Re: [v6ops] RFC7217 and flash renumbering and IID change

Fernando Gont <fgont@si6networks.com> Mon, 14 December 2020 05:33 UTC

To: Simon Hobson <linux@thehobsons.co.uk>, IPv6 Operations <v6ops@ietf.org>
References: <alpine.DEB.2.20.2012111147020.10335@uplift.swm.pp.se> <28ec97ca-355b-e4d8-200d-1c14160b51c0@si6networks.com> <4AC2A13C-9FE6-4D2C-B14C-D1DCC3169700@thehobsons.co.uk>
From: Fernando Gont <fgont@si6networks.com>
Message-ID: <dd31aa5f-bec7-d8b7-4297-ff89cbe21cd0@si6networks.com>
Date: Mon, 14 Dec 2020 01:32:43 -0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.1
MIME-Version: 1.0
In-Reply-To: <4AC2A13C-9FE6-4D2C-B14C-D1DCC3169700@thehobsons.co.uk>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/v6ops/LHua8zsmsIb8ou_J4GPxecMPLzs>
Subject: Re: [v6ops] RFC7217 and flash renumbering and IID change
Precedence: list

Hi, Simon,

On 13/12/20 16:53, Simon Hobson wrote:
> Fernando Gont <fgont@si6networks.com> wrote:
> 
>> So it should be the host talking to the firewall and telling what to do with which address.  -- with e.g. something like UPnP.
> 
> So we're back to each host deciding on the security policy for the network - not a network admin (as a proxy for the owners of the site/network).

For the home scenarios case, we're not "back", because we never went 
away from there.

The number of people manually configuring home firewalls is not 
statistically significant.

OTOH, if you want to manually configure rules based on addresses that 
are not guaranteed to remain stable... you know what you are going to 
get. In such scenarios, you probably should use RADIUS or something else.

> I make a point of disabling upnp as one of the first steps when setting up a network. Who wants ${random device which may or may not be "friendly"} to be able to determine what traffic is allowed into the network - it's not like there is anyone out there in the wild west of the internet who'd have any hostile intent :-/

Who wants a network with a random device?  :-)

If the device is evil enough to use UPnP to open wholes in the FW, it 
could also be evil to act as a proxy and tunnel everything into the 
internal network.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: fgont@si6networks.com
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

[v6ops] RFC7217 and flash renumbering and IID cha… Mikael Abrahamsson
Re: [v6ops] RFC7217 and flash renumbering and IID… Fernando Gont
Re: [v6ops] RFC7217 and flash renumbering and IID… Ted Lemon
Re: [v6ops] RFC7217 and flash renumbering and IID… Simon Hobson
Re: [v6ops] RFC7217 and flash renumbering and IID… Fernando Gont