Re: [v6ops] Fwd: (IETF I-D): Implications of IPv6 Addressing on Security Operations (Fwd: New Version Notification for draft-gont-opsec-ipv6-addressing-00.txt)

Hi Fernando,

Let's say that ACL in the IPv6 world is pretty unknown and not covered
much. Many people don't want and resist IPv6 because of ACL. They don't
understand how to do it, so this document is necessary to clear up many
obscure points.

Practicing an ACL for a simple /128 is unfeasible and leads us to inherited
thoughts and habits from IPv4.

We have always learned that IPv6 can deliver entire networks and is no
longer a simple IP.

The document goes in the right direction in guiding and stating its
implications but not forcing a practice. The network professional needs to
understand and change the habits of using ACL in IPv6.

For example, I use fail2ban, and despite reporting a /128, I temporarily
block the network address /64 when alarmed in the report. But this is an
action from my point of view.

Thanks,
Henri.

Em ter., 7 de fev. de 2023 às 01:29, Fernando Gont <fgont@si6networks.com>
escreveu:

> Folks,
>
> FYI, this one is targeted at opsec, but might be of interest to this group:
>
> * TXT:
> https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt
> * HTML:
> https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.html
>
> Thanks!
>
> Regards,
> Fernando
>
>
>
>
> -------- Forwarded Message --------
> Subject: (IETF I-D); Implications of IPv6 Addressing on Security
> Operations (Fwd: New Version Notification for
> draft-gont-opsec-ipv6-addressing-00.txt)
> Date: Fri, 3 Feb 2023 01:28:17 -0300
> From: Fernando Gont <fgont@si6networks.com>
> To: opsec@ietf.org
>
> Hi, All,
>
> I happened to participate in an IPv6 deployment meeting with some large
> content provider. Eventually there was a discussion about how to
> mitigate some attacks using block-lists, and they argued that they ban
> offending addresses (/128 for the IPv6 case), following IPv4 practices.
> While they had already deployed IPv6, some of the associated
> implications arising from the increased address space seemed to be
> non-obvious to them.
>
> So that's what motivated the publication of this document.
>
> * TXT:
> https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt
> * HTML:
> https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.html
>
> Comments welcome!
>
> Thanks,
> Fernando
>
>
>
>
> -------- Forwarded Message --------
> Subject: New Version Notification for
> draft-gont-opsec-ipv6-addressing-00.txt
> Date: Thu, 02 Feb 2023 19:48:40 -0800
> From: internet-drafts@ietf.org
> To: Fernando Gont <fgont@si6networks.com>, Guillermo Gont
> <ggont@si6networks.com>
>
>
> A new version of I-D, draft-gont-opsec-ipv6-addressing-00.txt
> has been successfully submitted by Fernando Gont and posted to the
> IETF repository.
>
> Name:           draft-gont-opsec-ipv6-addressing
> Revision:       00
> Title:          Implications of IPv6 Addressing on Security Operations
> Document date:  2023-02-02
> Group:          Individual Submission
> Pages:          8
> URL:
> https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt
> Status: https://datatracker.ietf.org/doc/draft-gont-opsec-ipv6-addressing/
> Htmlized:
> https://datatracker.ietf.org/doc/html/draft-gont-opsec-ipv6-addressing
>
>
> Abstract:
>     The increased address availability provided by IPv6 has concrete
>     implications on security operations.  This document discusses such
>     implications, and sheds some light on how existing security
>     operations techniques and procedures might need to be modified
>     accommodate the increased IPv6 address availability.
>
>
>
>
> The IETF Secretariat
>
>
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
>

--