Subject: RE: draft-ietf-v6ops-nap-04

From: "Gunter Van de Velde \(gvandeve\)" <[email-masked]>
Date: Wed, 1 Nov 2006 19:42:33 +0100

I was wondering on the message we agree upon here for this particular
point, so we can work on a re-write?

<>
NAT does provide a feeling of security that should not be there, however
with IPv6 people will receive more indicative signals on more secure
topologies for their infrastructure/applications/OperatingSoftware?
<>

G/

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Brian E Carpenter
Sent: Wednesday, November 01, 2006 4:50 PM
To: Margaret Wasserman
Cc: [email-masked]; Jari Arkko
Subject: Re: draft-ietf-v6ops-nap-04

Margaret Wasserman wrote:
> 
> Hi Brian,
> 
> On Oct 31, 2006, at 6:07 AM, Brian E Carpenter wrote:
> 
>>> the right place to define a new untraceable addressing mechanim.
>>
>>
>> It certainly can't purport to be a formal spec. But removing it would

>> leave a hole. Would you be OK with adding some clear disclaimer text 
>> saying that it is not a formal spec?
> 
> 
> I can live with that.
> 
>>
>>>  >   o  On a local network, any user will have more security
awareness.
>>>  >      This awareness will motivate the usage of simple firewall
>>>  >      applications/devices to be inserted on the border between
the
>>>  >      external network and the local (or home network) as there
is no
>>>  >      Address Translator and hence no false safety perception.
>>> [Substantive] IPv6 will not make users have more security awareness.
>>> When we say something like this, we are emitting the same type of 
>>> marketing hype that we deride in the vendors of NAT products.  This 
>>> bullet should just be omitted.
>>
>>
>> Yes, it's a bit slack, and naive about the way real users behave.
> 
> 
> Based on your indication that there are two issues that you are not 
> going to fix, I gather you aren't going to fix this one, even though 
> you agree that it is slack and naive?  Why not?

That's really not what I meant. I think this text does need fixing.
I'm a bit reluctant to delete it because I think there is a nugget of
value in there. But we authors need to get together; I can't speak for
the others.

     Brian

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 02 Nov 2006 13:58:17 +0100

As Fred has pointed out, NAT is functionally
equivalent to a stateful firewall. What we can say is:

NAT provides exactly the same level of security as a stateful
firewall, and no more. Therefore, IPv6 users behind a stateful
firewall are entitled to exactly the same feeling of security
as users behind an IPv4 NAT; no more and no less.

    Brian

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Thu, 2 Nov 2006 16:09:53 +0200

Hello,

On Thu, Nov 02, 2006 at 01:58:17PM +0100, Brian E Carpenter wrote :
> equivalent to a stateful firewall.

Errmm, NAT do no more than stateful firewall, and are in many but not
all case so close to it that can be considered equivalent. But it's not
always so. In particular, stateful firewalls tend to be more strict as
to what they accept as a "solicited response" from the outside toward
the inside than NATs.

> as users behind an IPv4 NAT; no more and no less

I'd rather have "NAT provides a level of security that is no better than
that of a stateful firewall, in any case. There, IPv6 users behind a
stateful firewall are entitled to as good a feeling of security as users
behind an IPv4 NAT, if not more; and the exact same feeling of security
as users behind an IPv4 stateful firewall."

??

-- 
Rémi Denis-Courmont
looking for a job
http://www.simphalempin.com/home/infos/CV-en.pdf

---

From: Pekka Savola <[email-masked]>
Date: Thu, 2 Nov 2006 22:33:34 +0200 (EET)

> to what they accept as a "solicited response" from the outside toward

Indeed.  If you look at draft-ietf-behave-udp-08.txt (in RFC editor's 
queue), those recommendations very specifically recommend designs 
where the inbound packets will be accepted from a wider set of 
addresses and ports that would be strictly required (by traditional 
apps) by inside-to-outside communication.

I raised this issue during IETF LC, but this was not changed because 
p2p-like apps seem to require more relaxed behaviour for easier 
interworking.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Thu, 2 Nov 2006 22:40:07 +0200

> p2p-like apps seem to require more relaxed behaviour for easier

That's ok by me.

I personnaly consider that NAT should never be used as a security 
device, but only to work-around IPv4 shortage, so I don't it being 
relaxed. If you want security, use a stateful firewall. Combine both if 
you need to.

-- 
Rémi Denis-Courmont
soon graduating