Re: [v6ops] Operational Consensus on deployment

[Ted Lemon <[e-mail]>]

On Aug 5, 2014, at 5:39 PM, Philip Homburg <[e-mail]> wrote:
>> Presumably you'll want a firewall inside of the SIIT gateway, to deal
>> with IPv6 ACLs? If so, you only need one firewall and only one ACL. If
>> you previously had an ACL that said something like in iptables syntax,
>> where 192.0.2.100 is the trusted IP address you want to allow:
>> 
>> --source 192.0.2.100 --protocol tcp --dport ssh -j ACCEPT
>> 
>> ...with SIIT, you'd instead do, assuming 64:ff9b::/96 is the translation
>> prefix):
>> 
>> --source 64:ff9b::192.0.2.100 --protocol tcp --dport ssh -j ACCEPT
> 
> Now we wait for somebody to type 64:ff9b::192.0.2.0/24 instead of
> 64:ff9b::192.0.2.0/120.
> 
> Also, this not in canonical form. So any program that outputs these address
> uses a different syntax. Try grepping your firewall config for an address
> you see in tcpdump and not finding it.
> 
> And I wonder howmany people understand this notation at all.

Gnaagh!   I really hope people aren't configuring their firewalls this way, but I don't have much operational involvement with firewalls, so maybe they do?   This seems hopelessly primitive and error-prone.