Re: [v6ops] draft-smith-v6ops-local-only-addressing

On 03-Dec-19 10:33, Ole Troan wrote:
> Hi Fred,
> 
>> I think you're thinking of an opec draft by Michael Behringer, https://tools.ietf.org/html/rfc7404. In essence, it suggests that routers only talk with each other and their local hosts using link-layer addressing in the "destination" address. 
>>
>> To my way of thinking, forcing that for all sessions means that one cannot access a device from a system that it is not directly connected to. Michael's proposal was in essence to prevent attacks on routers, permitting them to white-list network management devices and exclude pretty much everything else. Doing that for hosts would make the network pretty useless, I suspect. 
> 
> No it wasn't that one.

Well, there's always https://tools.ietf.org/html/rfc4864#section-3.2

And of course we punted on https://tools.ietf.org/html/draft-ietf-v6ops-ula-usage-considerations-02

   Brian

> It was very much along Mark's lines of increasing security by controlling reachability and scope of addressing to end hosts.
> Perhaps it was just something he talked about when Eric and he did advanced-security.
> 
> Regardless, seems like a fine idea. Devices that have no business being on the Internet, should as Mark proposes by default not have a global address.
> Now you might argue, are there really any such device.
> 
> Cheers,
> Ole
> 
>>
>>> On Dec 2, 2019, at 12:14 AM, Ole Troan <otroan@employees.org> wrote:
>>>
>>>
>>>
>>>> On 30 Nov 2019, at 21:14, Ron Bonica <rbonica=40juniper.net@dmarc.ietf.org> wrote:
>>>>
>>>> draft-smith-v6ops-local-only-addressing
>>>
>>> I believe Townsley or was it Vyncke described a security model, where a device by default would only accept incoming connections on link-local or ULA addresses.
>>> The device would have a global address that could be used for outbound connections, e.g. software updated.
>>> Can't find or recall exactly where they described this model.
>>>
>>> Best regards,
>>> Ole
>>> _______________________________________________
>>> v6ops mailing list
>>> v6ops@ietf.org
>>> https://www.ietf.org/mailman/listinfo/v6ops
>>
> 
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
>