Re: [v6ops] [Int-area] [OPSEC] I-D Action: draft-gont-opsec-ipv6-eh-filtering-00.txt

[Fernando Gont <[e-mail]>]

On 07/17/2014 02:11 PM, Joe Touch wrote:
> 
> 
> On 7/16/2014 3:13 PM, C. M. Heard wrote:
>> Even it I don't agree with all of them, the filtering
>> recommendations in this draft do seem to motivated by legitimate
>> operational
>> concerns, not blanket paranoia.
> 
> They need to be characterized as what they are:
> 
>     - an attempt to accommodate devices that are NOT IPv6-compliant

I'd have a hard time coming uup with a vendor/device that can process
IPv6 packets with HBH header with the same performance as regular
packets. So.. are you suggesting that we start claiming that "we
currently do not know of any ipv6-compliant routers", or what? (fwiw, I
expect you are not)



> I agree that there are legitimate operational concerns, but redefining
> the behavior or the IPv6 flags is not the purview of operational or
> management groups in the IETF.

We're not redefining anything. We're just saying "look, if you're
running an IPv6 network, this is probably the most sane thing to do".
Having that sane advice doesn't prevent you from doing something else if
you know better, if you want to allow everything withing your
organization, or if you just don't care if your network melts down.

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492