Re: [v6ops] Hmm. Interesting article...

["Howard, Lee" <[e-mail]>]

On 2/2/16, 9:33 AM, "v6ops on behalf of Fernando Gont"
<[e-mail] on behalf of [e-mail]> wrote:

>On 02/02/2016 10:20 AM, Owen DeLong wrote:
>>
>>> On Feb 1, 2016, at 23:56, Fernando Gont <[e-mail]> wrote:
>>>
>>> Maybe in that in IPv4 you typically have a NAT in front of your node,
>>> where in IPv6 you don't necessarily have a fw?
>>>
>>
>> If you're running a host without any sort of filter, that's really not
>>a problem we should be solving at the network level. That's more of an
>>educational problem.
>
>There's a reason for deploying network-based firewalls:
><https://tools.ietf.org/html/draft-gont-opsawg-firewalls-analysis-01>
>

There is an unaddressed tension here.
I think one view is that IPv6 should be deployed without firewalls so all
hosts are reachable from arbitrary other hosts on the Internet.
I think the other view is that all/most/many hosts should be protected by
a stateful firewall.

I don¹t know that we can resolve this tension in v6ops, but I want to make
it explicit.

Lee


________________________________

This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.