Re: [v6ops] [OPSEC] 3 Volunteers wanted - Draft: draft-gont-opsec-ipv6-implications-on-ipv4-nets

["Lee Howard" <[e-mail]>]

> > > -       1.0 please avoid all discussion about NAPT being
=91minimal/simpl
> > e=92 security, the days of scanning are over and have been replaced by
> > malw are download/email propagated
> >
> > > This is demonstrably false, and I can send you logs of scanning
> > > attempts
> > foiled by NAPT.  NAT is crap security, but it=92s not zero security.
> >
> > Heretic!
> >
> > Actually, I'd go so far as to drop the "crap" from the above -- while
> > it is n't "real" security (whatever that means) it has become cool to
> > simply beat  on the NAT.
>
> But the problem is that people think they need "NAT" as opposed to a
"stateful firewall with
> default allow out all, block in all".
> NAPT effectively establishes the latter + munges with addresses and ports.
It's the state table
> not the address/port translation that stops scans.

That is true, but is not a flaw in the document.  
The offending text is:
Finally,
   some transition/co-existence mechanisms (notably Teredo) are designed
   to traverse Network Address Translators (NATs), which in many
   deployments provide a minimum level of protection by only allowing
   those instances of communication that have been initiated from the
   internal network.  Thus, these mechanisms might cause an internal
   host with otherwise limited IPv4 connectivity to become globally
   reachable over IPv6, therefore resulting in increased (and possibly
   unexpected) host exposure.  That is, the aforementioned technologies
   might inadvertently allow incoming IPv6 connections from the Internet
   to hosts behind the organizational firewall.

Would you be happy if it said:
   to traverse Network Address Translators (NATs), which, by keeping a
  state table and only allowing inbound packets to hosts which have
  established outbound communication, provides a minimum level of
protection. . . 

I don't think a more thorough discussion of the different risk profiles of
full
cone versus symmetric NAT, etc., is warranted here.  I absolutely agree that

networks should have a stateful firewall.  Would you say that a stateful
firewall is *even more important* now (with IPv6 ramping up) than it ever
was before?   

> Stateless NAT44 or NAT66 doesn't stop scans.

True.  How is that relevant to a discussion of how unintentional IPv6 may
affect
IPv4 networks?
 
> As for the secretary's desktop how many of them would be owned if LSR was
being used to
> scan 192.168/16 though the NAT box?

Fewer than if it were even easier.  Again, not really the point of the
document.

Lee


> 
> Mark
> --
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: [phone]                 INTERNET: [e-mail]