Re: [v6ops] Operational guidelines for a company/organization IPv6 address scheme supplemental to RFC5157

[John Mann <[e-mail]>]

Hi,

On 27 September 2012 08:27, Philipp Kern <[e-mail]> wrote:

> On Wed, Sep 26, 2012 at 09:16:12AM +0200, Marksteiner, Stefan wrote:
> > There's a variety of reasons to keep track of addresses from usage and
> > statistics to forensic purposes in security incidents (also those which
> are
> > perpetrated from inside sources to outside targets).
>
> Wouldn't it be better to track the tables of your switches and routers
> (possibly with port info) instead? Because everybody can infer the subnet
> from
> one stateful DHCPv6 reply and just use another address. Well, unless your
> hardware can already do DHCPv6 snooping at the edge, which seems to be
> sort of
> rare.
>

I'm trying
a) to track which addresses are used by which hosts for forensics and
Internet authentication, and
b) allow for some basic network-level filtering (e.g. only allow those PCs
to ssh into this host)

Currently PCs get
1) MAC-based SLAAC addresses
2) a new Privacy IPv6 addresses every day -- that lasts for n days

There is no global event (like DHCPv4 traffic or RADIUS 802.1x) that
signifies when a new SLAAC or privacy address starts or stops being used.

Polling all routers for IPv6 neighbour tables (e.g. every hour) is
certainly possible, but it leads to lots of data.
It helps to do a FF02::1 multicast ping out each Vlan to refresh the tables
first, but many PCs have firewalls that drop all pings ...
If a PC is using a Privacy address for outbound communication, do you ever
see the MAC-based address?

As a test, I ran a ISC dhcpd to do stateful DHCPv6 address assignment to
get some sticky-ness to the IPv6 address used by a PC when connected to a
particular Vlan, and
3) the test PCs got an *extra* DHCPv6-assigned IPv6 address
But the PCs still preferred Privacy addresses for new outbound connections!!

To get PCs to use DHCPv6-assigned addresses instead of Privacy addresses,
do I need to change the RAs to disable all use of SLACC addresses
and then risk breaking IPv6 for any devices that don't support DHCPv6??

I'm at a University and have no control over the mixed BYOD fleet, just
over the network and DHCPv* servers.

Thanks,
    John