Security Implications of IPv6 on IPv4 Networks
draft-ietf-opsec-ipv6-implications-on-ipv4-nets-05
The information below is for an old version of the document | |||
---|---|---|---|
Document | Type | Active Internet-Draft (opsec WG) | |
Authors | Fernando Gont , Will LIU | ||
Last updated | 2013-07-05 | ||
Replaces | draft-gont-opsec-ipv6-implications-on-ipv4-nets | ||
Stream | IETF | ||
Intended RFC status | Informational | ||
Formats | pdf htmlized (tools) htmlized bibtex | ||
Reviews | |||
Stream | WG state | Submitted to IESG for Publication | |
Document shepherd | Warren Kumari | ||
Shepherd write-up | Show (last changed 2013-03-20) | ||
IESG | IESG state | IESG Evaluation::AD Followup | |
Consensus Boilerplate | Yes | ||
Telechat date |
Needs a YES. |
||
Responsible AD | Joel Jaeggli | ||
Send notices to | opsec-chairs@tools.ietf.org, draft-ietf-opsec-ipv6-implications-on-ipv4-nets@tools.ietf.org | ||
IANA | IANA review state | IANA - Review Needed |
Operational Security Capabilities for F. Gont IP Network Infrastructure (opsec) SI6 Networks / UTN-FRH Internet-Draft W. Liu Intended status: Informational Huawei Technologies Expires: January 6, 2014 July 5, 2013 Security Implications of IPv6 on IPv4 Networks draft-ietf-opsec-ipv6-implications-on-ipv4-nets-05 Abstract This document discusses the security implications of native IPv6 support and IPv6 transition/co-existence technologies on "IPv4-only" networks, and describes possible mitigations for the aforementioned issues. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on January 6, 2014. Copyright Notice Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Gont & Liu Expires January 6, 2014 [Page 1] Internet-Draft Sec. Impl. of IPv6 on IPv4 networks July 2013 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Security Implications of Native IPv6 Support . . . . . . . . . 5 2.1. Filtering Native IPv6 Traffic . . . . . . . . . . . . . . 5 3. Security Implications of Tunneling Mechanisms . . . . . . . . 7 3.1. Filtering 6in4 . . . . . . . . . . . . . . . . . . . . . . 8 3.2. Filtering 6over4 . . . . . . . . . . . . . . . . . . . . . 8 3.3. Filtering 6rd . . . . . . . . . . . . . . . . . . . . . . 9 3.4. Filtering 6to4 . . . . . . . . . . . . . . . . . . . . . . 9 3.5. Filtering ISATAP . . . . . . . . . . . . . . . . . . . . . 10 3.6. Filtering Teredo . . . . . . . . . . . . . . . . . . . . . 11 3.7. Filtering Tunnel Broker with Tunnel Setup Protocol (TSP) . . . . . . . . . . . . . . . . . . . . . . . . . . 12 3.8. Filtering AYIYA . . . . . . . . . . . . . . . . . . . . . 13 4. Additional Considerations when Filtering IPv6 Traffic . . . . 14 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15 6. Security Considerations . . . . . . . . . . . . . . . . . . . 16 7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 17 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 18 8.1. Normative References . . . . . . . . . . . . . . . . . . . 18 8.2. Informative References . . . . . . . . . . . . . . . . . . 18 Appendix A. Summary of filtering rules . . . . . . . . . . . . . 22 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 23 Gont & Liu Expires January 6, 2014 [Page 2] Internet-Draft Sec. Impl. of IPv6 on IPv4 networks July 2013 1. Introduction Most general-purpose operating systems implement and enable native IPv6 [RFC2460] support and a number of transition/co-existence technologies by default. Support of IPv6 by all nodes is intended to become best current practice [RFC6540]. Some enterprise networks might, however, choose to delay active use of IPv6. This document describes operational practices for enterprise networks to prevent security exposure resulting from unplanned use of IPv6 on such networks. This document is only applicable to enterprise networks: networks where the network operator is not providing a general-purpose internet, but rather a business-specific network. The solutions proposed here are not practical for home networks, nor are they appropriate for provider networks such as ISPs, mobile providers, Wifi hotspot providers or any other public internet service.Show full document text