Re: I-D.ietf-v6ops-cpe-simple-security-09

Brian E Carpenter <brian.e.carpenter@gmail.com> Sun, 21 March 2010 22:18 UTC

DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:organization:user-agent:mime-version:to:cc :subject:references:in-reply-to:content-type :content-transfer-encoding; b=cg2T4g2AdqP1J930n75UcXLaSYRy2zXwF3VZ9jyzikeCuOssnrq8LBfAuhfciaKfQC Xt5x8214CQrATJkTqZiijhZd6DwMU5iWO1fp5eOc0tOJ7kUd3SoO48FBNwpZy8rqpNi1 HdC3T+Q/x46HMUa5frGmoztXIa6iHAsuqughk=
Message-ID: <4BA69A3D.7@gmail.com>
Date: Mon, 22 Mar 2010 11:14:21 +1300
From: Brian E Carpenter <brian.e.carpenter@gmail.com>
Organization: University of Auckland
User-Agent: Thunderbird 2.0.0.6 (Windows/20070728)
MIME-Version: 1.0
To: Mark Townsley <townsley@cisco.com>
CC: james woodyatt <jhw@apple.com>, Gert Doering <gert@space.net>, IPv6 Operations <v6ops@ops.ietf.org>
Subject: Re: I-D.ietf-v6ops-cpe-simple-security-09
References: <D6F5ACD2-EB43-477E-9F48-AC3EDB3F7EB4@apple.com> <4BA3BBCF.2090903@cisco.com> <4BA3D1B3.4010501@gmail.com> <4BA3DAAA.10000@cisco.com> <4BA40DD1.7080306@gmail.com> <6C168711-6A34-4487-9911-92766513183C@apple.com> <4BA522E8.7050504@cisco.com> <4BA56626.20606@gmail.com> <20100321133831.GL69383@Space.Net> <4BA6575D.7070300@gmail.com> <4BA670ED.1020302@cisco.com> <D69F1DE6-D24D-45AA-95D0-99B63E62A1EE@apple.com> <4BA68F61.7020005@cisco.com>
In-Reply-To: <4BA68F61.7020005@cisco.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Sender: owner-v6ops@ops.ietf.org
Precedence: bulk

On 2010-03-22 10:28, Mark Townsley wrote:
> On 3/21/10 9:29 PM, james woodyatt wrote:
>> On Mar 21, 2010, at 12:18, Mark Townsley <townsley@cisco.com> wrote:
>>> On 3/21/10 6:29 PM, Brian E Carpenter wrote:
>>>>
>>>>
>>>> So, I'm wondering what's really wrong with:
>>>>
>>>>   REC-41  Gateways MUST provide an easily selected configuration option
>>>>       that permits operation in a mode that forwards all unsolicited
>>>>       flows regardless of forwarding direction.
>>>>
>>> The problem is the default, which is not to permit this.
>>>>
>>
>>
>> That problem is inherited from RFC 4864, which this draft is not
>> intended to reverse.
> Why not, if that is the current consensus? We've reversed the text of
> IETF standards track documents before, much less Informational documents
> that are not a standard of any kind.

As a co-author of 4864, let me agree violently. It's not a BCP.
Even if it was, consensus could reverse it.

What 4864 says is: NATs weren't designed as security devices but they
provide simple security by blocking everything incoming by default.
To implement simple security for v6 you should do it with a stateful
firewall.

It doesn't say that CPEs MUST do this. It leaves that choice open, as
an informational document.

    Brian

I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Fred Baker
Re: I-D.ietf-v6ops-cpe-simple-security-09 Fred Baker
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
Re: I-D.ietf-v6ops-cpe-simple-security-09 Ole Troan
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Baugher
RE: I-D.ietf-v6ops-cpe-simple-security-09 STARK, BARBARA H (ATTLABS)
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Fwd: I-D.ietf-v6ops-cpe-simple-security-09 - ICMP… Rémi Després
Re: I-D.ietf-v6ops-cpe-simple-security-09 - ICMP … james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 - ICMP … Rémi Després
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Smith
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Fred Baker
Re: I-D.ietf-v6ops-cpe-simple-security-09 Fred Baker
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Fred Baker
Re: I-D.ietf-v6ops-cpe-simple-security-09 Shane Amante
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Smith
Re: I-D.ietf-v6ops-cpe-simple-security-09 Cameron Byrne
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Smith
Re: I-D.ietf-v6ops-cpe-simple-security-09 Gert Doering
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Smith
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter
Re: I-D.ietf-v6ops-cpe-simple-security-09 james woodyatt
Status of RFC 4864 (was Re: I-D.ietf-v6ops-cpe-si… Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Smith
Re: I-D.ietf-v6ops-cpe-simple-security-09 Mark Townsley
Re: I-D.ietf-v6ops-cpe-simple-security-09 Ole Troan
Re: I-D.ietf-v6ops-cpe-simple-security-09 Brian E Carpenter