Re: [v6ops] [OPSEC] 3 Volunteers wanted - Draft: draft-gont-opsec-ipv6-implications-on-ipv4-nets

[Warren Kumari <[e-mail]>]

On Aug 17, 2012, at 11:15 AM, Lee Howard wrote:

>>>> -       1.0 please avoid all discussion about NAPT being
> =91minimal/simpl
>>> e=92 security, the days of scanning are over and have been replaced by
>>> malw are download/email propagated
>>> 
>>>> This is demonstrably false, and I can send you logs of scanning
>>>> attempts
>>> foiled by NAPT.  NAT is crap security, but it=92s not zero security.
>>> 
>>> Heretic!
>>> 
>>> Actually, I'd go so far as to drop the "crap" from the above -- while
>>> it is n't "real" security (whatever that means) it has become cool to
>>> simply beat  on the NAT.
>> 
>> But the problem is that people think they need "NAT" as opposed to a
> "stateful firewall with
>> default allow out all, block in all".
>> NAPT effectively establishes the latter + munges with addresses and ports.
> It's the state table
>> not the address/port translation that stops scans.
> 
> That is true, but is not a flaw in the document.  
> The offending text is:
> Finally,
>   some transition/co-existence mechanisms (notably Teredo) are designed
>   to traverse Network Address Translators (NATs), which in many
>   deployments provide a minimum level of protection by only allowing
>   those instances of communication that have been initiated from the
>   internal network.  Thus, these mechanisms might cause an internal
>   host with otherwise limited IPv4 connectivity to become globally
>   reachable over IPv6, therefore resulting in increased (and possibly
>   unexpected) host exposure.  That is, the aforementioned technologies
>   might inadvertently allow incoming IPv6 connections from the Internet
>   to hosts behind the organizational firewall.
> 
> Would you be happy if it said:
>   to traverse Network Address Translators (NATs), which, by keeping a
>  state table and only allowing inbound packets to hosts which have
>  established outbound communication, provides a minimum level of
> protection. . . 
> 
<no-hats>

Personally I'm fine with either…. 

I was just mumbling, don't have any particularly strong feelings on this…

</no-hats>


> I don't think a more thorough discussion of the different risk profiles of
> full
> cone versus symmetric NAT, etc., is warranted here.  I absolutely agree that
> 
> networks should have a stateful firewall.  Would you say that a stateful
> firewall is *even more important* now (with IPv6 ramping up) than it ever
> was before?   
> 
>> Stateless NAT44 or NAT66 doesn't stop scans.
> 
> True.  How is that relevant to a discussion of how unintentional IPv6 may
> affect
> IPv4 networks?
> 
>> As for the secretary's desktop how many of them would be owned if LSR was
> being used to
>> scan 192.168/16 though the NAT box?
> 
> Fewer than if it were even easier.  Again, not really the point of the
> document.
> 
> Lee
> 
> 
>> 
>> Mark
>> --
>> Mark Andrews, ISC
>> 1 Seymour St., Dundas Valley, NSW 2117, Australia
>> PHONE: [phone]                 INTERNET: [e-mail]
> 
> 
> _______________________________________________
> OPSEC mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/opsec
> 

-- 
"He who laughs last, thinks slowest." 
    -- Anonymous