Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

[Marc Lampo <[e-mail]>]

Yes, RFC 6092 recommends that unsolicited packets be dropped by default !

  REC-34  By DEFAULT, a gateway MUST respond with an ICMPv6
           "Destination Unreachable" error code 1 (Communication with
           destination administratively prohibited), to any unsolicited
           inbound SYN packet after waiting at least 6 seconds without
           first forwarding the associated outbound SYN or SYN/ACK from
           the interior peer.

"transparent mode" "MAY" be the default (which, in the context, I interpret
as a kind of "second choice")

   REC-49  Internet gateways with IPv6 simple security capabilities MUST
           provide an easily selected configuration option that permits
           a "transparent mode" of operation that forwards all
           unsolicited flows regardless of forwarding direction, i.e.,
           not to use the IPv6 simple security capabilities of the
           gateway.  The transparent mode of operation MAY be the
           default configuration.





On Wed, Nov 20, 2013 at 9:10 AM, Lorenzo Colitti <[e-mail]> wrote:

> On Wed, Nov 20, 2013 at 5:01 PM, Marc Lampo <[e-mail]>wrote:
>
>> This document states, for several recommendations in RFC 6092, exactly
>> the opposite of that document.
>>
>
> Which ones? Obviously you're not suggesting that RFC 6092 recommends that
> unsolicited inbound packets be dropped by default, right? Because it
> doesn't say that.
>
>
>> In addition, as I touched in my very first reaction, this draft lists a
>> number of threats - section 2.
>>  But, in my opinion, none of those threats are addressed by the rules
>> for balanced security - section 3.1.
>>  (my first comment only referred to the last threat on covert channels,
>> but I must rephrase)
>>
>
> Do you have text to suggest?
>
>
>> In reply to the question : yes, personally I would be happier if the ISP
>> dropped all unsolicited packets towards my network (except IPsec).
>>
>
> And there are people in this working group that will never agree with you.
> For example, I will never agree with you.
>
> But fortunately, that has no relevance on this document. Since this
> document does not recommend a security policy, saying "I don't like the
> security policy" (which is your opinion, and one you're perfectly entitled
> to) is not a valid reason not to publish this document.
>