Subject: RFC 5006 security considerations

From: Erik Nordmark <[email-masked]>
Date: Wed, 24 Mar 2010 13:42:53 -0700

Based on what I said at the mike, here is some suggested text to add to 
the security considerations section:

Some network devices such as switches might have mechanisms to block 
ports from being having a DHCPv6 server, which provides some protection 
against DHCP server spoofing. That means that an attacker on other ports 
can't insert bogus DNS servers using DHCPv6. The corresponding technique 
for RDNSS is to configure those devices to block Router Advertisement 
messages.

    Erik

---

From: Mohacsi Janos <[email-masked]>
Date: Thu, 25 Mar 2010 10:31:08 +0100 (CET)

On Wed, 24 Mar 2010, Erik Nordmark wrote:

>
> Based on what I said at the mike, here is some suggested text to add to the 
> security considerations section:
>
> Some network devices such as switches might have mechanisms to block ports 
> from being having a DHCPv6 server, which provides some protection against 
> DHCP server spoofing. That means that an attacker on other ports can't insert 
> bogus DNS servers using DHCPv6. The corresponding technique for RDNSS is to 
> configure those devices to block Router Advertisement messages.

As we try get ratified ra-guard draft in
http://datatracker.ietf.org/doc/draft-ietf-v6ops-ra-guard/

Best Regards,
 	Janos Mohacsi