IETF Logo Mail Archive

Re: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03

Truman Boyes <truman@suspicious.org> Tue, 26 August 2008 00:25 UTC

Return-Path: <owner-v6ops@ops.ietf.org>
X-Original-To: ietfarch-v6ops-archive@core3.amsl.com
Delivered-To: ietfarch-v6ops-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 545A53A69E5 for <ietfarch-v6ops-archive@core3.amsl.com>; Mon, 25 Aug 2008 17:25:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -97.481
X-Spam-Level:
X-Spam-Status: No, score=-97.481 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HOST_EQ_MINDSPRING=2.2, HOST_EQ_MODEMCABLE=1.368, HOST_MISMATCH_COM=0.311, IP_NOT_FRIENDLY=0.334, RCVD_IN_PBL=0.905, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VnLyUhrsRWXr for <ietfarch-v6ops-archive@core3.amsl.com>; Mon, 25 Aug 2008 17:25:09 -0700 (PDT)
Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id 8ADE33A685A for <v6ops-archive@lists.ietf.org>; Mon, 25 Aug 2008 17:25:09 -0700 (PDT)
Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from <owner-v6ops@ops.ietf.org>) id 1KXmLy-000JmG-RE for v6ops-data@psg.com; Tue, 26 Aug 2008 00:24:10 +0000
Received: from [2001:470:1f06:248::2] (helo=dns.suspicious.org) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from <truman@suspicious.org>) id 1KXmLu-000Jlh-OE for v6ops@ops.ietf.org; Tue, 26 Aug 2008 00:24:08 +0000
Received: from [10.0.1.199] (user-12lcjih.cable.mindspring.com [69.86.78.81]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by dns.suspicious.org (Postfix) with ESMTP id DDC3D5C6; Mon, 25 Aug 2008 20:24:03 -0400 (EDT)
Cc: Dan Wing <dwing@cisco.com>, 'Mark Smith' <ipng@69706e6720323030352d30312d31340a.nosense.org>, jhw@apple.com, 'IPv6 Operations' <v6ops@ops.ietf.org>
Message-Id: <A31EB889-2BD9-4283-A408-AB6DCC1D568A@suspicious.org>
From: Truman Boyes <truman@suspicious.org>
To: Brian E Carpenter <brian.e.carpenter@gmail.com>
In-Reply-To: <48B33430.40704@gmail.com>
Content-Type: text/plain; charset="US-ASCII"; format="flowed"; delsp="yes"
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v926)
Subject: Re: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03
Date: Mon, 25 Aug 2008 20:23:58 -0400
References: <20080824204553.08131c65.ipng@69706e6720323030352d30312d31340a.nosense.org> <48B1CCE8.1070305@gmail.com> <01af01c9065b$b4602440$c2f0200a@cisco.com> <48B23391.1090503@gmail.com> <01cd01c90672$a57c8790$c2f0200a@cisco.com> <48B31DA3.6080001@gmail.com> <07d201c906f7$50a85e30$c2f0200a@cisco.com> <48B32B43.5010103@gmail.com> <084c01c906fe$f9bf1840$c2f0200a@cisco.com> <48B33430.40704@gmail.com>
X-Mailer: Apple Mail (2.926)
Sender: owner-v6ops@ops.ietf.org
Precedence: bulk
List-ID: <v6ops.ops.ietf.org>

On 25/08/2008, at 6:37 PM, Brian E Carpenter wrote:
> But blocking tunnels by default, although it's simple, also
> blocks innovation. That worries me.
>
>    Brian

I agree with this stance. Blocking tunnels, although possibly more  
secure is going to make it very difficult to solve real world  
problems. We have enough trouble today with IPv4 Port forwarding in  
CPEs and the fact that some devices do not by default pass VPN  
traffic. I believe internal to external tunnel flow/solicitation  
should be permitted by default.

Truman

v2.23.0 | Report a Bug | By Email