Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

["Fred Baker (fred)" <[e-mail]>]

On Nov 13, 2013, at 12:42 AM, Tarko Tikan <[e-mail]>
 wrote:

> hey,
> 
>> From my perspective, I think I would prefer that the firewall - if implemented - blocked everything, and applications within the network advised the firewall(s) of traffic that they are willing to receive. If a potential session has no willing counterpart within my network, I don't see the argument for letting the first packet in.
> 
> That would be preferred but as already discussed, there are no suitable protocols (and implementations) for deployment today. And recommending to block all inbound sessions by default is not good idea with IPv6 end2end mentality.
> 
> To improve on the idea - I don't see why application should signal to CPE, firewalling in CPE is useless against ddos attacks. I'd prefer application to signal to edge routers and have firewall there, this way to-be-denied packets never make it to CPE and will not congest AN uplinks.

The action of the application would  be the same, right? If the user has a managed service, one can easily imagine the upstream firewall/router doing this. That simply says where the PCP traffic would go to.

The "IPv6 end2end mentality", I would argue, doesn't come into play here. The phrase "end to end" implies having multiple endpoints. If there is no application in the network prepared to be the receiving end, the sending end can do whatever it likes - there is nobody to talk with. And from a policy perspective, even if there is someone that *could* talk (the HTTP server on my phone, designed for management use), that doesn't imply that I want it to. I'm fine with saying there will be no impedance of traffic that is useful and fits policy. As far as I know, firewalls aren't supposed to block that anyway.