Subject: [OPSEC] Security Implications of IPv6 on IPv4 Networks

From: Simon Eng <[email-masked]>
Date: Mon, 30 Jul 2012 12:02:26 +0800

Hi,

 I have a few thoughts after reading the draft.

a) In Section 2, attacks related to Layer 2 (e.g. IPv6 Router
Advertisements) are mentioned discussed.  In my humble opinion, in networks
meant for IPv4 only (but with IPv6 turned on), Layer 2
attacks/mis-configurations will be the greatest to carry out.  Perhaps more
can be used to discuss ICMPv6 traffic filtering (especially since it will
replace other Layer 2 protocols, such as ARP) and also other relevant Layer
2 protocols?

b) DNS security is not mentioned (e.g. turning off AAAA). It may be good to
discuss the implications of enabling default IPv6 on for DNS deployment.
 Since Section 2 & 3 describes more about Layer 2 & 3 respectively, perhaps
a new Section 4 on "Application/Others" can discuss about DNS or even
DHCPv6 filtering?

Regards.

Simon Eng ([email-masked])

"Question to learn, learn to question."

---

From: Fernando Gont <[email-masked]>
Date: Mon, 30 Jul 2012 03:26:53 -0300

Hi, Simon,

Thanks so much for your feedback! -- Please find my comments inline...

On 07/30/2012 01:02 AM, Simon Eng wrote:
> Advertisements) are mentioned discussed.  In my humble opinion,
> in networks meant for IPv4 only (but with IPv6 turned on), Layer 2
> attacks/mis-configurations will be the greatest to carry out.  Perhaps
> more can be used to discuss ICMPv6 traffic filtering (especially since
> it will replace other Layer 2 protocols, such as ARP) and also other
> relevant Layer 2 protocols?

Do you mean mentioning things like RA-guard, ND-Shield, and
DHCPv6-Shield? Or something else?

> b) DNS security is not mentioned (e.g. turning off AAAA). It may be good
> to discuss the implications of enabling default IPv6 on for DNS
> deployment. 

Are you referring to enabling AAAA queries? Or something else?

> Since Section 2 & 3 describes more about Layer 2 & 3
> respectively, perhaps a new Section 4 on "Application/Others" can
> discuss about DNS or even DHCPv6 filtering?

Yep, this is a possible way to go... although in the specific case of
DHCPv6-filtering, one my want to discuss it along RA-filtering
(RA-guard), since they complement each other...

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: "Smith, Donald" <[email-masked]>
Date: Mon, 30 Jul 2012 23:07:39 +0000

This should be NAPT and statefull firewalling.

 Finally,
   some transition/co-existence mechanisms (notably Teredo) are designed
   to traverse Network Address Translators (NATs), which in many
   deployments provide a minimum level of protection by only allowing
   those instances of communication that have been initiated from the
   internal network.

The real issue isn't NAT per say, it is the fact that no ports are open on the outside that easily map to a service on the inside.
You have to know which port (external) is open to even begin. So it is the PAT and the statefull firewall (allow based 5tuple state) that provides this "minimal" level of security.

I quote the "minimal" as scan and sploit worms simply don't propagate through non1:1 PAT and a stateful firewall.

(coffee != sleep) & (!coffee == sleep)
 [email-masked]
________________________________________
From: [email-masked] [[email-masked]] on behalf of Fernando Gont [[email-masked]]
Sent: Monday, July 30, 2012 12:26 AM
To: Simon Eng
Cc: [email-masked]
Subject: Re: [OPSEC] Security Implications of IPv6 on IPv4 Networks

Hi, Simon,

Thanks!

Best regards,

_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec

---

From: Fernando Gont <[email-masked]>
Date: Tue, 31 Jul 2012 06:14:13 -0300

Hi, Donald,

Thanks so much for your feedback! Please find my comments in-line...

> This should be NAPT and statefull firewalling.

Agreed. -- Will fix this.

> Finally, some transition/co-existence mechanisms (notably Teredo) are
> designed to traverse Network Address Translators (NATs), which in
> many deployments provide a minimum level of protection by only
> allowing those instances of communication that have been initiated
> from the internal network.
> 
> The real issue isn't NAT per say, it is the fact that no ports are
> open on the outside that easily map to a service on the inside. You
> have to know which port (external) is open to even begin. 

And if no communication was ever initiated from the inside, this might
simple be "none".

> So it is
> the PAT and the statefull firewall (allow based 5tuple state) that
> provides this "minimal" level of security.
> 
> I quote the "minimal" as scan and sploit worms simply don't propagate
> through non1:1 PAT and a stateful firewall.

I didn't say "minimal" to mean "worthless", but rather "even if the
NAT-PT was deployed for other reasons, it is providing "some" level of
security as a result of the (side effect) policy of 'only allow return
traffic'" -- maybe I should reword the aforementioned "minimal"?

Thanks!

Cheers,

---

From: "Smith, Donald" <[email-masked]>
Date: Tue, 31 Jul 2012 14:19:34 +0000

Rather than minor I would prefer basic or simple.
Thanks for your feed back and responses.

(coffee != sleep) & (!coffee == sleep)
 [email-masked]
________________________________________
From: Fernando Gont [[email-masked]]
Sent: Tuesday, July 31, 2012 3:14 AM
To: Smith, Donald
Cc: Simon Eng; [email-masked]
Subject: Re: [OPSEC] Security Implications of IPv6 on IPv4 Networks

Hi, Donald,

Thanks!

Cheers,

---

From: "Smith, Donald" <[email-masked]>
Date: Tue, 31 Jul 2012 14:36:36 +0000

Right after I said that I remembered this rfc.
http://tools.ietf.org/html/rfc6092

Which talks to "simple security" which is nearly the same as what we were discussing.
It doesn't rely on NAPT but does provide the stateful and non-stateful firewalling only allowing traffic thru that was initiated from the "inside".

So I recommend "simple" instead of basic or minor :)

(coffee != sleep) & (!coffee == sleep)
 [email-masked]
________________________________________
From: [email-masked] [[email-masked]] on behalf of Smith, Donald
Sent: Tuesday, July 31, 2012 8:19 AM
To: Fernando Gont
Cc: [email-masked]
Subject: Re: [OPSEC] Security Implications of IPv6 on IPv4 Networks

Hi, Donald,

Thanks!

Cheers,