Re: [v6ops] Last Call: <draft-ietf-v6ops-ra-guard-implementation-04.txt> (Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard)) to Best Current Practice

["George, Wes" <[e-mail]>]

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf
> Of Marc Lampo
> Sent: Wednesday, May 30, 2012 3:34 AM
>
>
> Compare it to IPv4 "options" : I always configured my routers to drop
> IPv4 packets that had any options.  Not needed for any "production traffic".
> (unfortunately, such a simple solution does not exist, for IPv6 ...)

[WEG] I think there's a point of clarification here that makes this an invalid comparison. There's a very big difference between telling your router to *ignore* any IP Options it sees in packets going through the box (e.g. process/forward the packet as normal, but without taking any actions manipulated by the options) and in telling it to actually drop the packets altogether, either in general for all traffic through the box, or more specifically on "for us" packets destined for the router's control plane.
"ip options ignore" in Cisco parlance does the former, not the latter, mainly to prevent packets from being sent to the punt path and creating a DoS attack vector.  Indiscriminately Blocking/dropping packets with options configured is not a good idea unless you are operating a device whose position in the network means that you will definitely know whether or not there are any legitimate uses of options on the traffic traversing the device. Unless you have a very tight control on all of the uses of the network such that you know exactly what the traffic does and does not look like, making assumptions like that tend to get us into situations like we find ourselves in with legitimate ICMPv4 traffic being blocked by overzealous security admins. A recommendation in a BCP can't assume that much about the network, and therefore must be very careful in covering this in its recommendations.

Thanks
Wes George

This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.