On (2012-03-05 10:47 -0500), Justin M. Streiner wrote: > With this in mind, do you have any recommendations for deploying a > sane IPv6 ingress/egress filter policy on Juniper gear?
Try to make IPv6 rules where ultimate address matching rule is deny. So if you are doing iACL, allow UDP high ports, ICMP whatnot, then deny protocol agnostically everything to your infrastructure. Then attacker can only bypass the permit statement, but will hit the protocol agnostic deny statement. Other than that, ask JNPR to implement 'match tcp' like ipv4, not just 'next-protocol', which is needed also, of course. I'm pretty sure DPCE could do this also, at least EZchip could, but I don't expect it ever to be supported in DPCE. I'm confident it'll be supported some day in trio, while I have no information from JNPR on the matter. -- ++ytti _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
