Subject: RE: SUMMARY: RE: Limiting the Use of Site-Local

From: "Michel Py" <[email-masked]>
Date: Sun, 3 Nov 2002 16:19:57 -0800

Margaret,

>> Michel Py wrote:
>> I fail to see what the problem is if the node is a router
>> that has a global on one interface and a site-local one
>> on another interface.

> Margaret Wasserman wrote:
> If you have a site-border router in two sites, and the
> hosts in one of the sites _only_ have site-local addresses,
> then you don't need a router at all, as it will never
> forward any packets. The hosts in the site that only has
> site-local addresses will not be able to send any packets
> outside the site, and no hosts from outside the site will
> be able to send any packets to them.

Which is precisely what I want, that would be Router A.

However, I was referring to a router that has a global on one interface
and a site-local one on another interface, such as Router B below, and
both interfaces are part of the same site. Again, what is the problem
with this?

<-------------------- Global Addresses ----------------><-- SL addr -->
+-----+
| ISP |    :
+--+--+    :
   !       :
+--+---------+  +----------+     +----------+     +----------+
| Router A : +--+ Firewall +--+--+ Firewall +--+--+ Router B +---+
+------------+  +----------+  |  +----------+  |  +----------+   |
           :                  |                |                 |
           :              +---+--+          +--+---+        +----+----+
           :              | DFZ  |          | Host |        | Control |
           :              | Host |          +------+        | Device  |
           :              +------+                          +---------+
---Site -->:<-------------------------- Site ------------------------->
           :
Michel.

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Margaret Wasserman <[email-masked]>
Date: Mon, 04 Nov 2002 03:20:54 -0500

Hi Michel,

><-------------------- Global Addresses ----------------><-- SL addr -->

Yes, this makes more sense...

I think that this would be a perfectly legal network configuration
under the current scoped addressing architecture rules, and it
would result in outside hosts being unable to reach the control
devices.

However, I don't see that it offers any special security benefits
over putting the control devices on a separate subnet of the global
prefix and filtering that subnet in router A and the left-most
firewall.

Either way, if someone from the outside can hack into one of your
DFZ hosts (by which I assume you mean servers that are accessible
from the outside?), he can potentially reach your control devices.

Margaret