misunderstanding scale

Mon Mar 24 17:36:46 UTC 2014

On 2014-03-24, "Naslund, Steve" <SNaslund at medline.com> wrote:
>If they have a stateful IPv6 firewall (which they should and which most firewall vendors support), they already have what they need to prevent their internal systems from being accessible from the outside.  If you are an enterprise and you don't have a stateful firewall, you are in trouble from a security standpoint whether you run v4 or v6.  If you cannot configure a stateful firewall to block connections being initiated from outside, you are not qualified to be working with the firewall, v4 or v6 does not matter.  If someone is relying on NAT in case their firewall is misconfigured, they have major issues with security.
>
>In the home, I am not sure what the major issue is there either.  How many CPE devices have you seen that do not implement basic firewall functionality?  People may not use them correctly but that is no more an issue with v6 than it is with v4.  Most CPE even comes out of the box blocking inbound connections by default.

Tell that to our little D-Link AP/router with stateless filters only for v6, 
and broken config options that make it impossible to apply even that to a 
tunnel interface (HE).

I agree with you on pushing v6 adoption and that the at the root of it you 
should have a stateful firewall be it v4 or v6, but:

- if this thread is any indication and as per your first paragraph, way too 
  many orgs are depending on NAT as a security feature and v6 is exposing that 
weakness in their posture
- home CPE implementations are largely crap, and good luck getting a decent 
  portion of them supporting (functional) stateful v6 firewalls

>
>Steve
>

--
Hugo

>
>-----Original Message-----
>From: Mark Tinka [mailto:mark.tinka at seacom.mu]
>Sent: Monday, March 24, 2014 11:35 AM
>To: Timothy Morizot
>Cc: NANOG list
>Subject: Re: misunderstanding scale
>
>
>>>Don't disagree with you there.
>
>>>I'm saying many an enterprise (small and large) as well as homes operate this way. There is a lot of unlearning to do.
>
>>>The whole issue is that a number of enterprises "may" only feel safe if IPv6 comes with NAT66, probably on top (or not on top) of a stateful IPv6 firewall.
>
>>>We need to think about how to re-train the enterprise, if we don't want to repeat the erasure of the end-to-end model, second time around.
>
>>>Mark.
>

-- 
Hugo Slabbert
Network Specialist
Phone: 604.606.4448
Email: hslabbert at stargate.ca

Stargate Connections Inc.
http://www.stargate.ca

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20140324/2d682080/attachment.sig>