Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, "Fred Baker (fred)
" writes:
>
> On Nov 13, 2013, at 9:42 PM, Mikael Abrahamsson <[e-mail]>
>  wrote:
>
> > On Wed, 13 Nov 2013, Marc Lampo wrote:
> >
> >> Hence, in my opinion, the security (and privacy) of IPv6 users is best
> served by keeping unsolicited traffic out.
> >
> > You and me have a very different opinion what unsolicited is. If the
> host accepts connections on a port, then it has by definition accepted to
> handle the connection. There is no reason access control can't be handled
> on the host.
>
> The question here, if I understand Marc, is who sent the first packet. If
> the TCP SYN (or counterpart in whatever protocol) was sent by the host
> within the domain, an RFC 6092 firewall will permit traffic in response.
> If the TCP SYN was sent by the peer to that host, an RFC 6092 firewall
> will prevent that and everything following. Having the host say to the
> firewall that it is willing to accept unsolicited communications is quite
> a bit different than initiating those communications.
>
> > I would rather see a mechanism that the host can use to say "please
> protect me, I'm helpless" and then the gateways will filter traffic to
> the device (ie if the host says nothing then default policy is open) than
> what you're proposing which is "default close".
>
> What about a host that is so helpless that it doesn't say so?

Then it should be put in the bin.  Equipment should expect to be
exposed to the Internet as a whole.  It's not like this is a new
concept.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]