy7iddawEMmWOIHu5SGNyzaZEmlBVIUdZHjH8FtKXKEr988/HhgpfHeD8RkmTY BqazIqFZrhi/jzPPbBeSQmpjkZinP7jITI0MbjZJSSirvogxvyWdNbIXtMp2BnU8 mqMNUNcRewYraz4cmhn/ZurFctAV4KC0jfkrz1VV98AAto2CAIEChEamlf4afEk8 5Tv7q+WAsJLRTSY3IKWpvppaCI31Q7HBgJOo4irOua9JQ40QuU7N76oScKw41htJ onZpZIh6K6dZAoMCMN+U6xhIoXKLFdcAkRA==
X-ME-Sender: <xms:-RYOaW6DVG3MWtJDTxDfRzc1cVtzlcilFeY5J2wvzJsGUYuJsw_K4A> <xme:-RYOaazTS3a4P2VYJt26vJElPbv9qhXF0ksRngFg0zJ5fFydulxXuOdfsMWdcTIif gqSBoURIV3RLY-z1CsH5HjXCOfu9_wdpr6tCjx9r_nJjeo1vf3CYSU>
X-ME-Received: <xmr:-RYOadRoNCxTd5mPVwNfL4GpQ6uvaNPKGz8f5EaafngCbrGcRULrxtRv-z7W-ZzwrbSbFmXaTmDsI0i178J5jMr8jO8IZTJ-vO_-sQ>
X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtdeggdduledttdekucetufdoteggodetrf dotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfurfetoffkrfgpnffqhgenuceu rghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujf gurhephffktgggufffjgevvfhfofesrgdtmherhhdtjeenucfhrhhomhepvfgvugcunfgv mhhonhcuoehmvghllhhonhesfhhughhuvgdrtghomheqnecuggftrfgrthhtvghrnhepge euveeuhfdtgfejteelvedufeefgedvvdejieeiteekffekjefhvdfgvdegkeefnecuffho mhgrihhnpehivghtfhdrohhrghenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmh epmhgrihhlfhhrohhmpehmvghllhhonhesfhhughhuvgdrtghomhdpnhgspghrtghpthht ohepgedpmhhouggvpehsmhhtphhouhhtpdhrtghpthhtohepthhimhesqhgrtggrfhgvrd gtohhmpdhrtghpthhtohepuggrnhifihhnghesghhmrghilhdrtghomhdprhgtphhtthho pehviehophhssehivghtfhdrohhrghdprhgtphhtthhopegurhgrfhhtqdhivghtfhdqvh eiohhpshdqrhhftgejtdekgegsihhssehivghtfhdrohhrgh
X-ME-Proxy: <xmx:-RYOaRUo2dG_BjnwRmwqGOymoQRyryFSuazetNsiR1M3VoSBdunlVg> <xmx:-RYOafb89HXE5crPafKc-keHZ1kdWulubpQc1H2b4nXOg5tJrjwt0g> <xmx:-RYOaX3unYhBE5OmUCjAOuBOGnZkH5Z4sfDMn9EjbbwrWG-wp21L2w> <xmx:-RYOaRgnVZ8OuZSXBnM-YipxmXLglwv4wey5YLe8dsNg5ngYyGhe0Q> <xmx:-RYOacpy0M14qkv-FWW8tuCPL-EDX63Xo5OLD-0FnwRKiGf1wra4rrFw>
Feedback-ID: i1136489e:Fastmail
Received: by mail.messagingengine.com (Postfix) with ESMTPA; Fri, 7 Nov 2025 10:57:44 -0500 (EST)
From: Ted Lemon <mellon@fugue.com>
Message-Id: <62233FFF-72BE-4C1C-9662-145E462EBB01@fugue.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_CC46B77A-E540-43F4-B2BF-4796AEA6B23A"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.300.22\))
Date: Fri, 07 Nov 2025 16:57:13 +0100
In-Reply-To: <CAJgLMKtRpP4DzwuK0guoaHH8O5aecC00iYqPv_hNyc9Pnno1hw@mail.gmail.com>
To: Timothy Winters <tim@qacafe.com>
References: <AE2766CC-CEFB-4E6A-827C-2DDFEFDFD33C@gmail.com> <CAJgLMKtRpP4DzwuK0guoaHH8O5aecC00iYqPv_hNyc9Pnno1hw@mail.gmail.com>
X-Mailer: Apple Mail (2.3864.300.22)
Message-ID-Hash: RWQQLRKELJ44G7NDYTNJTHFSU6OVRALV
X-Message-ID-Hash: RWQQLRKELJ44G7NDYTNJTHFSU6OVRALV
X-MailFrom: mellon@fugue.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-v6ops.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Dan Wing <danwing@gmail.com>, v6ops list <v6ops@ietf.org>, draft-ietf-v6ops-rfc7084bis@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [v6ops] Re: rfc7084bis, L-21 Router Advertisement Guard
List-Id: v6ops discussion list <v6ops.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/v6ops/2uwQ81G__NuXVQons0N199fFDa8>
List-Archive: <https://mailarchive.ietf.org/arch/browse/v6ops>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Owner: <mailto:v6ops-owner@ietf.org>
List-Post: <mailto:v6ops@ietf.org>
List-Subscribe: <mailto:v6ops-join@ietf.org>
List-Unsubscribe: <mailto:v6ops-leave@ietf.org>

This isn't actually entirely accurate. RA on an unmanaged network just doesn't make sense, because the unmanaged device imposing the filtering has no way of establishing which RAs are legitimate and which are not. SNAC routers are an example of this, but so are backup routers. RA Guard is only appropriate in a managed environment, so it's simply out of scope for CE routers.

> On Nov 7, 2025, at 16:44, Timothy Winters <tim@qacafe.com> wrote:
> 
> Hi Dan,
> 
> This came from a requirement of snac-simple that sends Router Advertisements out, if they are blocked it causes an issue.
> 
> https://datatracker.ietf.org/doc/html/draft-ietf-snac-simple-08#appendix-B
> 
> ~Tim
> 
> On Fri, Nov 7, 2025 at 10:41 AM Dan Wing <danwing@gmail.com <mailto:danwing@gmail.com>> wrote:
>> I noticed https://datatracker.ietf.org/doc/html/draft-ietf-v6ops-rfc7084bis-04 added:
>> 
>>   L-21: The IPv6 CE Router MUST NOT enable IPv6 Router Advertisement Guard, [RFC6105], by default.
>> 
>> Malicious RA's can be harmful to other hosts on the network.  What was the reason for prohibiting RA Guard?
>> 
>> 
>> (I searched v6ops and couldn't find an earlier discussion of this addition.  My apologies if my search was inadequate.)
>> 
>> -d
>> 
> _______________________________________________
> v6ops mailing list -- v6ops@ietf.org
> To unsubscribe send an email to v6ops-leave@ietf.org

v2.46.0 | Report a Bug | By Email | System Status