Subject: RE: Node Requirements Issue 3

From: Margaret Wasserman <[email-masked]>
Date: Sun, 27 Oct 2002 20:20:00 -0500

Hi Rich,

Could you elaborate a bit more?

Are there particular problems that would be caused by
limiting the use of site-local addresses to non-globally-
connected networks?

Margaret

At 12:53 PM 10/24/02, Richard Draves wrote:
>This is craziness. We (I don't mean just MS) have shipping
>implementations that support site-locals. We have operational
>deployments using site-locals. We have applications that work just fine
>with site-locals.
>
>Rich
>
>--------------------------------------------------------------------
>IETF IPng Working Group Mailing List
>IPng Home Page:                      http://playground.sun.com/ipng
>FTP archive:                      ftp://playground.sun.com/pub/ipng
>Direct all administrative requests to [email-masked]
>--------------------------------------------------------------------

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Mon, 28 Oct 2002 09:36:51 +0200 (EET)

> limiting the use of site-local addresses to non-globally-

I believe often an issue here is that OS/application vendors can just bind 
all the local services to nodes' site-local addresses, and make the 
security someone else's (ie router vendor, because site locals must not go 
out of the site) problem.

Needless to say that sounds pretty much like "NAT protection" today..

Pekka

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Keith Moore <[email-masked]>
Date: Mon, 28 Oct 2002 07:51:56 -0500

> out of the site) problem.

IMHO this is a really good reason for deprecating SLs entirely.

if nothing else, we should make it very clear that it is not acceptable 
for developers/vendors to assume that the threats from the local network 
are less, or significantly different, than the threats presented by 
the global Internet.

Keith

---

From: Margaret Wasserman <[email-masked]>
Date: Mon, 28 Oct 2002 08:38:02 -0500

>Needless to say that sounds pretty much like "NAT protection" today..

Right.  With the added "feature" that site-local IPv6 traffic may
transit IPv4 networks (via tunnels) that are not part of the
local site...

There are no security benefits to site-local addressing that can't be
better realized by appropriate filtering rules in routers.

Margaret