Subject: RE: Limiting the Use of Site-Local

From: "Michel Py" <[email-masked]>
Date: Wed, 30 Oct 2002 20:05:07 -0800

Margaret,

> Margaret Wasserman wrote:
> You have made a statement that the use of IPv6
> site-local addresses (as opposed to globally
> unique addresses) will increase the security
> of a private network.  And, I still don't
> understand the basis for that claim.

Semantics: I would have said "globally routable" instead of "globally
unique", as some mechanisms such as including the ASN in the upper bits
of a site-local address could make it globally unique and not globally
routable. That being said, the reasons the mechanism mentioned above has
not convinced is because it was a disguised globally routable address
anyway.

> Could you please answer the following question
> that I posted earlier?

I have. Shall I expect a response, or is what Richard and I have posted
enough to convince you that there are indeed some security benefits in
using site-local address when designing a security perimeter in a
private network?

Michel.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Keith Moore <[email-masked]>
Date: Thu, 31 Oct 2002 00:08:25 -0500

> Shall I expect a response, or is what Richard and I have posted

I don't think you've made a convincing case for this.  

I generally agree that an SL address that somehow appears in
a network remote from the site in which it was used is not likely 
to be able to make it back to that site via the network's normal
routing mechanisms.  Some sort of tunnel is likely to be necessary.

On the other hand there are far more opportunities to filter an 
address that does have a global prefix (you're not limited to filtering
them at the border of the "site"), or to detect the use of such addresses 
on networks where they are supposed to be filtered, or to log such 
addresses for traffic analysis.  

I also don't think you've made a convincing case that a single, 
non-permeable security perimeter is a very useful feature of an
addressing architecture.

I do think you've made a case for using SLs in isolated networks, 
or nearly isolated networks where the only interactions between
those networks and other networks are via special-purpose 
applications.  As I said earlier I don't have a problem with using
SLs in that corner case.  I do have a problem with promoting SLs
as a security mechanism for use in general-purpose network where
off-the-shelf apps are exposed to a mixture of SLs and globals.

Keith

---

From: Margaret Wasserman <[email-masked]>
Date: Thu, 31 Oct 2002 09:11:27 -0500

>not convinced is because it was a disguised globally routable address

I think that this is the source of our misunderstanding.

I am _not_ operating under the assumption that all globally-unique
addresses will appear in global routing tables.  If I want to have
a private network, I should be able to get a globally unique (routable,
but _not_ necessarily globally routed) address, and _not_ have my ISP
advertise that prefix into the global routing tables.  If my ISP's
policy (or some higher-level policy) requires that I get a second
/48 in order to have address space that isn't advertised, I could
just get a second /48...

Of course, I don't have to simply trust my ISP not to inject my
private network addresses into the global routing tables -- I can
also run filters on my edge routers that don't allow traffic
from/to links outside of my private network using those addresses.

As far as I can tell, this approach has all of the putative
advantages of site-local addressing, without the problems caused
by using the same addresses on every private network (creating
ambiguity and the potential for traffic to be sent to the wrong
node -- same address, wrong site).  Upper-level protocols would
not have to be aware of these addresses as anything special, and
all of the costs associated with private addressing would accrue
to the people who actually want to use them -- they'd have to
decide whether or not to run two-faced DNS, how to make sure
that globally-routed addresses are used to talk to the outside,
etc.

Site-local addresses could continue to be useful in networks
that are not routed (at all) to the global network.  This would
include isolated sites, non-Internet-connected sites within
cars and planes, etc.

I actually _agree_ that it would be better if I could obtain
provider-independent global addresses.  But perhaps that is a
different fight for a different day...

Margaret