IETF Logo Mail Archive

Re: [v6ops] new draft: draft-ietf-v6ops-6204bis

"Hemant Singh (shemant)" <shemant@cisco.com> Tue, 18 October 2011 18:59 UTC

Return-Path: <shemant@cisco.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF38521F8C76 for <v6ops@ietfa.amsl.com>; Tue, 18 Oct 2011 11:59:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.737
X-Spam-Level:
X-Spam-Status: No, score=-5.737 tagged_above=-999 required=5 tests=[AWL=0.862, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DrjLOgMv+dC3 for <v6ops@ietfa.amsl.com>; Tue, 18 Oct 2011 11:59:45 -0700 (PDT)
Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by ietfa.amsl.com (Postfix) with ESMTP id 0575E21F8BDB for <v6ops@ietf.org>; Tue, 18 Oct 2011 11:59:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=shemant@cisco.com; l=1844; q=dns/txt; s=iport; t=1318964385; x=1320173985; h=mime-version:content-transfer-encoding:subject:date: message-id:in-reply-to:references:from:to:cc; bh=JSPT6NSoxLXUZPL9x1BDSG5A38xDalUNNMSbauIfQHk=; b=Jhz1iVS1MIk3E5dxPuNCRpOm+X8zzOt+mjQGGq37CTVC0q97y0dX37yt +BxYq5C1vkpzmUNU5ZEicTWubYXYDg8u5wjz6f+KLU26jTEzKqAquSxj2 eMgQM+HOU6U3+FqGupd6ovFdRzatyDpV1C87xrkFUdfkDsszwf27m3yRX E=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: ArUAAMjLnU6tJXHB/2dsb2JhbABEhHWUSY40fIEFgW4BAQEEEgEQBAkERRACAQgOAwQBAQMCBgYXAQICAgEBRAkIAQEEEwgan1UBjEeSG4EwhVczYQSIApEujEE
X-IronPort-AV: E=Sophos;i="4.69,366,1315180800"; d="scan'208";a="29301537"
Received: from rcdn-core2-6.cisco.com ([173.37.113.193]) by rcdn-iport-6.cisco.com with ESMTP; 18 Oct 2011 18:59:44 +0000
Received: from xbh-rcd-201.cisco.com (xbh-rcd-201.cisco.com [72.163.62.200]) by rcdn-core2-6.cisco.com (8.14.3/8.14.3) with ESMTP id p9IIxiQW011597; Tue, 18 Oct 2011 18:59:44 GMT
Received: from xmb-rcd-109.cisco.com ([72.163.62.151]) by xbh-rcd-201.cisco.com with Microsoft SMTPSVC(6.0.3790.4675); Tue, 18 Oct 2011 13:59:44 -0500
X-Mimeole: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: base64
Date: Tue, 18 Oct 2011 13:59:43 -0500
Message-ID: <5B6B2B64C9FE2A489045EEEADDAFF2C303130B54@XMB-RCD-109.cisco.com>
In-Reply-To: <4E994515.6020204@forthnetgroup.gr>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: [v6ops] new draft: draft-ietf-v6ops-6204bis
Thread-Index: AcyLFP1s4hjs5XCVS1Gwa28pyF7QIwCsbYsg
References: <4E974F1A.2030008@forthnetgroup.gr> <5B6B2B64C9FE2A489045EEEADDAFF2C3030A4156@XMB-RCD-109.cisco.com> <5B6B2B64C9FE2A489045EEEADDAFF2C303130390@XMB-RCD-109.cisco.com> <4E98CCB2.2050100@forthnetgroup.gr> <5B6B2B64C9FE2A489045EEEADDAFF2C3031303D8@XMB-RCD-109.cisco.com> <4E994515.6020204@forthnetgroup.gr>
From: "Hemant Singh (shemant)" <shemant@cisco.com>
To: Tassos Chatzithomaoglou <achatz@forthnetgroup.gr>
X-OriginalArrivalTime: 18 Oct 2011 18:59:44.0266 (UTC) FILETIME=[193326A0:01CC8DC8]
Cc: v6ops@ietf.org, draft-ietf-v6ops-6204bis@tools.ietf.org
Subject: Re: [v6ops] new draft: draft-ietf-v6ops-6204bis
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/v6ops>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 18 Oct 2011 18:59:45 -0000

Tassos,

Sorry for the delayed reply.   Please see below.

From: Tassos Chatzithomaoglou [mailto:achatz@forthnetgroup.gr] 
Sent: Saturday, October 15, 2011 4:32 AM
To: Hemant Singh (shemant)
Cc: v6ops@ietf.org; draft-ietf-v6ops-6204bis@tools.ietf.org
Subject: Re: [v6ops] new draft: draft-ietf-v6ops-6204bis


>I gave it a second thought and i'm thinking that without port forwarding the chances of needing a firewall for decapsulated IPv4 traffic is low in case of DS->Lite. RFC 4863 describes very nicely the perceived benefits of NAT (which on this case will happen on the AFTR), and since we are not (are we?) including any >reference to port forwarding mechanisms, IPv4 attack vectors to the CPE through >DS-Lite are low (but existent).

If DS-Lite is enabled on the CE router, NAT has to be disabled on the CE router.  If there is no NAT running on the CE router, then port forwarding is not relevant. 

>On the other hand, in the 6rd scenario, there is no (need for) NAT happening on IPv6 traffic on the BR, so an IPv6 firewall for filtering ingress decapsulated >IPv4=>IPv6 traffic on the CPE is surely needed. Maybe, you would like to differentiate those scenarios in your text.

Certainly, we will mull over this suggestion and if we think text needs to be added, we will send out the text soon.

Regards,

Hemant

v2.23.0 | Report a Bug | By Email