Subject: Re: [OPSEC] Security Implications of IPv6 on IPv4 Networks

From: Simon Eng <[email-masked]>
Date: Tue, 7 Aug 2012 10:18:58 +0800

Hi,

Apologies for the late reply.  Please see comments inline.

Regards.

Simon

On Mon, Jul 30, 2012 at 2:26 PM, Fernando Gont <[email-masked]>wrote:

> Hi, Simon,
>
> Thanks so much for your feedback! -- Please find my comments inline...
>
>
> On 07/30/2012 01:02 AM, Simon Eng wrote:
> > a) In Section 2, attacks related to Layer 2 (e.g. IPv6 Router
> > Advertisements) are mentioned discussed.  In my humble opinion,
> > in networks meant for IPv4 only (but with IPv6 turned on), Layer 2
> > attacks/mis-configurations will be the greatest to carry out.  Perhaps
> > more can be used to discuss ICMPv6 traffic filtering (especially since
> > it will replace other Layer 2 protocols, such as ARP) and also other
> > relevant Layer 2 protocols?
>
> Do you mean mentioning things like RA-guard, ND-Shield, and
> DHCPv6-Shield? Or something else?
>

Simon: Yes, or security technologies (especially Layer 2??) that should be
highlighted to defend IPv4-only network.

>
>
> > b) DNS security is not mentioned (e.g. turning off AAAA). It may be good
> > to discuss the implications of enabling default IPv6 on for DNS
> > deployment.
>
> Are you referring to enabling AAAA queries? Or something else?
>

Simon: yes, AAAA queries.  On IPv4-only networks, we should not deal with
AAAA queries right?

>
>
> > Since Section 2 & 3 describes more about Layer 2 & 3
> > respectively, perhaps a new Section 4 on "Application/Others" can
> > discuss about DNS or even DHCPv6 filtering?
>
> Yep, this is a possible way to go... although in the specific case of
> DHCPv6-filtering, one my want to discuss it along RA-filtering
> (RA-guard), since they complement each other...
>
> Thanks!
>
> Best regards,
> --
> Fernando Gont
> SI6 Networks
> e-mail: [email-masked]
> PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
>
>
>
>