Subject: I-D ACTION:draft-ietf-ipv6-unique-local-addr-04.txt

From: [email-masked]
Date: Tue, 25 May 2004 15:51:20 -0400

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the IP Version 6 Working Group Working Group of the IETF.

	Title		: Unique Local IPv6 Unicast Addresses
	Author(s)	: R. Hinden, B. Haberman
	Filename	: draft-ietf-ipv6-unique-local-addr-04.txt
	Pages		: 16
	Date		: 2004-5-25
	
This document defines an IPv6 unicast address format that is globally
   unique and is intended for local communications, usually inside of a
   site.  They are not expected to be routable on the global Internet.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-ipv6-unique-local-addr-04.txt

To remove yourself from the I-D Announcement list, send a message to 
[email-masked] with the word unsubscribe in the body of the message.  
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-ipv6-unique-local-addr-04.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-ipv6-unique-local-addr-04.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 27 May 2004 13:35:40 +0200

I'm sorry to come up with a substantive comment late in the day,
since I very much like this document. This isn't a showstopper,
but I though it was worth mentioning:

> 12.0 Security Considerations
> 
>    Local IPv6 addresses do not provide any inherent security to the
>    nodes that use them.  They may be used with filters at site
>    boundaries to keep Local IPv6 traffic inside of the site, but this is
>    no more or less secure than filtering any other type of global IPv6
>    unicast addresses.

This is true, but it undersells the proposal, given the current state of
enterprise security models. Can we add:

 From a security viewpoint, such filtering is exactly equivalent to the
filtering of ambiguous IPv4 addresses [RFC1918] at a site boundary. Hosts
whose local addresses are filtered are invisible from outside the site. If
such a host needs, and is authorized to have, external access, it must do
so using an additional, globally routeable, IPv6 address.

     Brian

---

From: Pekka Savola <[email-masked]>
Date: Fri, 28 May 2004 14:12:36 +0300 (EEST)

> so using an additional, globally routeable, IPv6 address.

You have implicit assumptions about what you mean with 'external
access'.  Did you mean something like, "access by external
[non-unique-local-addressed] users"?  Because you will be able to 
access external hosts from the unique-local hosts through proxies etc.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 28 May 2004 15:38:08 +0200

> access external hosts from the unique-local hosts through proxies etc.

I meant (see RFC 2775 :-) IP level transparent access from internal hosts
to external servers, which many if not most corporate users are denied
today. The proxy discussion is another matter. (I'm assuming that access
to internal hosts from external servers will use a DMZ with global
addresses, as today.)

But the practical details of this belong in v6ops. All I suggest we do here
is make IPv6 unique local addresses look attractive for security by
obscurity. Many of us here probably don't believe in security by obscurity,
but most corporate network managers do, and we need them on board.

    Brian

---

From: Tim Chown <[email-masked]>
Date: Sun, 30 May 2004 14:13:00 +0100

> but most corporate network managers do, and we need them on board.

I'm not sure this is a good message for this draft to promote.  If people
want to deploy security by obscurity fine, but I'd vote against encouraging
it in here.

Tim