IETF Logo Mail Archive

Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

Marc Lampo <marc.lampo.ietf@gmail.com> Wed, 13 November 2013 09:30 UTC

Return-Path: <marc.lampo.ietf@gmail.com>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5ABA821E8099 for <v6ops@ietfa.amsl.com>; Wed, 13 Nov 2013 01:30:23 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.988
X-Spam-Level:
X-Spam-Status: No, score=-0.988 tagged_above=-999 required=5 tests=[AWL=-0.655, BAYES_00=-2.599, HTML_MESSAGE=0.001, J_CHICKENPOX_13=0.6, NO_RELAYS=-0.001, SARE_HTML_USL_OBFU=1.666]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jXnmCJbN2mpb for <v6ops@ietfa.amsl.com>; Wed, 13 Nov 2013 01:30:22 -0800 (PST)
Received: from mail-vb0-x231.google.com (mail-vb0-x231.google.com [IPv6:2607:f8b0:400c:c02::231]) by ietfa.amsl.com (Postfix) with ESMTP id BB23A21E808D for <v6ops@ietf.org>; Wed, 13 Nov 2013 01:30:22 -0800 (PST)
Received: by mail-vb0-f49.google.com with SMTP id o19so89234vbm.36 for <v6ops@ietf.org>; Wed, 13 Nov 2013 01:30:22 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=GJI//jZ/t6qCCSvdLgiY+8JP6MrGCHDkkTD3KYqFKLY=; b=YpOUCib0JDoOFhhA7cEfpUIQHS9yj6SNcYw3dByUC5fYtXJDLwdi/YIeHh/RFtVq/x K6v/bIq8Eh3RkNizq3c3VvrVGGjKFHxiY/wiflh7yCh+4YbKE5Yje0vketVFjce2/WQ/ UZLgKQXZsCTM6k5JeBdh9ASrn0ofOeB22y0tkarnToE1a6QbzF+gb5ldvXsKIzGwDECt sVqBypJkKgY8zpumlt6bqExGQe4FpzmhA1htLu/UCDZWA9QkccD2qD57nKF2sUG/UI2d SqOf9xoqKJYIac8JPbxpaCXG2CYxbfAKZDwUKjfxkyZQcC2rO6XFvrhC36Y8HR034BLc tRuQ==
MIME-Version: 1.0
X-Received: by 10.58.118.84 with SMTP id kk20mr7085778veb.26.1384335022225; Wed, 13 Nov 2013 01:30:22 -0800 (PST)
Received: by 10.58.227.66 with HTTP; Wed, 13 Nov 2013 01:30:22 -0800 (PST)
In-Reply-To: <52833B8F.10708@lanparty.ee>
References: <201311101900.rAAJ0AR6025350@irp-view13.cisco.com> <CAB0C4xOfz_JAjEEJZ-Zz7MBEyZhVzrAE+8Ghf1ggC3+9pyHmNg@mail.gmail.com> <989B8ED6-273E-45D4-BFD8-66A1793A1C9F@cisco.com> <52833B8F.10708@lanparty.ee>
Date: Wed, 13 Nov 2013 10:30:22 +0100
Message-ID: <CAB0C4xN88WMwKN5+VE5ZupWmCnYQGAuFPPFqQ+Vx+g_+c=z9HQ@mail.gmail.com>
From: Marc Lampo <marc.lampo.ietf@gmail.com>
To: Tarko Tikan <tarko@lanparty.ee>
Content-Type: multipart/alternative; boundary="089e0122a0863ffea604eb0b9da4"
Cc: v6ops@ietf.org
Subject: Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/v6ops>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 13 Nov 2013 09:30:23 -0000

Hello,

but is "IPv6 end2end mentality" a good idea, from the security point of
view ?  I don't think so.

Kind regards,


On Wed, Nov 13, 2013 at 9:42 AM, Tarko Tikan <tarko@lanparty.ee> wrote:

> hey,
>
>
>   From my perspective, I think I would prefer that the firewall - if
>> implemented - blocked everything, and applications within the network
>> advised the firewall(s) of traffic that they are willing to receive. If a
>> potential session has no willing counterpart within my network, I don't see
>> the argument for letting the first packet in.
>>
>
> That would be preferred but as already discussed, there are no suitable
> protocols (and implementations) for deployment today. And recommending to
> block all inbound sessions by default is not good idea with IPv6 end2end
> mentality.
>
> To improve on the idea - I don't see why application should signal to CPE,
> firewalling in CPE is useless against ddos attacks. I'd prefer application
> to signal to edge routers and have firewall there, this way to-be-denied
> packets never make it to CPE and will not congest AN uplinks.
>
> --
> tarko
>
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
>

v2.23.0 | Report a Bug | By Email