nanog mailing list archives
Re: Requirements for IPv6 Firewalls
From: Matt Palmer <mpalmer () hezmatt org>
Date: Fri, 18 Apr 2014 16:57:57 +1000
On Thu, Apr 17, 2014 at 09:05:17PM -0500, Timothy Morizot wrote:
On Apr 17, 2014 7:52 PM, "Matthew Kaufman" <matthew () matthew at> wrote:While you're at it, the document can explain to admins who have beenburned, often more than once, by the pain of re-numbering internal services at static addresses how IPv6 without NAT will magically solve this problem. If you're worried about that issue, either get your own end user assignment(s) from ARIN or use ULA internally and employ NAT-PT (prefix translation) at the perimeter. That's not even a hard question.
Why use NAT-PT in that instance? Since IPv6 interfaces are happy running with multiple addresses, the machines can have their publically-accessable address and also their ULA address, with internal services binding to (and referring to, via DNS, et al) the ULA address; when you change providers, the publically-accessable address changes (whoopee!), but the internal service address doesn't. - Matt
Current thread:
- Re: Requirements for IPv6 Firewalls, (continued)
- Re: Requirements for IPv6 Firewalls George Herbert (Apr 21)
- Re: Requirements for IPv6 Firewalls Sander Steffann (Apr 17)
- Re: Requirements for IPv6 Firewalls Brandon Ross (Apr 17)
- Re: Requirements for IPv6 Firewalls Matthew Kaufman (Apr 17)
- Re: Requirements for IPv6 Firewalls Timothy Morizot (Apr 17)
- Thank you Comcast Michael T. Voity (Apr 17)
- Re: Thank you Comcast Mehmet Akcin (Apr 17)
- Re: Thank you Comcast Doug Barton (Apr 17)
- Re: Requirements for IPv6 Firewalls Brandon Ross (Apr 17)
- Re: Requirements for IPv6 Firewalls Matthew Kaufman (Apr 17)
- Re: Requirements for IPv6 Firewalls Matt Palmer (Apr 18)
- Re: Requirements for IPv6 Firewalls Seth Mos (Apr 18)
- Re: Requirements for IPv6 Firewalls Enno Rey (Apr 18)
- Re: Requirements for IPv6 Firewalls Nick Hilliard (Apr 18)
- Re: Requirements for IPv6 Firewalls Lee Howard (Apr 18)
- Re: Requirements for IPv6 Firewalls Fernando Gont (Apr 21)
- Re: Requirements for IPv6 Firewalls Brandon Ross (Apr 21)
- Re: Requirements for IPv6 Firewalls Enno Rey (Apr 18)
- Re: Requirements for IPv6 Firewalls Doug Barton (Apr 18)
- Re: Requirements for IPv6 Firewalls Enno Rey (Apr 18)
- Re: Requirements for IPv6 Firewalls Doug Barton (Apr 19)