Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

On Fri, Nov 15, 2013 at 10:35 AM, Fred Baker (fred) <fred@cisco.com> wrote:
>
> On Nov 15, 2013, at 10:02 AM, Tassos Chatzithomaoglou <achatz@forthnet.gr> wrote:
>
>> So, although i support this, i would like to see a note warning about some of the above dangers and noting that extra caution is to be used when following this.
>
> Thanks.
>
> Again, speaking as a participant.
>
> Where I most scratch my head is that the threat the firewall presumably is intended to defend against, and the asset it is trying to defend, is not usually related to a protocol. If we decide that a given protocol number or port number is "universally OK", such as RFC 6092's comments on ESP/AH/IKE, one can expect port-agile attacks to use that port number for whatever protocol they use. If we say that we want a specified server to act as a listener for a protocol, such as a web server for http/https, that doesn't imply that all devices implementing listeners should be exposed as a matter of policy (if you have a Canon MP620 series printer or a Cisco telephone, and its address is X.X.X.X, open http://X.X.X.X, and ask yourself if that's information you want available to the world).
>
> So, blocking a couple of ports doesn't seem to accomplish much from a security perspective. I'm not sure what I would call "security" in this draft, much less "balanced". What the draft does, as near as I can tell, is give service providers something that somebody called a firewall, so that they can tell their customers that have the presence of a firewall as a market requirement that they are deploying a firewall, but depending on their customers to be dumb enough to not realize that the firewall doesn't secure anything.
>

Network operators who have deployed this strategy outlined in the
draft have penned the draft, they have to deal with the strain on
their network and helpdesk calls related to being hacked.

I believe the point of the draft is to share deployment experience
that there is no material change to the relevant network provider
metrics related to those costs of hacking.

If i understanding the scenario correctly, Swisscom had IPv4 NAT CPE
deployed with "stateful connection inspection" by default

They deployed IPv6 on a large scale without "stateful connection
inspection"  for IPv6 and the relevant metrics of attack traffic and
helpdesk calls have not changed.

This is not a matter of theory, this a matter of network operators
sharing operational experience for the betterment of other network
operators.

CB

> BTW, as chair, I have asked for a security directorate review of this draft.
>
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
>