Subject: RE: Limiting the Use of Site-Local

From: Margaret Wasserman <[email-masked]>
Date: Wed, 30 Oct 2002 16:22:21 -0500

>
>I didn't say anything about site-locals and security
>and I didn't ask what link-locals are for. I said
>that you can create a tunnel to take link-locals
>beyond a link, so the problem is not specific to
>site-locals.

Actually, I think that there are some important differences
between link-locals and site-locals.

A router might (and probably should) be hard-coded not to
forward link-local packets, as there is no reason to ever
forward them.

However, a router that might ever need have multiple interfaces
in a single site can't be hard-coded not to forward site-locals.
Whether or not they will be forwarded is the result of
configuration.

There is another important difference that doesn't relate
directly to security (as far as I know): site-local prefixes
are advertised by routers, and they differ from link to link
(different subnet IDs), whereas the link-local prefix is a
single constant.

Margaret

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Ole Troan <[email-masked]>
Date: Wed, 30 Oct 2002 22:31:34 +0000

> forward link-local packets, as there is no reason to ever

one might imagine links where hosts need to use the router to reach
other hosts, e.g radio links, NBMA networks.

more importantly what purpose does it solve? routers will only forward
traffic to link-local destinations out the same link.

> (different subnet IDs), whereas the link-local prefix is a

with regards filtering traffic to site-local destinations. one would
not use normal traffic filters for this, as the incoming interface
decides which site the packet belongs to, and thereby which forwarding
table to do the lookup in. making the border interface belong to a
different site than any other interface achieves this.

/ot