On Saturday, August 07, 2010 02:57:33 am Phil Mayers wrote: > I am also reluctant to enable "real" IPv6, which ought to > suppress the client 6to4 activity, because (I believe) > the IPv6 forwarding does not obey vlan-assignment, a > feature we use to segregate clients. > > [Obviously I would *much* prefer to enable real IPv6, and > we're prepared for it - except for the vlan assignment > issue...]
Until RA Guard + DHCPv6 Snooping become routinely available in Ethernet switches, managing this kind of problem will be hectic at best. We ran a network for a conference back in February, and Windows 7/Vista boxes were handing out 6-to-4 addresses. Annoying! As you noticed, filtering this upstream is useless since client-to-client problems still remain. Also, filtering upstream doesn't prevent clients from mis- representing the network to other clients. We had about 7 switches in production, and while it was troublesome, it became a case of identifying the offenders' MAC address, and applying it to MAC filters on all the switches (since it was a wi-fi network, the offending user could roam the floor - 25 AP's in total). Of course, a wireless controller that can manage a wi-fi network capable of filtering v6 packets would be useful. But then again, running your traffic through this could present its own set of problems at scale. Mark.
signature.asc
Description: This is a digitally signed message part.
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
