Re: [v6ops] I-D Action: draft-ietf-v6ops-balanced-ipv6-security-00.txt

Here are the main changes based on the Berlin meeting discussion:

In order to avoid that this document appears as an IETF 'blessing' of a specific ACL (or layer-4 ports), a lot of verbiage has been added to show the list as EXAMPLE and we have removed all 'proposals' and 'recommend' in favor of the word 'example'.

We kept the list of ports as an example but clearly mentioned that this list was based on known vulnerabilities in protocols (e.g. Telnet is in the clear) or implementations (still some worms active on 445 for old Windows implementations). Again, examples.

Another generic rule was added to allow for remote management (in the case of managed CPE).

A mention is also added about whether to do stateless or stateful filtering is not that relevant for this I-D as its only objective is to give an example of what a SP did.

As a side note, Ragnar (a co-author) has presented this approach at the RIPE meeting => several positive discussions

> -----Original Message-----
> From: v6ops-bounces@ietf.org [mailto:v6ops-bounces@ietf.org] On Behalf Of
> internet-drafts@ietf.org
> Sent: lundi 21 octobre 2013 19:19
> To: i-d-announce@ietf.org
> Cc: v6ops@ietf.org
> Subject: [v6ops] I-D Action: draft-ietf-v6ops-balanced-ipv6-security-
> 00.txt
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
>  This draft is a work item of the IPv6 Operations Working Group of the
> IETF.
> 
> 	Title           : Balanced Security for IPv6 Residential CPE
> 	Author(s)       : Martin Gysi
>                           Guillaume Leclanche
>                           Eric Vyncke
>                           Ragnar Anfinsen
> 	Filename        : draft-ietf-v6ops-balanced-ipv6-security-00.txt
> 	Pages           : 7
> 	Date            : 2013-10-21
> 
> Abstract:
>    This document describes how an IPv6 residential Customer Premise
>    Equipment (CPE) can have a balanced security policy that allows for a
>    mostly end-to-end connectivity while keeping the major threats
>    outside of the home.  It is based on an actual IPv6 deployment by
>    Swisscom and allows all packets inbound/outbound EXCEPT for some
>    layer-4 ports where attacks and vulnerabilities (such as weak
>    passwords) are well-known.  The blocked inbound ports is expected to
>    be updated as threats come and go.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-v6ops-balanced-ipv6-security
> 
> There's also a htmlized version available at:
> http://tools.ietf.org/html/draft-ietf-v6ops-balanced-ipv6-security-00
> 
> 
> Please note that it may take a couple of minutes from the time of
> submission until the htmlized version and diff are available at
> tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops