Re: [v6ops] draft-smith-v6ops-local-only-addressing

Hi Fred,

> I think you're thinking of an opec draft by Michael Behringer, https://tools.ietf.org/html/rfc7404. In essence, it suggests that routers only talk with each other and their local hosts using link-layer addressing in the "destination" address. 
> 
> To my way of thinking, forcing that for all sessions means that one cannot access a device from a system that it is not directly connected to. Michael's proposal was in essence to prevent attacks on routers, permitting them to white-list network management devices and exclude pretty much everything else. Doing that for hosts would make the network pretty useless, I suspect. 

No it wasn't that one.
It was very much along Mark's lines of increasing security by controlling reachability and scope of addressing to end hosts.
Perhaps it was just something he talked about when Eric and he did advanced-security.

Regardless, seems like a fine idea. Devices that have no business being on the Internet, should as Mark proposes by default not have a global address.
Now you might argue, are there really any such device.

Cheers,
Ole

> 
>> On Dec 2, 2019, at 12:14 AM, Ole Troan <otroan@employees.org> wrote:
>> 
>> 
>> 
>>> On 30 Nov 2019, at 21:14, Ron Bonica <rbonica=40juniper.net@dmarc.ietf.org> wrote:
>>> 
>>> draft-smith-v6ops-local-only-addressing
>> 
>> I believe Townsley or was it Vyncke described a security model, where a device by default would only accept incoming connections on link-local or ULA addresses.
>> The device would have a global address that could be used for outbound connections, e.g. software updated.
>> Can't find or recall exactly where they described this model.
>> 
>> Best regards,
>> Ole
>> _______________________________________________
>> v6ops mailing list
>> v6ops@ietf.org
>> https://www.ietf.org/mailman/listinfo/v6ops
> 