Subject: [v4tov6transition] IPSec

From: "Chandran, Girish" <[email-masked]>
Date: Mon, 6 Sep 2010 15:11:34 -0700

While IPSec implementation is mandatory with IPv6, I assume IPSec use is
not mandatory. Is this assumption correct? What percentage of apps use
this mandatory IPSec in IPv6, other than the standard VPN apps.

Thanks,

Girish

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 07 Sep 2010 10:38:36 +1200

On 2010-09-07 10:11, Chandran, Girish wrote:
> While IPSec implementation is mandatory with IPv6, 

Well, not in reality - that is a fiction in the standards,
propagated in some quarters as a myth about IPv6 being more secure.
Look for the thread "Node Requirements: Issue 17 - IPsec/IKE"
in the 6MAN WG mail archive for July 2010.

> I assume IPSec use is

The incentives to use IPsec are identical for IPv4 and IPv6.
I would guess that today, usage of IPsec in IPv6 is basically
zero, and this will only change when the widespread enterprise
VPN implementations are upgraded.

   Brian

---

From: "Yiu L. Lee" <[email-masked]>
Date: Mon, 6 Sep 2010 18:47:17 -0400

Well, many people argue that IPv6 is in fact less secure because there is no
NAT to shield your home network (side effect of the ill NAT) and people can
find out your mac-address if your host uses simple auto-configuration to
construct the source IPv6 address.

So far I don't know of any vendor has hardware solution for IPSec for v6.
But this is supply-and-demand problem. There is no (or very less) demand, so
no supply is available. Things will change in time.

On 9/6/10 6:38 PM, "Brian E Carpenter" <[email-masked]> wrote:

> _______________________________________________
> v4tov6transition mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v4tov6transition

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 07 Sep 2010 12:21:54 +1200

Hi,

As for the NAT argument, that's why we wrote RFC 4864,
and also see draft-ietf-v6ops-cpe-simple-security.

Regards
   Brian