Re: [v6ops] Thoughts about wider operational input

[Joe Maimon <[e-mail]>]

Brian E Carpenter wrote:
> On 31-Mar-22 09:16, Joe Maimon wrote:
> ...
>
>> At least with the existence of NAT there also exists some level of state
>> management and unsolicited incoming traffic constraints from reaching
>> the internal network nodes. By default, by dint of them being
>> operationally on the internet.
>
> As I just noted, the same is true with IPv6-capable domestic CEs in the
> complete absence of NAT66 or NPTv6. By default. Why can that not be true
> for enterprise CEs?
>
>     Brian
>

I thought you were expressing some sarcasm. The same is completely 
untrue of IPv6 CPE.

Of course we fully expect (and hope for) CPE to incorporate a properly 
functioning firewall, IPv4 and IPv6, whether for end users or 
enterprises. And we want it to have secure defaults.

The problem is that in IPv6, any and all security functionality is 
orthogonal to the primary purpose of the CPE, which is to pass packets 
so the user gets to use the internet.

Enterprises are with near complete certainty going to need extensive 
management and featuresets on that firewall. Their requirements from a 
firewall go far far beyond network translation features, of which there 
are many and they make use of them, but thats beside the point.

The point I have been trying to make is that with NAPT44 in IPv4 as it 
is commonly deployed today, when the "firewall" is off, so is the 
internet. That is an inherent level of security absent in IPv6 as 
commonly deployed.

NAT fails securely. IPv6 firewalls do not.

In the absence of this basic level of security by default, ever greater 
rigorous and vigorous attention needs to be given to the security 
features and functionality as shipped to consumers, who are unlikely to 
do anything beyond plug it in and turn it on.

I question whether such efforts are enough to bridge that gap. History 
suggests that is unlikely. And the fact that they are now required is a 
step backwards in time.

These are the same devices that oops, ship with backdoor passwords and 
otherwise glaring security defects. All the time.

I further note that with such a setup, communication issues 
troubleshooting will likely start with "turn off the firewall", as it 
does today on most desktops. Users are unlikely to turn it back on after 
that at any point. So your CPE must also come with a turn back on timer 
feature. Standardize that. Worse, this is a moving target, and as 
before, its orthogonal, tangential, a cost center.

Typical IPv6 users are not likely to be any more security aware and 
conscious than IPv4 users are now. They are the same users.

The same is true for the vendors whose customers are those users.

Joe