Status of RFC 4864 (was Re: I-D.ietf-v6ops-cpe-simple-security-09)

[Mark Townsley <[e-mail]>]

This exchange highlights a very significant point with respect to the 
content in v6ops-cpe-simple-security.

According to its author, v6ops-cpe-simple-security has been operating 
under the influence of precedent from RFC 4864, something that was never 
intended by the authors of the RFC, nor something expected under IETF 
procedures.

- Mark

On 3/21/10 11:14 PM, Brian E Carpenter wrote:
> On 2010-03-22 10:28, Mark Townsley wrote:
>    
>> On 3/21/10 9:29 PM, james woodyatt wrote:
>>      
>>> On Mar 21, 2010, at 12:18, Mark Townsley<[e-mail]>  wrote:
>>>        
>>>> On 3/21/10 6:29 PM, Brian E Carpenter wrote:
>>>>          
>>>>> So, I'm wondering what's really wrong with:
>>>>>
>>>>>    REC-41  Gateways MUST provide an easily selected configuration option
>>>>>        that permits operation in a mode that forwards all unsolicited
>>>>>        flows regardless of forwarding direction.
>>>>>            
>>>> The problem is the default, which is not to permit this.
>>>>          
>>> That problem is inherited from RFC 4864, which this draft is not
>>> intended to reverse.
>>>        
>> Why not, if that is the current consensus? We've reversed the text of
>> IETF standards track documents before, much less Informational documents
>> that are not a standard of any kind.
>>      
> As a co-author of 4864, let me agree violently. It's not a BCP.
> Even if it was, consensus could reverse it.
>
> What 4864 says is: NATs weren't designed as security devices but they
> provide simple security by blocking everything incoming by default.
> To implement simple security for v6 you should do it with a stateful
> firewall.
>
> It doesn't say that CPEs MUST do this. It leaves that choice open, as
> an informational document.
>
>      Brian
>
>