Security Implications of IPv6 on IPv4 Networks
draft-ietf-opsec-ipv6-implications-on-ipv4-nets-04

The information below is for an old version of the document
Document Type Active Internet-Draft (opsec WG)
Last updated 2013-05-16 (latest revision 2013-05-02)
Replaces draft-gont-opsec-ipv6-implications-on-ipv4-nets
Stream IETF
Intended RFC status Informational
Formats pdf htmlized (tools) htmlized bibtex
Reviews
Stream WG state Submitted to IESG for Publication
Document shepherd Warren Kumari
Shepherd write-up Show (last changed 2013-03-20)
IESG IESG state IESG Evaluation::AD Followup
Consensus Boilerplate Yes
Telechat date
Needs a YES.
Responsible AD Joel Jaeggli
Send notices to opsec-chairs@tools.ietf.org, draft-ietf-opsec-ipv6-implications-on-ipv4-nets@tools.ietf.org
IANA IANA review state IANA - Review Needed
Operational Security Capabilities for                            F. Gont
IP Network Infrastructure (opsec)                 SI6 Networks / UTN-FRH
Internet-Draft                                                    W. Liu
Intended status: Informational                       Huawei Technologies
Expires: November 3, 2013                                    May 2, 2013

             Security Implications of IPv6 on IPv4 Networks
           draft-ietf-opsec-ipv6-implications-on-ipv4-nets-04

Abstract

   This document discusses the security implications of native IPv6
   support and IPv6 transition/co-existence technologies on "IPv4-only"
   networks, and describes possible mitigations for the aforementioned
   issues.

Status of this Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on November 3, 2013.

Copyright Notice

   Copyright (c) 2013 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Gont & Liu              Expires November 3, 2013                [Page 1]
Internet-Draft     Sec. Impl. of IPv6 on IPv4 networks          May 2013

Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
   2.  Security Implications of Native IPv6 Support . . . . . . . . .  5
     2.1.  Filtering Native IPv6 Traffic  . . . . . . . . . . . . . .  5
   3.  Security Implications of Tunneling Mechanisms  . . . . . . . .  7
     3.1.  Filtering 6in4 . . . . . . . . . . . . . . . . . . . . . .  8
     3.2.  Filtering 6over4 . . . . . . . . . . . . . . . . . . . . .  8
     3.3.  Filtering 6rd  . . . . . . . . . . . . . . . . . . . . . .  9
     3.4.  Filtering 6to4 . . . . . . . . . . . . . . . . . . . . . .  9
     3.5.  Filtering ISATAP . . . . . . . . . . . . . . . . . . . . . 10
     3.6.  Filtering Teredo . . . . . . . . . . . . . . . . . . . . . 11
     3.7.  Filtering Tunnel Broker with Tunnel Setup Protocol
           (TSP)  . . . . . . . . . . . . . . . . . . . . . . . . . . 12
     3.8.  Filtering AYIYA  . . . . . . . . . . . . . . . . . . . . . 13
   4.  Additional Considerations when Filtering IPv6 Traffic  . . . . 14
   5.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 15
   6.  Security Considerations  . . . . . . . . . . . . . . . . . . . 16
   7.  Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 17
   8.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 18
     8.1.  Normative References . . . . . . . . . . . . . . . . . . . 18
     8.2.  Informative References . . . . . . . . . . . . . . . . . . 18
   Appendix A.  Summary of filtering rules  . . . . . . . . . . . . . 22
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 23

Gont & Liu              Expires November 3, 2013                [Page 2]
Internet-Draft     Sec. Impl. of IPv6 on IPv4 networks          May 2013

1.  Introduction

   Most general-purpose operating systems implement and enable native
   IPv6 [RFC2460] support and a number of transition/co-existence
   technologies by default.  Support of IPv6 by all nodes is intended to
   become best current practice [RFC6540].  Some enterprise networks
   might, however, choose to delay active use of IPv6.  In scenarios in
   which the aforementioned devices are deployed on networks that are
   assumed to be IPv4-only, native IPv6 support and/or IPv6 transition/
   co-existence technologies could be leveraged by local or remote
   attackers for a number of (illegitimate) purposes.  For example,

   o  A Network Intrusion Detection System (NIDS) might be prepared to
      detect attack patterns for IPv4 traffic, but might be unable to
      detect the same attack patterns when a transition/co-existence
      technology is leveraged for that purpose.

   o  An IPv4 firewall might enforce a specific security policy in IPv4,
Show full document text