Security Implications of IPv6 on IPv4 Networks
draft-ietf-opsec-ipv6-implications-on-ipv4-nets-05

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00
• 01
• 02
• 03
• 04
• 05
• 06
• 07

Operational Security Capabilities for                            F. Gont
IP Network Infrastructure (opsec)                 SI6 Networks / UTN-FRH
Internet-Draft                                                    W. Liu
Intended status: Informational                       Huawei Technologies
Expires: January 6, 2014                                    July 5, 2013

             Security Implications of IPv6 on IPv4 Networks
           draft-ietf-opsec-ipv6-implications-on-ipv4-nets-05

Abstract

   This document discusses the security implications of native IPv6
   support and IPv6 transition/co-existence technologies on "IPv4-only"
   networks, and describes possible mitigations for the aforementioned
   issues.

Status of this Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on January 6, 2014.

Copyright Notice

   Copyright (c) 2013 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Gont & Liu               Expires January 6, 2014                [Page 1]
Internet-Draft     Sec. Impl. of IPv6 on IPv4 networks         July 2013

Table of Contents

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
   2.  Security Implications of Native IPv6 Support . . . . . . . . .  5
     2.1.  Filtering Native IPv6 Traffic  . . . . . . . . . . . . . .  5
   3.  Security Implications of Tunneling Mechanisms  . . . . . . . .  7
     3.1.  Filtering 6in4 . . . . . . . . . . . . . . . . . . . . . .  8
     3.2.  Filtering 6over4 . . . . . . . . . . . . . . . . . . . . .  8
     3.3.  Filtering 6rd  . . . . . . . . . . . . . . . . . . . . . .  9
     3.4.  Filtering 6to4 . . . . . . . . . . . . . . . . . . . . . .  9
     3.5.  Filtering ISATAP . . . . . . . . . . . . . . . . . . . . . 10
     3.6.  Filtering Teredo . . . . . . . . . . . . . . . . . . . . . 11
     3.7.  Filtering Tunnel Broker with Tunnel Setup Protocol
           (TSP)  . . . . . . . . . . . . . . . . . . . . . . . . . . 12
     3.8.  Filtering AYIYA  . . . . . . . . . . . . . . . . . . . . . 13
   4.  Additional Considerations when Filtering IPv6 Traffic  . . . . 14
   5.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 15
   6.  Security Considerations  . . . . . . . . . . . . . . . . . . . 16
   7.  Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 17
   8.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 18
     8.1.  Normative References . . . . . . . . . . . . . . . . . . . 18
     8.2.  Informative References . . . . . . . . . . . . . . . . . . 18
   Appendix A.  Summary of filtering rules  . . . . . . . . . . . . . 22
   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 23

Gont & Liu               Expires January 6, 2014                [Page 2]
Internet-Draft     Sec. Impl. of IPv6 on IPv4 networks         July 2013

1.  Introduction

   Most general-purpose operating systems implement and enable native
   IPv6 [RFC2460] support and a number of transition/co-existence
   technologies by default.  Support of IPv6 by all nodes is intended to
   become best current practice [RFC6540].  Some enterprise networks
   might, however, choose to delay active use of IPv6.

   This document describes operational practices for enterprise networks
   to prevent security exposure resulting from unplanned use of IPv6 on
   such networks.  This document is only applicable to enterprise
   networks: networks where the network operator is not providing a
   general-purpose internet, but rather a business-specific network.
   The solutions proposed here are not practical for home networks, nor
   are they appropriate for provider networks such as ISPs, mobile
   providers, Wifi hotspot providers or any other public internet
   service.