Subject: RE: New draft-vasilenko-6man-nd-mitm-protection-00.txt against SAVI (RFC6620)

From: Vasilenko Eduard <[email-masked]>
Date: Mon, 28 Sep 2020 13:13:31 +0000

Hi All,
The comment from Fernando is reasonable:
> > https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_fhsec/configuration/15-sy/ip6-nd-inspect.html
Proposed draft is the replacement of SAVI.
Proposed draft is a little better:
- SAVI is very complicated and expensive on switches, available only  on small portion of vendors
- Intruder could be 1st to claim address (if server is in reload), then SAVI would create MITM: all users (from other subnets) would contact server and show credentials to intruder
- it is better to fix L3 problem at L3, not rely on L2 for L3 security
But in principle - it is possible to rely on SAVI.

Before WG would make a decision to leave this ND security problem to L2.

Fernando,
I have googled who else support RFC 6620 (in addition to Cisco). These are HPE and Aruba.
Is it the full list whom is protected against leakage of information?
Is it enough to consider problem solved?

Ed/