Subject: [OPSEC] I-D Action: draft-ietf-opsec-v6-18.txt

From: [email-masked]
Date: Sat, 21 Sep 2019 00:09:15 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure WG of the IETF.

        Title           : Operational Security Considerations for IPv6 Networks
        Authors         : Eric Vyncke
                          Kiran K. Chittimaneni
                          Merike Kaeo
                          Enno Rey
	Filename        : draft-ietf-opsec-v6-18.txt
	Pages           : 52
	Date            : 2019-09-21

Abstract:
   Knowledge and experience on how to operate IPv4 securely is
   available: whether it is the Internet or an enterprise internal
   network.  However, IPv6 presents some new security challenges.  RFC
   4942 describes the security issues in the protocol but network
   managers also need a more practical, operations-minded document to
   enumerate advantages and/or disadvantages of certain choices.

   This document analyzes the operational security issues in several
   places of a network (enterprises, service providers and residential
   users) and proposes technical and procedural mitigations techniques.
   Some very specific places of a network such as the Internet of Things
   are not discussed in this document.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-opsec-v6/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-opsec-v6-18
https://datatracker.ietf.org/doc/html/draft-ietf-opsec-v6-18

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-opsec-v6-18

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Sat, 21 Sep 2019 07:29:53 +0000

With this revision, the authors have taken into account the very extensive review by Jen Linkova and other previous comments from Donald Smith, Jordi Palet and Bernie Volz.

As discussed at IETF-105, the authors would like to start another working group last call.

Let's finish this document with the assistance of the OPSEC community

Regards

-éric -merike -kk and -enno

On 21/09/2019, 09:10, "OPSEC on behalf of [email-masked]" <[email-masked] on behalf of [email-masked]> wrote:

    
    Abstract:

    

    
    
    _______________________________________________
    OPSEC mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/opsec

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 22 Sep 2019 09:13:29 +1200

Hi,

I think the ULA section is still not quite right.

> 2.1.1.  Use of ULAs
> 
>    Unique Local Addresses (ULAs) [RFC4193] are intended for scenarios
>    where systems are not globally reachable, despite formally having
>    global scope.  ULA are not similar to [RFC1918] addresses and have
>    different use cases.  One use of ULA is described in [RFC4864] and
>    some considerations on using ULA is described in the draft document
>    [I-D.ietf-v6ops-ula-usage-considerations]; this document failed to
>    have the IETF consensus and is now considered as dead.

1. I think it is worth mentioning that ULAs should be filtered at domain
boundaries.

2. Actually they are *similar* to RFC1918 - but they are not the same.

3. I don't think there is any use in referencing a draft that you describe
as "dead".

So, a possible rewrite:

2.1.1.  Use of ULAs

   Unique Local Addresses (ULAs) [RFC4193] are intended for scenarios
   where interfaces are not globally reachable, despite being routed
   within a domain. They formally have global scope, but RFC 4193
   sepcifies that they must be filtered out at domain boundaries.
   ULAs are different from [RFC1918] addresses and have different use
   cases. One use case is described in [RFC4864].

Regards
   Brian Carpenter

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Sun, 22 Sep 2019 12:05:20 +0000

Brian,

Thank you for the improved text. 

Expect a -19 any time soon

-éric

On 21/09/2019, 23:14, "OPSEC on behalf of Brian E Carpenter" <[email-masked] on behalf of [email-masked]> wrote:

    Hi,

    

    
    So, a possible rewrite:
    
    2.1.1.  Use of ULAs

    Regards
       Brian Carpenter

---

From: Bob Hinden <[email-masked]>
Date: Sun, 22 Sep 2019 08:12:48 -0700

Eric,

I support Brian’s proposed changes.

Bob

> On Sep 22, 2019, at 5:05 AM, Eric Vyncke (evyncke) <[email-masked]> wrote:
> 
> Brian,
>