IETF Logo Mail Archive

Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

Tarko Tikan <tarko@lanparty.ee> Wed, 13 November 2013 15:58 UTC

Return-Path: <tarko@lanparty.ee>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D399221E8063 for <v6ops@ietfa.amsl.com>; Wed, 13 Nov 2013 07:58:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.449
X-Spam-Level:
X-Spam-Status: No, score=-2.449 tagged_above=-999 required=5 tests=[AWL=0.150, BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3UcIL0erlv73 for <v6ops@ietfa.amsl.com>; Wed, 13 Nov 2013 07:58:51 -0800 (PST)
Received: from valgus.lanparty.ee (valgus.lanparty.ee [194.126.124.108]) by ietfa.amsl.com (Postfix) with ESMTP id E41D621E80AE for <v6ops@ietf.org>; Wed, 13 Nov 2013 07:58:50 -0800 (PST)
Received: from tuli.elion.ee ([194.126.117.170] helo=[192.168.28.102]) by valgus.lanparty.ee with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.72) (envelope-from <tarko@lanparty.ee>) id 1Vgcq5-0008PW-1v for v6ops@ietf.org; Wed, 13 Nov 2013 17:58:45 +0200
Message-ID: <5283A1AF.1070806@lanparty.ee>
Date: Wed, 13 Nov 2013 17:58:39 +0200
From: Tarko Tikan <tarko@lanparty.ee>
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20100101 Thunderbird/24.0
MIME-Version: 1.0
To: "v6ops@ietf.org WG" <v6ops@ietf.org>
References: <201311101900.rAAJ0AR6025350@irp-view13.cisco.com> <CAB0C4xOfz_JAjEEJZ-Zz7MBEyZhVzrAE+8Ghf1ggC3+9pyHmNg@mail.gmail.com> <989B8ED6-273E-45D4-BFD8-66A1793A1C9F@cisco.com> <52833B8F.10708@lanparty.ee> <A453058E-C40C-4D3A-83F0-FB6851A501DD@nominum.com>
In-Reply-To: <A453058E-C40C-4D3A-83F0-FB6851A501DD@nominum.com>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
X-SA-Exim-Connect-IP: 194.126.117.170
X-SA-Exim-Mail-From: tarko@lanparty.ee
X-SA-Exim-Version: 4.2.1 (built Mon, 22 Mar 2010 06:51:10 +0000)
X-SA-Exim-Scanned: Yes (on valgus.lanparty.ee)
Subject: Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/v6ops>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 13 Nov 2013 15:58:57 -0000

hey,

> You could definitely do this with PCP, but do you really want to encourage the installation of firewalls in this part of the network?   I suspect the law of unintended consequences is worth paying attention to here.

There are pros and cons like always. Considering people put subscriber 
awareness, CGN (stateful) etc. into PEs, adding firewalls is not that 
big of a deal. Scale is an issue but current hardware can already do 
tens of gigabits worth of stateful firewalling.

Then again it adds cost and raises complexity (lower MTBF) and CPEs are 
there and paid for.

-- 
tarko

v2.23.0 | Report a Bug | By Email