Subject: RE: Limiting the Use of Site-Local

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Wed, 30 Oct 2002 22:27:27 +0100

Margaret, 

  > >I didn't say anything about site-locals and security
  > >and I didn't ask what link-locals are for. I said
  > >that you can create a tunnel to take link-locals
  > >beyond a link, so the problem is not specific to
  > >site-locals.
  > 
  > Actually, I think that there are some important differences
  > between link-locals and site-locals.

=> I hereby declare to the ML that I completely
agree that link-locals and site-locals are different :)
The point was: using tunnelling to evade scope boundaries.
This can be done in a zillion ways for different addresses, 
if we're not careful how the tunnel is setup or if a malicious
node is inside the site and can fool the firewall (if one exists).

Just making sure that we're talking about the same thing.
Hesham 

  > 
  > A router might (and probably should) be hard-coded not to
  > forward link-local packets, as there is no reason to ever
  > forward them.
  > 
  > However, a router that might ever need have multiple interfaces
  > in a single site can't be hard-coded not to forward site-locals.
  > Whether or not they will be forwarded is the result of
  > configuration.
  > 
  > There is another important difference that doesn't relate
  > directly to security (as far as I know): site-local prefixes
  > are advertised by routers, and they differ from link to link
  > (different subnet IDs), whereas the link-local prefix is a
  > single constant.
  > 
  > Margaret
  > 
  > 
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Margaret Wasserman <[email-masked]>
Date: Wed, 30 Oct 2002 16:38:48 -0500

Hi Hesham,

>agree that link-locals and site-locals are different :)

:-)

Sorry if my note seemed condescending or something... I
didn't mean it that way.

>node is inside the site and can fool the firewall (if one exists).

I completely agree...

The current discussion is (I think) attempting to compare the
security implications of two ways of addressing a private
network:

         - Using site-local addresses that are filtered at
                 an SBR due to site configuration.
         - Using global addresses that are filtered at the
                 border of the private address space using
                 routing filters.

In neither case would the addresses being used on the private
network appear in global routing tables.

I still don't really understand why these cases are substantially
different in terms of security... Not that I'm claiming to be
a security expert or anything, but I would like to understand
what the difference are, if any.

Margaret

---

From: Rob Austein <[email-masked]>
Date: Wed, 30 Oct 2002 18:05:48 -0500

I've heard this argument that site-local addresses somehow make the
site border router filtering problem easier, and I don't get it.  As
far as I can tell, they don't help at all, and in fact just make the
problem a little worse.  I have to filter all the kinds of addresess
that shouldn't be crossing my router anyway (eg, ingress filtering,
various whacky combinations of transition address spaces with various
kinds of IPv4 addresses, etc), whether applications in my site are
using site-local addresses or not.  Site-local addresses are just one
more flipping thing I have to filter.

So how were site-local addresess helping me with this problem again?