Re: [v6ops] I-D Action: draft-ietf-v6ops-ipv6-ehs-packet-drops-00 - Admin Policy

[Fernando Gont <[e-mail]>]

Hello, Mark,

On 3/8/20 08:35, Mark Smith wrote:
[...]>
> 
> I expect many network operators drop fragments because they were taught 
> to do ACLs/packet filters similar to the following:
> 
> permit tcp any any eq http
> permit udp any any eq dns
> deny ip any any

You'll not get away with that in IPv6, since it would break ND.

That said, the above (modulo ICMPv6 and fragmentation) might seem 
reasonable on the edge (e.g. enterprise network), but not so much elsewhere.

(From RFC7872, you'll see that not all EHs share the same drop rate. IN 
fact, the drop rates are proportional to the EH len...)


[...]
> Network firewall admins can be a bit worse in the sense that they can be 
> more paranoid about blocking things they don't understand enough or 
> don't trust e.g. blocking all of ICMP by default.

When doing sysadmin, I've myself started from a default deny, and 
subsequently allowed things to make stuff work.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492