IETF Logo Mail Archive

Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

Tarko Tikan <tarko@lanparty.ee> Wed, 13 November 2013 08:43 UTC

Return-Path: <tarko@lanparty.ee>
X-Original-To: v6ops@ietfa.amsl.com
Delivered-To: v6ops@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F80421E8097 for <v6ops@ietfa.amsl.com>; Wed, 13 Nov 2013 00:43:09 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.299
X-Spam-Level:
X-Spam-Status: No, score=-2.299 tagged_above=-999 required=5 tests=[AWL=0.300, BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YhJ1UMdRaJHg for <v6ops@ietfa.amsl.com>; Wed, 13 Nov 2013 00:43:03 -0800 (PST)
Received: from valgus.lanparty.ee (valgus.lanparty.ee [194.126.124.108]) by ietfa.amsl.com (Postfix) with ESMTP id 513D621E8082 for <v6ops@ietf.org>; Wed, 13 Nov 2013 00:43:03 -0800 (PST)
Received: from tuli.elion.ee ([194.126.117.170] helo=[192.168.28.102]) by valgus.lanparty.ee with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.72) (envelope-from <tarko@lanparty.ee>) id 1VgW2O-00089w-Ak for v6ops@ietf.org; Wed, 13 Nov 2013 10:43:00 +0200
Message-ID: <52833B8F.10708@lanparty.ee>
Date: Wed, 13 Nov 2013 10:42:55 +0200
From: Tarko Tikan <tarko@lanparty.ee>
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20100101 Thunderbird/24.0
MIME-Version: 1.0
To: v6ops@ietf.org
References: <201311101900.rAAJ0AR6025350@irp-view13.cisco.com> <CAB0C4xOfz_JAjEEJZ-Zz7MBEyZhVzrAE+8Ghf1ggC3+9pyHmNg@mail.gmail.com> <989B8ED6-273E-45D4-BFD8-66A1793A1C9F@cisco.com>
In-Reply-To: <989B8ED6-273E-45D4-BFD8-66A1793A1C9F@cisco.com>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
X-SA-Exim-Connect-IP: 194.126.117.170
X-SA-Exim-Mail-From: tarko@lanparty.ee
X-SA-Exim-Version: 4.2.1 (built Mon, 22 Mar 2010 06:51:10 +0000)
X-SA-Exim-Scanned: Yes (on valgus.lanparty.ee)
Subject: Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC
X-BeenThere: v6ops@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: v6ops discussion list <v6ops.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/v6ops>, <mailto:v6ops-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/v6ops>
List-Post: <mailto:v6ops@ietf.org>
List-Help: <mailto:v6ops-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/v6ops>, <mailto:v6ops-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 13 Nov 2013 08:43:09 -0000

hey,

>  From my perspective, I think I would prefer that the firewall - if implemented - blocked everything, and applications within the network advised the firewall(s) of traffic that they are willing to receive. If a potential session has no willing counterpart within my network, I don't see the argument for letting the first packet in.

That would be preferred but as already discussed, there are no suitable 
protocols (and implementations) for deployment today. And recommending 
to block all inbound sessions by default is not good idea with IPv6 
end2end mentality.

To improve on the idea - I don't see why application should signal to 
CPE, firewalling in CPE is useless against ddos attacks. I'd prefer 
application to signal to edge routers and have firewall there, this way 
to-be-denied packets never make it to CPE and will not congest AN uplinks.

-- 
tarko

v2.23.0 | Report a Bug | By Email