Re: [v6ops] (IETF I-D): Implications of IPv6 Addressing on Security Operations (Fwd: New Version Notification for draft-gont-opsec-ipv6-addressing-00.txt)

[Fernando Gont <[e-mail]>]

Hello, Simon,

Thanks for reaching out! In-line....

On 14/2/23 15:11, Simon wrote:
> 
> Interesting read. However, I think a few places are perhaps a little
> misleading.
> 
> One is discussing blocking a whole /64, and that it will probably
> block other (innocent) hosts on the same network. This isn’t really
> any different to the world of IPv4 where blocking a single address
> will most likely block all hosts in a network behind a NAPT gateway.
> To an extent, I can see that treating a /64 in much the same way as a
> /32 in the IPv4 world will become commonplace for the reasons you
> mention. I’ve definitely dealt with the situation where the email for
> a whole office keeps going down because one device was misconfigured
> and kept triggering fail2ban on our servers.

mm... what is misleading about this statement?  Or, in other words, how 
could you make e.g. fail2ban being off any use by blocking just /128s?

Are you arguing to only ban the /64 after a few blocks in that /64? Or 
something else?

Thanks!

Regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: F242 FF0E A804 AF81 EB10 2F07 7CA1 321D 663B B494