Re: [v6ops] RA-Guard: Advice on the implementation (feedback requested)

It is useful for my current deployment.
I like this document in general, will discuss more details with Fernando.

Sent from my iPhone

On Feb 1, 2012, at 4:45 PM, "Fernando Gont" <fgont@si6networks.com> wrote:

> Folks,
> 
> We have just published a revision of our I-D "Implementation Advice for
> IPv6 Router Advertisement Guard (RA-Guard)"
> <http://tools.ietf.org/id/draft-gont-v6ops-ra-guard-implementation-01.txt>.
> 
> In essence, this is the problem statement, and what this I-D is about:
> 
> * RA-Guard is essential to have feature parity with IPv4.
> 
> * Most (all?) existing RA-Guard implementations can be trivially evaded:
> if the attacker includes extension headers in his packets, the RA-Guard
> devices fail to identify the Router Advertisement messages. -- For
> instance, THC's "IPv6 attack suite" (<http://www.thc.org/thc-ipv6/>)
> contains tools that can evade RA-Guard as indicated.
> 
> * The I-D discusses this problem, and provides advice on how to
> implement RA-Guard, such that the aforementioned vulnerabilities are
> eliminated, we have an effective RA-Guard device, and hence
> feature-parity with IPv4.
> 
> We'd like feedback on this I-D, including high-level comments on whether
> you support the proposal in this I-D.
> 
> Thanks!
> 
> Best regards,
> -- 
> Fernando Gont
> SI6 Networks
> e-mail: fgont@si6networks.com
> PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
> 
> 
> 
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops