On 2014-03-24, "Naslund, Steve" <snasl...@medline.com> wrote:
If they have a stateful IPv6 firewall (which they should and which most firewall vendors support), they already have what they need to prevent their internal systems from being accessible from the outside. If you are an enterprise and you don't have a stateful firewall, you are in trouble from a security standpoint whether you run v4 or v6. If you cannot configure a stateful firewall to block connections being initiated from outside, you are not qualified to be working with the firewall, v4 or v6 does not matter. If someone is relying on NAT in case their firewall is misconfigured, they have major issues with security.In the home, I am not sure what the major issue is there either. How many CPE devices have you seen that do not implement basic firewall functionality? People may not use them correctly but that is no more an issue with v6 than it is with v4. Most CPE even comes out of the box blocking inbound connections by default.
Tell that to our little D-Link AP/router with stateless filters only for v6, and broken config options that make it impossible to apply even that to a tunnel interface (HE).
I agree with you on pushing v6 adoption and that the at the root of it you should have a stateful firewall be it v4 or v6, but:
- if this thread is any indication and as per your first paragraph, way too many orgs are depending on NAT as a security feature and v6 is exposing that weakness in their posture - home CPE implementations are largely crap, and good luck getting a decent portion of them supporting (functional) stateful v6 firewalls
Steve
-- Hugo
-----Original Message----- From: Mark Tinka [mailto:mark.ti...@seacom.mu] Sent: Monday, March 24, 2014 11:35 AM To: Timothy Morizot Cc: NANOG list Subject: Re: misunderstanding scaleDon't disagree with you there.I'm saying many an enterprise (small and large) as well as homes operate this way. There is a lot of unlearning to do.The whole issue is that a number of enterprises "may" only feel safe if IPv6 comes with NAT66, probably on top (or not on top) of a stateful IPv6 firewall.We need to think about how to re-train the enterprise, if we don't want to repeat the erasure of the end-to-end model, second time around.Mark.
-- Hugo Slabbert Network Specialist Phone: 604.606.4448 Email: hslabb...@stargate.ca Stargate Connections Inc. http://www.stargate.ca
signature.asc
Description: Digital signature
