Subject: RE: Limiting the Use of Site-Local

From: "Michel Py" <[email-masked]>
Date: Wed, 30 Oct 2002 12:23:16 -0800

> Margaret Wasserman wrote:
> If you can compromise the edge router and change its
> configuration, you can get either intra-site global
> or site-local traffic to be forwarded outside of the
> site.

Oh really? Maybe you can explain us how you would do that?

Let's see, by announcing FE80::/10 or FEC0::/10 to the peers. Problem
is, most of them are not that dumb and will filter it.

Or maybe, you have a special version of IOS that has IPv6 NAT in it so
it enables the host with a link-local address to communicate with the
outside.

So Margaret, tell us: How do you reconfigure a router to forward
site-local traffic to the outside?

Michel.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Bill Sommerfeld <[email-masked]>
Date: Wed, 30 Oct 2002 15:32:11 -0500

> ... How do you reconfigure a router to forward

create a tunnel.

					- Bill

---

From: Ralph Droms <[email-masked]>
Date: Wed, 30 Oct 2002 15:33:43 -0500

Would you please check your sarcasm at the door?

Presumably, if this is a router that can be used either internally or at 
the edge of a network, it can be configured so that all of its interfaces 
are part of the same site (so that it forwards site-locals) or that some of 
its interfaces are not part of the site (so that it doesn't forward site 
locals).

- Ralph Droms

---

From: Margaret Wasserman <[email-masked]>
Date: Wed, 30 Oct 2002 16:15:12 -0500

>site-local traffic to the outside?

It depends what you mean by the "outside".

If I am on a link that is attached to the SBR, but in another
site, I could reconfigure the router to consider my link as part
of the site.

If I am further away from the router, I could possibly configure
the router to tunnel site-local traffic across the underlying (v4
or v6) network.

Let me turn the question around...  You have posited that the
use of site-local address is somehow more "secure" than using
a private global address range that is filtered in the router.
Why?  What attacks would work in the latter case that wouldn't
work in the former case?

Margaret