Security Implications of IPv6 on IPv4 Networks
draft-ietf-opsec-ipv6-implications-on-ipv4-nets-03
| The information below is for an old version of the document | |||
|---|---|---|---|
| Document | Type | Active Internet-Draft (opsec WG) | |
| Authors | Fernando Gont , Will LIU | ||
| Last updated | 2013-04-25 (latest revision 2013-02-22) | ||
| Replaces | draft-gont-opsec-ipv6-implications-on-ipv4-nets | ||
| Stream | IETF | ||
| Intended RFC status | Informational | ||
| Formats | pdf htmlized (tools) htmlized bibtex | ||
| Reviews | |||
| Stream | WG state | Submitted to IESG for Publication | |
| Document shepherd | Warren Kumari | ||
| Shepherd write-up | Show (last changed 2013-03-20) | ||
| IESG | IESG state | Waiting for AD Go-Ahead::Revised I-D Needed | |
| Consensus Boilerplate | Yes | ||
| Telechat date |
Needs a YES. |
||
| Responsible AD | Joel Jaeggli | ||
| Send notices to | opsec-chairs@tools.ietf.org, draft-ietf-opsec-ipv6-implications-on-ipv4-nets@tools.ietf.org | ||
| IANA | IANA review state | IANA - Review Needed | |
Operational Security Capabilities for F. Gont
IP Network Infrastructure (opsec) SI6 Networks / UTN-FRH
Internet-Draft W. Liu
Intended status: Informational Huawei Technologies
Expires: August 26, 2013 February 22, 2013
Security Implications of IPv6 on IPv4 Networks
draft-ietf-opsec-ipv6-implications-on-ipv4-nets-03
Abstract
This document discusses the security implications of native IPv6
support and IPv6 transition/co-existence technologies on "IPv4-only"
networks, and describes possible mitigations for the aforementioned
issues.
Status of this Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on August 26, 2013.
Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Gont & Liu Expires August 26, 2013 [Page 1]
Internet-Draft Sec. Impl. of IPv6 on IPv4 networks February 2013
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Security Implications of Native IPv6 Support . . . . . . . . . 5
2.1. Filtering Native IPv6 Traffic . . . . . . . . . . . . . . 5
3. Security Implications of Tunneling Mechanisms . . . . . . . . 7
3.1. Filtering 6in4 . . . . . . . . . . . . . . . . . . . . . . 8
3.2. Filtering 6over4 . . . . . . . . . . . . . . . . . . . . . 8
3.3. Filtering 6rd . . . . . . . . . . . . . . . . . . . . . . 9
3.4. Filtering 6to4 . . . . . . . . . . . . . . . . . . . . . . 9
3.5. Filtering ISATAP . . . . . . . . . . . . . . . . . . . . . 10
3.6. Filtering Teredo . . . . . . . . . . . . . . . . . . . . . 10
3.7. Filtering Tunnel Broker with Tunnel Setup Protocol
(TSP) . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3.8. Filtering AYIYA . . . . . . . . . . . . . . . . . . . . . 12
4. Additional Considerations when Filtering IPv6 Traffic . . . . 14
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15
6. Security Considerations . . . . . . . . . . . . . . . . . . . 16
7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 17
8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 18
8.1. Normative References . . . . . . . . . . . . . . . . . . . 18
8.2. Informative References . . . . . . . . . . . . . . . . . . 18
Appendix A. Summary of filtering rules . . . . . . . . . . . . . 22
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 23
Gont & Liu Expires August 26, 2013 [Page 2]
Internet-Draft Sec. Impl. of IPv6 on IPv4 networks February 2013
1. Introduction
Most general-purpose operating systems implement and enable native
IPv6 [RFC2460] support and a number of transition/co-existence
technologies by default. For cases in which the corresponding
devices are deployed on networks that are assumed to be IPv4-only,
native IPv6 support and/or IPv6 transition/co-existence technologies
could be leveraged by local or remote attackers for a number of
(illegitimate) purposes. For example,
o A Network Intrusion Detection System (NIDS) might be prepared to
detect attack patterns for IPv4 traffic, but might be unable to
detect the same attack patterns when a transition/co-existence
technology is leveraged for that purpose.
o An IPv4 firewall might enforce a specific security policy in IPv4,
but might be unable to enforce the same policy in IPv6.
o A NIDS or firewall might support both IPv4 and IPv6, but might be
Show full document text