Subject: Re: ICMPv6: New destination unreachable codes

From: Pekka Savola <[email-masked]>
Date: Mon, 2 Feb 2004 09:06:31 +0200 (EET)

On Thu, 29 Jan 2004 [email-masked] wrote:
>                   5 - source address failed ingress policy
[...]
> 
>    If the reason for the failure to deliver is that packets with this
>    source address is not allowed due to ingress filtering policies, the
>    Code field is set to 5.

One minor comment here: this code could also be applicable to egress 
policies, if the site is practising those. (That is, before sending 
the traffic off to your upstream interface, check at the outbound 
interface that the source address belongs to your site prefixes.)  
Pedantically that's egress filtering.

Should we just replace "ingress" with "ingress/egress"?

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: [email-masked]
Date: Mon, 2 Feb 2004 01:34:00 -0600

> Should we just replace "ingress" with "ingress/egress"?

Makes sense. will change that.

Regards
Mukesh