nanog mailing list archives
RE: misunderstanding scale
From: "Naslund, Steve" <SNaslund () medline com>
Date: Mon, 24 Mar 2014 16:53:47 +0000
If they have a stateful IPv6 firewall (which they should and which most firewall vendors support), they already have what they need to prevent their internal systems from being accessible from the outside. If you are an enterprise and you don't have a stateful firewall, you are in trouble from a security standpoint whether you run v4 or v6. If you cannot configure a stateful firewall to block connections being initiated from outside, you are not qualified to be working with the firewall, v4 or v6 does not matter. If someone is relying on NAT in case their firewall is misconfigured, they have major issues with security. In the home, I am not sure what the major issue is there either. How many CPE devices have you seen that do not implement basic firewall functionality? People may not use them correctly but that is no more an issue with v6 than it is with v4. Most CPE even comes out of the box blocking inbound connections by default. Steve -----Original Message----- From: Mark Tinka [mailto:mark.tinka () seacom mu] Sent: Monday, March 24, 2014 11:35 AM To: Timothy Morizot Cc: NANOG list Subject: Re: misunderstanding scale
Don't disagree with you there.
I'm saying many an enterprise (small and large) as well as homes operate this way. There is a lot of unlearning to do.
The whole issue is that a number of enterprises "may" only feel safe if IPv6 comes with NAT66, probably on top (or not on top) of a stateful IPv6 firewall.
We need to think about how to re-train the enterprise, if we don't want to repeat the erasure of the end-to-end model, second time around.
Mark.
Current thread:
- Re: misunderstanding scale, (continued)
- Re: misunderstanding scale William Herrin (Mar 24)
- Re: misunderstanding scale Joe Greco (Mar 24)
- Re: misunderstanding scale Valdis . Kletnieks (Mar 24)
- Re: misunderstanding scale Michael Thomas (Mar 24)
- Re: misunderstanding scale William Herrin (Mar 24)
- RE: misunderstanding scale Eric Wieling (Mar 24)
- RE: misunderstanding scale Naslund, Steve (Mar 24)
- Re: misunderstanding scale Owen DeLong (Mar 24)
- Re: misunderstanding scale Timothy Morizot (Mar 24)
- Re: misunderstanding scale Mark Tinka (Mar 24)
- RE: misunderstanding scale Naslund, Steve (Mar 24)
- Message not available
- RE: misunderstanding scale Naslund, Steve (Mar 24)
- Re: misunderstanding scale hslabbert (Mar 24)
- Re: misunderstanding scale Owen DeLong (Mar 24)
- RE: misunderstanding scale Naslund, Steve (Mar 24)
- Re: misunderstanding scale Valdis . Kletnieks (Mar 24)
- RE: misunderstanding scale Alexander Lopez (Mar 24)
- Re: misunderstanding scale hslabbert (Mar 24)
- Re: why IPv6 isn't ready for prime time, SMTP edition John Levine (Mar 25)
- Re: why IPv6 isn't ready for prime time, SMTP edition Brielle Bruns (Mar 25)
- Re: why IPv6 isn't ready for prime time, SMTP edition Jim Popovitch (Mar 25)