Subject: RE: draft-ietf-v6ops-ipv6-cpe-router-04

From: "Frank Bulk" <[email-masked]>
Date: Fri, 26 Mar 2010 00:25:48 -0500

There was some discussion on arin-ppml regarding ULA-C which led to talking
about NAT and it's role.

One point that rose out of that discussion is that most consumers will
presume, because they have NAT today, some kind of stateful firewall in
their shiny new IPv6 router.  Section 3.1 of the current draft discusses
current NAT behavior in IPv4 routers, but the draft in its current form
doesn't describe a CPE feature that provides similar functionality in an
IPv6 CPE router.

For that reason (with assistance from Michael Dillon), I would like to
suggest the following be placed in section 4.2, perhaps as W-4.

	All IPv6 CPE should include a stateful firewall,
	enabled by default, to give end user networks 
	some of the benefits that they gain from the 
	stateful firewall behavior that is part of most 
	IPv4 NAT implementations.  The firewall should 
	support the configuration of a DMZ on a certain 
	IPv6 address or prefix.  It should include
	support inbound access control lists and may
	include support for outbound access control lists.

Without this behavior these IPv6 routers will be just that, routers, and
unnecessarily expose broadband customer hosts to Internet-based probing and
attacks.  A stateful firewall for IPv6 traffic would provide some beneficial
functional consistency between the two IP versions.

With the existence of several *nix-based open source firewall packages,
implementation would not be burdensome.

Perhaps some of you feel strongly enough about this you would change the
"should" to "must".  I'm OK with that, but that might set the bar too high.

Kind regards,

Frank Bulk

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 27 Mar 2010 03:12:25 +1300

Frank,

You obviously haven't been tracking the current discussion
on draft-ietf-v6ops-cpe-simple-security on the v6ops list,
which is where the cpe-router draft belongs anyway.

I suggest that you read that thread.

Regards
   Brian Carpenter

On 2010-03-26 18:25, Frank Bulk wrote:
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>

---

From: "STARK, BARBARA H (ATTLABS)" <[email-masked]>
Date: Fri, 26 Mar 2010 10:38:21 -0400

Frank,
Yeah, I think that after the bloody simple-security debates of the past
week, that many are amazed that anyone on this list was able to miss the
carnage. Anyway, the current CPE router draft has the following security
requirements in section 4.4:

   S-1:  The IPv6 CE router SHOULD support
         [I-D.ietf-v6ops-cpe-simple-security].

   S-2:  The IPv6 CE router MUST support ingress filtering in accordance
         with [RFC2827](BCP 38)

The simple-security draft referenced in S-1 describes exactly what
you're asking for (IMO), only in much greater detail. So I think what
you're asking for is already in the cpe-router draft, and it would be a
good idea for you to look at the simple-security draft and provide
comments to it, if you think there's something missing. 
Barbara

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
Of
> Brian E Carpenter
> Sent: Friday, March 26, 2010 10:12 AM
> To: [email-masked]
> Cc: IETF IPv6 Mailing List
> Subject: Re: draft-ietf-v6ops-ipv6-cpe-router-04
> 
> Frank,
> 
> > doesn't describe a CPE feature that provides similar functionality
in
> an
> > "should" to "must".  I'm OK with that, but that might set the bar
too
> high.

---

From: Ole Troan <[email-masked]>
Date: Fri, 26 Mar 2010 08:11:49 -0700

> comments to it, if you think there's something missing. 

indeed, apart from the fact that it does not/will not make any recommendation about default on or off.

cheers,
Ole

---

From: "Perkins, Carroll G" <[email-masked]>
Date: Fri, 26 Mar 2010 11:53:25 -0400

In all of these discussions, I am amazed that no one has mentioned that NIST has written a set of IPv6 implementation requirements for all US manufactured equipment that addresses many of the discussion issues.

NIST SP-800-115 Guidelines for the Secure Deployment of IPv6
NIST SP-500-267 A Profile for IPv6 in the US Government - Version 1.0

These documents were developed under the statutory responsibilities of the Federal Information Security Management Act (FISMA) of 2002, Public Law 107-347.  The recommendations in these reports are enforced by the Federal Acquisition Language (FAR) requirements stated in RIN 9000-AK57 as FAR Case 2006-041, Internet Protocol Version 6 (IPv6).
In short, follow the FAR law for IPv6 devices or the US Government will not purchase a vendor IPv6 device. This law applies to all Federal Government departments, agencies, offices, including DoD, NASA, Dept of Commerce, Veterans Administration, literally all Federal government purchasing offices and all equipment purchased via Federal funding dollars or the GSA bidding process.

IPv6 routers are similar to automobiles at this point in time.  If the device is sold in the US, then it must conform to US law.  That is the way that unleaded gas came into use, through Federal Law implemented as a certain size gas tank nozzle.  For IPv6, the transported packets may not be liquid, but the core principle of controlling the transport "ground rules" is the same.  A vendor can break the law just as replica makers violate copyright law, but the vendor is liable for damages if that is his organization's choice.

Carroll Perkins

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Ole Troan
Sent: Friday, March 26, 2010 11:12 AM
To: STARK, BARBARA H (ATTLABS)
Cc: IETF IPv6 Mailing List; Brian E Carpenter
Subject: Re: draft-ietf-v6ops-ipv6-cpe-router-04

cheers,
Ole

---

From: james woodyatt <[email-masked]>
Date: Fri, 26 Mar 2010 10:33:49 -0700

[added V6OPS list]

> indeed, apart from the fact that it does not/will not make any recommendation about default on or off.

If the editors of I-D.ietf-v6ops-ipv6-cpe-router would like to host the debate over whether or not to make such a recommendation, then that would make me very, very happy.  We could declare all such flames out of scope for the discussion to review I-D.ietf-v6ops-cpe-simple-security.  I might even consider bribing you with chocolates and fruit baskets if that would help.

--
james woodyatt <[email-masked]>
member of technical staff, communications engineering

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 27 Mar 2010 06:35:16 +1300

Once again, this is a v6ops topic, so this will be my last comment
here on the 6man list:

Except that this is truly obnoxious and paranoid:

> Organizations that are not yet deploying IPv6 should implement the following recommendations:
>  
> * Block all IPv6 traffic, native and tunneled, at the organization's firewall. Both incoming and outgoing traffic should be blocked. 

This, if applied, would block all early-adopter activity.

More reasonable guidelines are in draft-ietf-v6ops-cpe-simple-security
and an approach that actively helps Internet transparency is suggested in
draft-vyncke-advanced-ipv6-security.

These are much more fruitful approaches than the NIST guideline, which
I hope will be widely disregarded.

   Brian

---

From: Ole Troan <[email-masked]>
Date: Fri, 26 Mar 2010 10:43:31 -0700

James,

> If the editors of I-D.ietf-v6ops-ipv6-cpe-router would like to host the debate over whether or not to make such a recommendation, then that would make me very, very happy.  We could declare all suc…

I'm known to both like chocolate and be gullible, but not _that_ gullible. ;-)

cheers,
Ole

---

From: "Frank Bulk - iName.com" <[email-masked]>
Date: Fri, 26 Mar 2010 16:45:43 -0500

My apologies for posting to the wrong list -- I didn't realize there was a
second v6ops listserv for IETF-related discussion (I also subscribe to
[email-masked] at ). 

Looks like ietf-v6ops-cpe-simple-security more than covers my little
paragraph, except the phrase "stateful firewall" is nowhere to be found.

Frank

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
james woodyatt
Sent: Friday, March 26, 2010 12:34 PM
To: IETF IPv6 Mailing List
Cc: IPv6 v6ops
Subject: Re: draft-ietf-v6ops-ipv6-cpe-router-04

[added V6OPS list]

> indeed, apart from the fact that it does not/will not make any
recommendation about default on or off.

If the editors of I-D.ietf-v6ops-ipv6-cpe-router would like to host the
debate over whether or not to make such a recommendation, then that would
make me very, very happy.  We could declare all such flames out of scope for
the discussion to review I-D.ietf-v6ops-cpe-simple-security.  I might even
consider bribing you with chocolates and fruit baskets if that would help.

---

From: Mark Townsley <[email-masked]>
Date: Fri, 26 Mar 2010 23:08:29 +0100

>>>         [I-D.ietf-v6ops-cpe-simple-security].
What does "support" mean?

I would like it to be very clear that "support" does not imply that it 
be set to "transparent" or "non-transparent" mode by default, just that 
the functionality exist and be available to be turned on or off.

- Mark
> james woodyatt<[email-masked]>