Re: [v6ops] Possible issue with source address selection for ULAs...

[Mark Smith <[e-mail]>]

Hi Eduard,

On Wed, 19 Jan 2022 at 20:35, Vasilenko Eduard
<[e-mail]> wrote:
>
> Hi Mark,
>
> This is a good argument that ULA filtering is already activated by default on all interfaces. Hence, ULA is more secure for the closed domain.
>
> Indeed, a Firewall is more secure because everything is “deny” by default. It is considered a big part of Firewall security.
>
> The discussion about DDoS or other security problems (for example, all other types of attacks) could be much longer in this case - your list is not full.
>

All I have to do to disprove your argument that ULAs aren't useful for
carriers is provide a use case where they are. I have done that.

Which is the better operational situation, providing highest service
robustness and reliability:

- receive DDoS traffic from the Internet to a GUA address on an
infrastructure service, and then have to configure filters to drop it

- not receive DDoS traffic from the Internet to a ULA address on an
infrastructure service in the first place, because the Internet by its
nature doesn't route the ULA address space.

Erasmus answered this question 500 years ago - prevention is better than cure.

>
>
> But is it really the case?
>

Yes.

>
>
> Is this a mistake that people are trying to add “ULA deny” to the list of Martian’s deny?
>
> https://6session.wordpress.com/2009/04/08/ipv6-martian-and-bogon-filters/
>
> Why they are doing it for routers? You said that it is already there.
>
>

I did not say it was already there, although RFC4193 actually requires
it, see 4.1.

I said that ULAs aren't intended to be routed over the Internet. The
default nature of the Internet (as in the default nature of the
majority of ASes that make up the Internet) is not to route ULAs,
either the prefixes or packets with them as SAs and DAs. This is
because many network operators filter routes and also filter packets.
They're not trying to actively make ULAs work over the Internet,
unlike the GUA space.

Most network operators know that vendors don't always implement what
they should, so we put in place things like martin and bogon filters
against route announcements. That's far easier to do with IPv6 -
permit  route announcements in 2000::/3, drop everything else.

>
> I have found a few references of different vendors that “ULAs are treated as regular global addresses. The router configuration filters ULA prefixes to prevent them from appearing in the public domain”.
>
>
>
> I have found a discussion that ULA is good because one does not need to change the manual filter compared to the case of dynamic PA GUA
>
> https://datatracker.ietf.org/doc/html/draft-ietf-v6ops-ula-usage-recommendations
>
>
>
> Good comment about ULA not traversing many internet hops: (yet again, assuming someone in the path cares at least a bit about security)
>
> https://blog.ipspace.net/2013/11/dont-use-ula-addresses-in-service.html
>
>
>
> The administrator will configure the router ACLs to restrict IP addresses that contain any Unique Local Unicast addresses
>
> https://www.stigviewer.com/stig/perimeter_router_juniper/2018-11-28/finding/V-14703
>
>
>
> It is evident, that everybody assumes that ULA filtering is manual. It is difficult to search for a black cat in the black room.
>
> Hence, could you reference the particular router that has “deny ULA” on some or all interfaces by default? (probably FC::)
>
> Because in this case vendor should have a reminder not to forget to add a separate permit for the situation when ULA is needed (with probably a longer mask).
>
> You may know the router that has put ULA in default deny. But it is very expensive for other people to find it.
>
> I strongly suspect that the majority of routers have a default “permit” for ULA.
>
>
>
> Hence, again: if one needs to filter infrastructure prefix manually then no advantage for ULA against GUA.
>
> The same human mistake is the same probable.
>
> ULA is good only because one does not need to go to RIR. It is not applicable for Carriers.
>

You forgot, "in my opinion".

I work for a carrier (and have worked for a number of them), ULAs are
useful to us for the reasons explained. (Many carriers have used
RFC1918s for internal only services, so this is far from a new idea).

Regards,
Mark.

>
>
> Eduard
>
> From: ipv6 [mailto:[e-mail]] On Behalf Of Mark Smith
> Sent: Wednesday, January 19, 2022 7:17 AM
> To: Vasilenko Eduard <vasilenko.eduard=[e-mail]>
> Cc: IPv6 Ops WG <[e-mail]>; Fernando Gont <fernando.gont=[e-mail]>; 6man WG <[e-mail]>
> Subject: Re: [v6ops] Possible issue with source address selection for ULAs...
>
>
>
>
>
> On Wed, 19 Jan 2022, 00:11 Vasilenko Eduard, <vasilenko.eduard=[e-mail]> wrote:
>
> Hi Fernando,
> Sorry, I do not understand why the filtering of 2 IPv6 prefixes has any difference.
> Mask would be probably different for GUA (that Carrier devoted for infrastructure) and ULA (always /48),
> but mask looks like not a problem.
> The number of filters is the same (by the number of ports).
> Why ULA segregation is better for Carrier? The Special GUA prefix looks the same effective.
>
>
>
> It isn't.
>
>
>
> ULAs aren't reachable from the Internet, that's they're default nature. Use ULAs for internal only infrastructure services, then they're Internet DDoS proof by default.
>
>
>
> As RFC5505 says, "what can be configured can be misconfigured".
>
>
>
> Filtering GUAs is trying to take away default Internet reachability, and there is room for misconfiguration.
>
>
>
> With ULA addressing there is no default Internet reachability in the first place, and no configuration required to take away something that never existed.
>
>
>
> We're about to use ULA addressing been our BNGs and DHCPv6 servers for the DHCPv6 traffic so the DHCPv6 service can't be DDoS'd from the Internet. We're also going to put in 2000::/3 only DA filters on customers so they can't DDoS them either (less of a risk because of the customers' vested interest in the service being available, however simple to do, so may as well.)
>
>
>
> Everything doesn't have to be on the Internet just because you have enough address space to easily do so.
>
>
>
> Regards,
>
> Mark.
>
>
>
>
> IMHO:
> - the carrier has no problem reserving a special GUA prefix for infrastructure
> - no difference for carrier what prefix to filter on the perimeter (if it is needed in principle).
>
> Hence, I am questioning the only claimed advantage of ULA for Carrier's infrastructure.
> For disadvantages, I have presented the list before.
>
> ULA has an advantage for small entities that do not want to deal with RIR. These are not Carrier!
> Eduard
> -----Original Message-----
> From: Fernando Gont [mailto:fernando.gont=[e-mail]]
> Sent: Tuesday, January 18, 2022 2:38 PM
> To: Vasilenko Eduard <[e-mail]>; 6man WG <[e-mail]>
> Cc: IPv6 Ops WG <[e-mail]>
> Subject: Re: [v6ops] Possible issue with source address selection for ULAs...
>
> Hi, Eduard,
>
> On 18/1/22 08:24, Vasilenko Eduard wrote:
> > I did not say about depreciation. For sure not.
>
> What I mean is that there seems to be a group of people being very vocal about how bad ULAs are (which is probably the reason why we never got guidance on ULAs). But my take is that if they are so bad, they should be deprecated. But if they are not, guidance should be provided.
>
>
> > ULA is good when a small company does not want to deal with RIR (it is not about big carriers).
>
> And probably also good if you need/want stable addressing within your home network.
>
>
> > ULA+NPT is the only currently working mechanism for small businesses to get redundancy from 2 PA Carriers.
> > The context was about big Carrier infrastructure, not Enterprise, not Home network.
>
> Sorry, I missed the context.  That said, as noted, it may be of use in cloud infrastructure.
>
>
>
> > Fernando,
> > Could you elaborate a bit more why in an attempt to emulate closed
> > domain
>
> That's exactly the point: when you use ULAs for certain services (say, some admin interfaces), you somewhat declare the part of a closed domain. And that's another layer of protection -- e.g., you're filters failed for some reason, but since you;re using GUAs, you are not fully exposed to the 'net.
>
> Thanks,
> --
> Fernando Gont
> Director of Information Security
> EdgeUno
> PGP Fingerprint: DFBD 63E3 B248 AE79 C598 AF23 EBAE DA03 0644 1531
>
>
>
>
> “This communication is the property of EdgeUno or one of its group companies and/or affiliates. This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and if you are not the intended recipient be aware that any non-explicitly authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, and will be considered a criminal offense. Please notify [e-mail] about the unintended receipt of this electronic message and delete it.”
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------