Re: [v6ops] draft-ietf-v6ops-ula-usage-recommendations - work or abandon?

[Fernando Gont <[e-mail]>]

El 9/11/2015 11:41, "Lorenzo Colitti" <[e-mail]> escribió:
>
> On Mon, Nov 9, 2015 at 11:27 AM, Fernando Gont <[e-mail]>
wrote:
>>
>> FTP PORT does not work in the presence of an ipv6 diode firewall,
either. And layer 3 addrs in layer 7 protocols is not clean design. Period.
>
> You're saying that it's a cleaner design to require that any application
that
> needs to do peer-to-peer connectivity or receive incoming connections
> must first talk to a third party to ensure it works? Sorry, but I don't
think
> that makes sense.

Including layer-3 addresses in layer 7, is flawed, and has nothing to do
with what you're referring to above.

What you refer to has to do with the diode-firewall thing (which is a side
effect in nat, and that folks are replicating in ipv6 by deploying a diode
firewall where you currently have a nat box). Obviously, if your policy is
that you don't want incoming connections, and i have the same policy then,
unfortunately, we have to talk to a third party.

PS: No, i don't want an uncalled-for malformed packet to allow an attacker
to gain access to my IoT device, thanks to its buggy implementation. So,
me, I'll do diode-firewall to my devices, regardless of the availability of
global addresses.

Thanks,
Fernando