Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

["cb.list6" <[e-mail]>]

On Nov 12, 2013 6:34 PM, "Mikael Abrahamsson" <[e-mail]> wrote:
>
> On Tue, 12 Nov 2013, Fred Baker (fred) wrote:
>
>> From my perspective, I think I would prefer that the firewall - if
implemented - blocked everything, and applications within the network
advised the firewall(s) of traffic that they are willing to receive. If a
potential session has no willing counterpart within my network, I don't see
the argument for letting the first packet in.
>
>
> My biggest problem with this resoning, is that I am not aware of any
firewall poking mechanism actively being in use for IPv6. This means that
if we have a firewall with default-deny for incoming connections, then
either hosts need an Internet based machine to coordinate a STUN type of
behaviour to get the firewall to accept packets for sessions, or they need
to implement a firewall poking mechanism that as far as I know, neither
todays firewalls/CPEs nor hosts actually has.
>
> So today, implementing default-deny would mean a lot of the benefit of
IPv6 wouldn't be seen immediately but would takes many years to realise.
Right?
>

That's my view too

> Or am I mistaken and uPNP for IPv6 actually functional today? PCP I have
never seen in home devices.
>

I would rather restore e2e than deploy pcp. Or firewall  related ALGs.

At the end of the day, this draft is an excellent start towards restoring
e2e in a pragmatic and prudent way.  It is deployed and successful and is
thusly a reference for us all.  I fully support it as written since it will
help p2p technologies like webrtc and Microsoft Xbox One, as presented at
ietf88.

CB

> --
> Mikael Abrahamsson    email: [e-mail]
>
> _______________________________________________
> v6ops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/v6ops