Re: [v6ops] comment on draft-liu-v6ops-ula-usage-analysis

On Tue, Nov 5, 2013 at 7:16 PM, Arturo Servin <arturo.servin@gmail.com> wrote:
> Blocking according to DNS content would be something like Deep Packet
> Inspection, isn't it?
>
> Do we want to go there?

There are various ways to achieve it but I think the standard way is
to use split DNS. Anyway I don't think that the document in question
must dictate how to prevent DNS leakage (although having some
recommendation would be nice).

> On Tue, Nov 5, 2013 at 3:50 PM, Jen Linkova <furry13@gmail.com> wrote:
>>
>> Section 4.2. says that
>> "
>>
>> So when using ULAs in a network, the administrators should clearly
>>    set the scope of the ULAs and configure ACLs on relevant border
>>    routers to block them out of the scope. And if internal DNS are
>>    enabled, the administrators might also need to use internal-only DNS
>>    names for ULAs.
>> "
>> I believe it should that that the administrator MUST configure egress
>> ACLs on borders routers and MUST ensure that their DNS servers do not
>> include ULAs in any responses to external clients.
>>
>>
>>
>>
>> --
>> SY, Jen Linkova aka Furry
>> _______________________________________________
>> v6ops mailing list
>> v6ops@ietf.org
>> https://www.ietf.org/mailman/listinfo/v6ops
>
>

-- 
SY, Jen Linkova aka Furry