Subject: [BEHAVE] ULA as PREF64

From: Cameron Byrne <[email-masked]>
Date: Sat, 18 Dec 2010 13:53:17 -0800

Are there any known limitations or problems with using ULA addresses
as the PREF64?

I do not want people from outside of my administrative domain to use
my DNS64 and NAT64.  Other mechanisms such as access lists will be
used, but in an attempt to have a layered approach to this particular
security issue, it seems to make sense that ULA be used as both the
queried address of the DNS64 as well as the NSP PREF64 that will be
used.

Any concerns that i am overlooking?

Thanks,

cameron

---

From: Simon Perreault <[email-masked]>
Date: Mon, 20 Dec 2010 11:10:03 -0500

> queried address of the DNS64 as well as the NSP PREF64 that will be

ULAs are probably more likely to be filtered by the customer. Although
in a mobile context you likely have more control over that...

Simon
-- 
DTN made easy, lean, and smart --> http://postellation.viagenie.ca
NAT64/DNS64 open-source        --> http://ecdysis.viagenie.ca
STUN/TURN server               --> http://numb.viagenie.ca

---

From: "Stephan Millet (stmillet)" <[email-masked]>
Date: Tue, 21 Dec 2010 20:50:33 -0800

My 2c worth,

Using ULAs will not allow your DNS64 to resolve using IPv6 as a
transport when talking to IPv6 enabled root servers or other IPv6
enabled authoritative servers.

If I can go slightly off topic, given that the NAT64 prefix is unique to
your network how could it be used by people outside your administrative
domain ? Other users could point their DNS queries to your DNS64, though
when crap answers get returned, that behaviour should stop relatively
quickly. (I am differentiating here between a DOS attack versus a
misconfigured resolver) 

Cheers

---- 
Stephan Millet 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Cameron Byrne
Sent: Sunday, 19 December 2010 8:53 AM
To: [email-masked]
Subject: [BEHAVE] ULA as PREF64

Thanks,

cameron
_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave

---

From: Behcet Sarikaya <[email-masked]>
Date: Wed, 22 Dec 2010 08:25:44 -0800 (PST)

> enabled authoritative servers.

This maybe true for standard servers. But here we are talking about DNS64 server 
which should be configurable by the operator to use ULA prefixes.

> your network 

This is not necessarily correct. An operator may use more than one NAT64 
prefixes and NAT64 servers.

> how could it be used by  people outside your administrative

Regards,

Behcet