IPv6 Security [Was: Re: misunderstanding scale]
Jack Bates
jbates at brightok.net
Wed Mar 26 18:17:26 UTC 2014
On 3/26/2014 12:55 PM, Luke S. Crawford wrote:
>
> However, DHCPv6 isn't anywhere near as useful for me, as someone who
> normally deals with IPs that don't change, as DHCPv4 is.
>
My favorite is the RA thing. Years ago I decided that stupid DSLAMs were
better than smart ones, so I generally utilize 1 vlan per customer with
q-in-q and let the router handle all security. This meant I didn't have
the usual breakage smart DSLAMs had with IPv6. Ideally, the router would
run passive and not send regular RA updates. However, that isn't always
viable with all clients. Sending out regular announcements and
replicating them to all the vlans is extremely inefficient.
Jack
More information about the NANOG
mailing list