Subject: RE: Fwd: IPv6 Scoped Addresses and Routing Protocols

From: "Michel Py" <[email-masked]>
Date: Fri, 7 Jun 2002 19:32:28 -0700

>> Michel Py wrote:
>> On the other hand, considering that a typical IPv6 will _not_ feature
>> IPv6 NAT, an IPv6 host that has _only_ a site-local address would
have
>> an extra layer of protection against external attacks as it would not
be
>> reachable at all from the outside.

> Bill Sommerfeld wrote:
> I see this as a distinction without a difference -- if the site has
> some systems running a global p2p network's software with external
> connectivity, and that p2p network is cracked, the site will be
> vulnerable to attacks relayed through the p2p network.
> if one system within the site has external connectivity and is part
> of the compromised p2p network, any system at the site will now be
> open to attacks from the compromised system.

I don't know on which planet you are living, but on earth a system that
has no direct access to the outside is more secure than a system that
does; this is called a fact, not a distinction. Security is the sum of
different things, including passwords, firewalls _and_ preventing direct
access from the Internet.

> If there is widespread deployment of systems with site-local only
> addresses, this will in turn drive the creation of ipv6 NAT
> specifically to give them external connectivity..

That looks like a solution without a problem. To give these hosts
connectivity you just have both the site-local and the global address.
Since NAT would not bring anything to the table why implement it in the
first place?

Michel.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Sat, 8 Jun 2002 13:19:50 +0300 (EEST)

> Since NAT would not bring anything to the table why implement it in the

To give folks that think IPv4 private addresses provide security 
(especially wrt. incoming connections) a smooth transition path to IPv6 
and "warm fuzzy feeling".

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Bill Sommerfeld <[email-masked]>
Date: Sat, 08 Jun 2002 14:12:10 -0400

I think i was a little too subtle in my original post.

Denying external connectivity on a host-by-host basis is harder than
it looks, because if any system with external connectivity at any
layer is compromised, it can be used as a springboard to attack
"internal" systems which the firewall allegedly protects.

Site-local addresses add complication and do nothing that a site
couldn't do already by setting aside part of its address space to be
blocked at a firewall.

The belief that site boundaries will be configured correctly is
equivalent to the belief that site boundary firewalls will be
configured correctly.

						- Bill