Subject: RE: Limiting the Use of Site-Local

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Wed, 30 Oct 2002 21:49:49 +0100

> > ... How do you reconfigure a router to forward
  > > site-local traffic to the outside?
  > 
  > create a tunnel.

=> I guess you would give the same answer
for link-locals and many other cases. 
So, if you have a tunnel, secure it. 
We've had the exacrt same problems with
MIPv6. These are not specific to site-locals.

Hesham

  > 
  > 					- Bill
  > --------------------------------------------------------------------
  > IETF IPng Working Group Mailing List
  > IPng Home Page:                      http://playground.sun.com/ipng
  > FTP archive:                      ftp://playground.sun.com/pub/ipng
  > Direct all administrative requests to [email-masked]
  > --------------------------------------------------------------------
  > 
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Bill Sommerfeld <[email-masked]>
Date: Wed, 30 Oct 2002 16:04:13 -0500

> for link-locals and many other cases. 

link-locals are there for autoconfiguration, not security.

> So, if you have a tunnel, secure it. 

answer is non-responsive.  we were discussing unauthorized
router modifications.

site locals do not result in a meaningful improvement in security to a
site of nontrivial size -- any node with a global address may
unilaterally "choose" to extend the site...

						- Bill

---

From: Keith Moore <[email-masked]>
Date: Wed, 30 Oct 2002 16:50:23 -0500

> MIPv6. These are not specific to site-locals.

I think the point is that SLs aren't more immune to security problems
than globals.  If you can tweak the router configuration you can find
a way to route them off-site.
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------