Re: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-prefix-per-host-08.txt

[Lorenzo Colitti <[e-mail]>]

In reality I suspect that that is, in fact, the current IETF best practice.
That the ways I see to implement that sort of security are to 1) have
different hosts share one prefix, but keep track of which IP addresses
belong to which hosts or 2) have different hosts on different prefixes. In
the presence of hostile actors, #1 is very expensive to build while meeting
the recommendations in RFC 7934.

On Mon, Oct 9, 2017 at 10:16 PM, Fred Baker <[e-mail]>
wrote:

> Unless someone wants to tell me I'm wrong, I don't think that consensus
> exists. What the document says is that when someone is running a service
> such as described, traffic from the CPE router to which a prefix has been
> delegated should invariably travel through the upstream router as opposed
> to directly to a router that might appear to be an immediate neighbor. It
> doesn't deprecate the use of SLAAC/DHCPv6 or the use of
> neighbor-to-neighbor routing in LAN networks.
>
> > On Oct 6, 2017, at 7:48 AM, Mudric, Dusan (Dusan) <[e-mail]>
> wrote:
> >
> > Hi Fred,
> >
> > Should it be mentioned that even though a ‘shared’ prefix with L=0 makes
> hosts send packets over the first hope router, the unique prefix per host
> is preferred mechanism in the environments where security is of a concern?
> >
> > Thanks,
> > Dusan.
> >
> > From: v6ops [mailto:[e-mail]] On Behalf Of Lorenzo Colitti
> > Sent: Wednesday, September 13, 2017 6:04 PM
> > To: Templin, Fred L
> > Cc: [e-mail]; [e-mail]
> > Subject: Re: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-
> prefix-per-host-08.txt
> >
> > I would instead say the opposite, i.e., call attention to what is in
> fact one of the the main benefits of this document. Suggested text:
> >
> > The practices described in this document make it very simple for
> networks to implement robust isolation between clients at layer 2. The
> network can simply ensure that devices cannot send packets to each other
> except through the first-hop router. This will automatically provide robust
> protection against attacks between devices that rely on link-local ICMPv6
> packets, such as DAD reply spoofing, ND cache exhaustion, malicious
> redirects, and rogue RAs. This form of protection is much more scalable and
> robust than alternative mechanisms such as DAD proxying, forced forwarding,
> or ND snooping.
> >
> >
> >
> > On Wed, Sep 13, 2017 at 2:12 PM, Templin, Fred L <
> [e-mail]> wrote:
> > Please add the following to Security Considerations:
> >
> >   "While the practices described herein encourage L3 operations that
> would
> >     forward all traffic through a provider managed First Hop Router,
> peer to peer
> >     communications are still possible unless L2 mechanisms are also
> employed
> >     in some fashion outside the scope of this document."
> >
> > Thanks - Fred
> >
> > > -----Original Message-----
> > > From: v6ops [mailto:[e-mail]] On Behalf Of
> [e-mail]
> > > Sent: Wednesday, September 13, 2017 7:04 AM
> > > To: [e-mail]
> > > Cc: [e-mail]
> > > Subject: [v6ops] I-D Action: draft-ietf-v6ops-unique-ipv6-
> prefix-per-host-08.txt
> > >
> > >
> > > A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> > > This draft is a work item of the IPv6 Operations WG of the IETF.
> > >
> > >         Title           : Unique IPv6 Prefix Per Host
> > >         Authors         : John Jason Brzozowski
> > >                           Gunter Van De Velde
> > >       Filename        : draft-ietf-v6ops-unique-ipv6-
> prefix-per-host-08.txt
> > >       Pages           : 9
> > >       Date            : 2017-09-13
> > >
> > > Abstract:
> > >    This document outlines an approach utilising existing IPv6 protocols
> > >    to allow hosts to be assigned a unique IPv6 prefix (instead of a
> > >    unique IPv6 address from a shared IPv6 prefix).  Benefits of unique
> > >    IPv6 prefix over a unique service provider IPv6 address include
> > >    improved host isolation and enhanced subscriber management on shared
> > >    network segments.
> > >
> > >
> > > The IETF datatracker status page for this draft is:
> > > https://datatracker.ietf.org/doc/draft-ietf-v6ops-unique-
> ipv6-prefix-per-host/
> > >
> > > There are also htmlized versions available at:
> > > https://tools.ietf.org/html/draft-ietf-v6ops-unique-ipv6-
> prefix-per-host-08
> > > https://datatracker.ietf.org/doc/html/draft-ietf-v6ops-
> unique-ipv6-prefix-per-host-08
> > >
> > > A diff from the previous version is available at:
> > > https://www.ietf.org/rfcdiff?url2=draft-ietf-v6ops-unique-
> ipv6-prefix-per-host-08
> > >
> > >
> > > Please note that it may take a couple of minutes from the time of
> submission
> > > until the htmlized version and diff are available at tools.ietf.org.
> > >
> > > Internet-Drafts are also available by anonymous FTP at:
> > > ftp://ftp.ietf.org/internet-drafts/
> > >
> > > _______________________________________________
> > > v6ops mailing list
> > > [e-mail]
> > > https://www.ietf.org/mailman/listinfo/v6ops
> >
> >
> > _______________________________________________
> > v6ops mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/v6ops
> >
> > _______________________________________________
> > v6ops mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/v6ops
>
>