Subject: RE: raw thoughts on v6 firewalls

From: "Sassaman, Kim (CCI-Phoenix)" <[email-masked]>
Date: Thu, 19 Sep 2002 11:02:57 -0400

The only issue I can see arise is when a site-local address would have to communicate with foreign entities not local to itself.  In such a implementation a "barrier" that logically and/or physically sepperates the two entities from one another would serve a purpose.  This "barrier" can be in many forms a proxy, a nat device, and what is commonly known as a firewall.  Being a security professional as well as a network professional blanket dismissal of security devices could prove to become a huge flaw if we take a stance of negating them so early on in the process.
 
Kim Sassaman

	-----Original Message----- 
	From: Behcet Sarikaya [mailto:[email-masked]] 
	Sent: Thu 9/19/2002 7:29 AM 
	To: Pekka Savola 
	Cc: [email-masked] 
	Subject: Re: raw thoughts on v6 firewalls

	Hello Pekka, 
	  Site-local addresses would provide the same functionality and 
	therefore there is no need to introduce firewalls into v6. 
	  Is there anything wrong with the above argument? 

	Regards, 

	Pekka Savola wrote: 

	>Hi, 
	> 
	>Regarding v6ops meeting discussion.. 
	> 
	>I don't think v6 firewalls can be killed.  They're a mechanism to ensure 
	>some form of security policy; trusting end nodes to do the right thing is 
	>not enough. 
	> 
	>But there are problems with v6 firewalling.  I've been trying to get 
	>around to writing a draft for a year or so now but never did it (further 
	>than the baseline summary of the content): perhaps now it's a better time. 
	> 
	>One potentially major deployment issue is how the firewall is supposed to 
	>handle packets where extension header contains a header it does not not 
	>recognize and thus cannot parse e.g. UDP/TCP headers. 
	> 
	>  
	> 

	-- 
	Behcet

---

From: "Michel Py" <[email-masked]>
Date: Thu, 19 Sep 2002 09:50:36 -0700

> Behcet Sarikaya wrote:
> Site-local addresses would provide the same functionality
> and therefore there is no need to introduce firewalls into
> v6. Is there anything wrong with the above argument?

Something very wrong, IMHO: you would have to introduce IPv6 NAT if
these hosts have to talk to the outside world.

> Now I understand that it is somewhat orthogonal. Using
> site local addresses the intranet can avoid seeing company
> emails on Google's search engine, but how to avoid having
> ftp sites to be not accessible from the Internet? Maybe
> this is also possible using site local addresses.

Site-local addresses make sense for hosts that *never* have to access
the Internet, neither egress nor ingress. If a host with a site-local
address needs to communicate with the outside, I think that everyone
agrees that it is much preferable to give it a public address as well as
the site-local one rather than using the site-local only and IPv6 NAT.

Michel.