Re: [v6ops] control and security of DHCP

[joel jaeggli <[e-mail]>]

On 1/10/14, 10:45 AM, Mikael Abrahamsson wrote:
> On Fri, 10 Jan 2014, Gert Doering wrote:
> 
>> Nick's use case is fairly specific.  "If you want to live in my
>> datacenter,
>> these are the rules: do not listen to RA, use DHCPv6".
>>
>> This can be done.
> 
> Yes, but without intelligent inspection of RAs in the L2 network, there
> is basically no way to verify that this actually is the way things are
> configured. There are no RAs for a year, then a misconfiguration causes
> an RA to be emitted and then you find 5% of the machines in the DC
> haven't been configured to ignore RAs, and will now configure themselves
> by listening to this RA message.

Today (baring deliberate action) you'll probably find 100% of them
listening for RAs, which is either great because your deployment is
going to be a lot easier when you get to the edge, a ticking bomb, or both.

Which is at least partly why this is sitting with the RFC editor right now.

https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-implications-on-ipv4-nets/

That is clearly not an IPv6 deployment solution.

> This there is an absolute need to inspect traffic in the L2 network and
> thus the whole "I want a way to do this that doesn't suck when I don't
> have this L2 inspection functionality" falls flat imnho.

If you find it necessary to do that for IPv4 I have no doubt that you
will find it necessary for IPv6. There are other approaches, such as
limiting the diameter of the broadcast domain to a point you find
acceptable that might also be appropriate, if not always feasible.