| draft-krishnan-mip6-firewall-admin-00.txt | draft-krishnan-mip6-firewall-admin-01.txt | |||
|---|---|---|---|---|
| Network Working Group S. Krishnan | Network Working Group S. Krishnan | |||
| Internet-Draft Ericsson | Internet-Draft Ericsson | |||
| Intended status: Informational N. Steinleitner | Intended status: Informational N. Steinleitner | |||
| Expires: May 13, 2008 University of Goettingen | Expires: May 19, 2008 University of Goettingen | |||
| Y. Qiu | Y. Qiu | |||
| Institute for Infocomm Research | Institute for Infocomm Research | |||
| November 10, 2007 | November 16, 2007 | |||
| Guidelines for firewall administrators regarding MIPv6 traffic | Guidelines for firewall administrators regarding MIPv6 traffic | |||
| draft-krishnan-mip6-firewall-admin-00 | draft-krishnan-mip6-firewall-admin-01 | |||
| Status of this Memo | Status of this Memo | |||
| By submitting this Internet-Draft, each author represents that any | By submitting this Internet-Draft, each author represents that any | |||
| applicable patent or other IPR claims of which he or she is aware | applicable patent or other IPR claims of which he or she is aware | |||
| have been or will be disclosed, and any of which he or she becomes | have been or will be disclosed, and any of which he or she becomes | |||
| aware will be disclosed, in accordance with Section 6 of BCP 79. | aware will be disclosed, in accordance with Section 6 of BCP 79. | |||
| Internet-Drafts are working documents of the Internet Engineering | Internet-Drafts are working documents of the Internet Engineering | |||
| Task Force (IETF), its areas, and its working groups. Note that | Task Force (IETF), its areas, and its working groups. Note that | |||
| skipping to change at page 1, line 37 | skipping to change at page 1, line 37 | |||
| and may be updated, replaced, or obsoleted by other documents at any | and may be updated, replaced, or obsoleted by other documents at any | |||
| time. It is inappropriate to use Internet-Drafts as reference | time. It is inappropriate to use Internet-Drafts as reference | |||
| material or to cite them other than as "work in progress." | material or to cite them other than as "work in progress." | |||
| The list of current Internet-Drafts can be accessed at | The list of current Internet-Drafts can be accessed at | |||
| http://www.ietf.org/ietf/1id-abstracts.txt. | http://www.ietf.org/ietf/1id-abstracts.txt. | |||
| The list of Internet-Draft Shadow Directories can be accessed at | The list of Internet-Draft Shadow Directories can be accessed at | |||
| http://www.ietf.org/shadow.html. | http://www.ietf.org/shadow.html. | |||
| This Internet-Draft will expire on May 13, 2008. | This Internet-Draft will expire on May 19, 2008. | |||
| Copyright Notice | Copyright Notice | |||
| Copyright (C) The IETF Trust (2007). | Copyright (C) The IETF Trust (2007). | |||
| Abstract | Abstract | |||
| This document presents some recommendations for firewall | This document presents some recommendations for firewall | |||
| administrators to help them configure their firewalls in a way that | administrators to help them configure their firewalls in a way that | |||
| allows Mobile IPv6 signaling and data messags to pass through. This | allows Mobile IPv6 signaling and data messages to pass through. This | |||
| document assumes that the firewalls in question include some kind of | document assumes that the firewalls in question include some kind of | |||
| stateful packet filtering capability. | stateful packet filtering capability. | |||
| Table of Contents | Table of Contents | |||
| 1. Requirements notation . . . . . . . . . . . . . . . . . . . . 3 | 1. Requirements notation . . . . . . . . . . . . . . . . . . . . 3 | |||
| 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 | 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 | |||
| 3. Home Agent behind a firewall . . . . . . . . . . . . . . . . . 5 | 3. Home Agent behind a firewall . . . . . . . . . . . . . . . . . 3 | |||
| 3.1. Signaling between the MN and the HA . . . . . . . . . . . 5 | 3.1. Signaling between the MN and the HA . . . . . . . . . . . 3 | |||
| 3.2. Route optimization signaling between MN and CN through | 3.2. IKEv2 signaling between MN and HA for establishing SAs . . 4 | |||
| HA . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 | 3.3. Data traffic from and to MN passing through the HA . . . . 4 | |||
| 3.3. IKEv2 signaling between MN and HA for establishing SAs . . 6 | 4. Correspondent Node behind a firewall . . . . . . . . . . . . . 4 | |||
| 3.4. Data traffic from and to MN passing through the HA . . . . 6 | ||||
| 4. Correspondent Node behind a firewall . . . . . . . . . . . . . 7 | ||||
| 4.1. Route optimization signaling between MN and CN through | 4.1. Route optimization signaling between MN and CN through | |||
| HA . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 | HA . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 | |||
| 4.2. Route optimization signaling between MN and CN . . . . . . 7 | 4.2. Route optimization signaling between MN and CN . . . . . . 5 | |||
| 4.3. Binding Update from MN to CN . . . . . . . . . . . . . . . 8 | 4.3. Binding Update from MN to CN . . . . . . . . . . . . . . . 6 | |||
| 4.4. Route Optimization data traffic from MN . . . . . . . . . 8 | 4.4. Route Optimization data traffic from MN . . . . . . . . . 6 | |||
| 4.5. Bi-directional tunnelled data traffic from the MN to | 4.5. Bi-directional tunnelled data traffic from the MN to | |||
| the CN through HA . . . . . . . . . . . . . . . . . . . . 8 | the CN through HA . . . . . . . . . . . . . . . . . . . . 6 | |||
| 5. Mobile Node behind a firewall . . . . . . . . . . . . . . . . 10 | 5. Mobile Node behind a firewall . . . . . . . . . . . . . . . . 7 | |||
| 5.1. Signaling between MN and HA . . . . . . . . . . . . . . . 10 | 5.1. Signaling between MN and HA . . . . . . . . . . . . . . . 7 | |||
| 5.2. Signaling between MN and CN . . . . . . . . . . . . . . . 10 | 5.2. Signaling between MN and CN . . . . . . . . . . . . . . . 7 | |||
| 5.3. IKEv2 signaling between MN and HA for establishing SAs . . 11 | 5.3. IKEv2 signaling between MN and HA for establishing SAs . . 8 | |||
| 5.4. Data traffic from and to the MN . . . . . . . . . . . . . 11 | 6. Contributors . . . . . . . . . . . . . . . . . . . . . . . . . 8 | |||
| 6. Contributors . . . . . . . . . . . . . . . . . . . . . . . . . 12 | 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9 | |||
| 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 13 | 8. Security Considerations . . . . . . . . . . . . . . . . . . . 9 | |||
| 8. Security Considerations . . . . . . . . . . . . . . . . . . . 14 | 9. Normative References . . . . . . . . . . . . . . . . . . . . . 9 | |||
| 9. Normative References . . . . . . . . . . . . . . . . . . . . . 15 | Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 9 | |||
| Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 16 | Intellectual Property and Copyright Statements . . . . . . . . . . 11 | |||
| Intellectual Property and Copyright Statements . . . . . . . . . . 17 | ||||
| 1. Requirements notation | 1. Requirements notation | |||
| The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | |||
| "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this | "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this | |||
| document are to be interpreted as described in [RFC2119]. | document are to be interpreted as described in [RFC2119]. | |||
| 2. Introduction | 2. Introduction | |||
| Network elements such as firewalls are an integral aspect of a | Network elements such as firewalls are an integral aspect of a | |||
| skipping to change at page 4, line 19 | skipping to change at page 3, line 25 | |||
| Internet, threats, and vulnerabilities to data networks. MIPv6 | Internet, threats, and vulnerabilities to data networks. MIPv6 | |||
| [RFC3775] defines mobility support for IPv6 nodes. Since firewalls | [RFC3775] defines mobility support for IPv6 nodes. Since firewalls | |||
| are not aware of MIPv6 protocol details, they will probably interfere | are not aware of MIPv6 protocol details, they will probably interfere | |||
| with the smooth operation of the protocol. The problems caused by | with the smooth operation of the protocol. The problems caused by | |||
| firewalls to Mobile IPv6 are documented in [RFC4487]. | firewalls to Mobile IPv6 are documented in [RFC4487]. | |||
| This document presents some recommendations for firewall | This document presents some recommendations for firewall | |||
| administrators to help them configure their firewalls in a way that | administrators to help them configure their firewalls in a way that | |||
| allows Mobile IPv6 signaling and data messags to pass through. This | allows Mobile IPv6 signaling and data messags to pass through. This | |||
| document assumes that the firewalls in question include some kind of | document assumes that the firewalls in question include some kind of | |||
| stateful packet filtering capability. | stateful packet filtering capability. The static rules that need to | |||
| be configured are described in this document. The dynamic | ||||
| capabilities needed for the firewalls to implement stateful filtering | ||||
| of MIPv6 packers is described in a companion document [MIP6FWVENDOR]. | ||||
| 3. Home Agent behind a firewall | 3. Home Agent behind a firewall | |||
| This section presents the recommendations for configuring a firewall | This section presents the recommendations for configuring a firewall | |||
| that is protects a home agent. For each type of traffic that needs | that protects a home agent. For each type of traffic that needs to | |||
| to pass through this firewall, recommendations are presented on how | pass through this firewall, recommendations are presented on how to | |||
| to identify that traffic. The following types of traffic are | identify that traffic. The following types of traffic are considered | |||
| considered | ||||
| o Signaling between the MN and the HA | o Signaling between the MN and the HA | |||
| o Route optimization signaling between MN and CN through HA | ||||
| o IKEv2 signaling between MN and HA for establishing SAs | o IKEv2 signaling between MN and HA for establishing SAs | |||
| o Data traffic from and to MN passing through the HA | o Data traffic from and to MN passing through the HA | |||
| 3.1. Signaling between the MN and the HA | 3.1. Signaling between the MN and the HA | |||
| The signaling between the MN and HA is protected using IPSec ESP. | The signaling between the MN and HA is protected using IPSec ESP. | |||
| These messages are encrypted and hence are not inspectable by | These messages are critical to the MIPv6 protocol and if these | |||
| firewalls. So the firewall has to either permit all these messages | messages are discarded, Mobile IPv6 as specified today will cease to | |||
| or discard all of them. But if these messages are discarded, Mobile | work. In order to permit these messages through, the firewall has to | |||
| IPv6 as specified today will cease to work. In order to permit these | detect the messages using the following patterns. | |||
| messages through, the firewall has to detect the messages using the | ||||
| following pattern. | ||||
| Destination Address: Address of HA | Destination Address: Address of HA | |||
| IP payload protocol number: 50 (ESP) | Next Header: 50 (ESP) | |||
| Mobility Header Type: 5 (BU) | ||||
| This pattern will allow the BU messages from MNs to HA and BA | ||||
| messages from the HA to the MNs to pass through. It will also allow | ||||
| the HoTI and HoT messages (related to route optimization) between the | ||||
| MN and the HA to pass through. | ||||
| 3.2. Route optimization signaling between MN and CN through HA | ||||
| Route Optimization allows direct communication of data packets | ||||
| between the MN and a CN without tunneling it back through the HA. In | ||||
| order for route optimization to work, part of the initial signaling | ||||
| has to pass through the HA. The following pattern will allow these | ||||
| messages to pass through. | ||||
| Destination Address: HoA of MN | Destination Address: Address of HA | |||
| Mobility Header Type: 3 | Next Header: 50 (ESP) | |||
| Mobility Header Type: 1 (HoTI) | ||||
| This pattern allows the HoT message from the CN to the MN's HoA to | This pattern will allow the BU messages from MNs to HA to pass | |||
| pass through the firewall. The HoTI message from the MN to the CN | through. It will also allow the HoTI messages (related to route | |||
| through the HA usually passes through the firewall without any | optimization) between the MN and the HA to pass through. | |||
| problems. Hence no specific pattern is recommended. If the firewall | ||||
| does not have the capability to recognize the mobility header type, | ||||
| it needs to at least filter on the IP payload protocol type 135 | ||||
| (Mobility Header) in order to limit the scope of this filter rule. | ||||
| 3.3. IKEv2 signaling between MN and HA for establishing SAs | 3.2. IKEv2 signaling between MN and HA for establishing SAs | |||
| The MN and HA exchange IKEv2 signaling in order to establish the | The MN and HA exchange IKEv2 signaling in order to establish the | |||
| security associations. The security associations so established will | security associations. The security associations so established will | |||
| later be used for securing the mobility signaling messages. Hence | later be used for securing the mobility signaling messages. Hence | |||
| these messages need to be permitted to pass through the firewalls. | these messages need to be permitted to pass through the firewalls. | |||
| The following pattern will detect these messages. | The following pattern will detect these messages. | |||
| Destination Address: Address of HA | Destination Address: Address of HA | |||
| Transport Protocol: UDP | Transport Protocol: UDP | |||
| Destination UDP Port: 500 | Destination UDP Port: 500 | |||
| 3.4. Data traffic from and to MN passing through the HA | 3.3. Data traffic from and to MN passing through the HA | |||
| If a CN tries to initiate traffic to an MN, a stateful firewall would | If a CN tries to initiate traffic to an MN, a stateful firewall would | |||
| prevent these connection requests to pass through as there is no | prevent these connection requests to pass through as there is no | |||
| established state on the firewall. Since MNs do not usually provide | established state on the firewall. Since MNs do not usually provide | |||
| services, this is not usually a problem. But if this is necessary to | services, this is not usually a problem. But if this is necessary to | |||
| do, the pattern to look for is | do, the pattern to look for is | |||
| Destination Address: MN HoA | Destination Address: MN HoA | |||
| Allowing this traffic might allow any kind of traffic, including | Allowing this traffic might allow any kind of traffic, including | |||
| skipping to change at page 8, line 30 | skipping to change at page 6, line 23 | |||
| Mobility Header Type: 5 | Mobility Header Type: 5 | |||
| This allows the BU to traverse the firewall and the BA can pass the | This allows the BU to traverse the firewall and the BA can pass the | |||
| firewall without any assistance. Therefore, the Binding Update | firewall without any assistance. Therefore, the Binding Update | |||
| sequence can be performed successfully. | sequence can be performed successfully. | |||
| 4.4. Route Optimization data traffic from MN | 4.4. Route Optimization data traffic from MN | |||
| Also the Route Optimization data traffic from MN directly to the CN | Also the Route Optimization data traffic from MN directly to the CN | |||
| can not traverse the firewall without assistance. But as we have | can not traverse the firewall without assistance. The stateful | |||
| configured the firewall to allow the BU message from MN to the CN to | firewall rules specified in [MIP6FWVENDOR] will open a pinhole for | |||
| traverse the firewall, the Route Optimization data traffic is able to | this traffic. | |||
| pass through as it also matches the pinhole installed for the BU. | ||||
| Therefore, no additional pinhole rules are required. | ||||
| 4.5. Bi-directional tunnelled data traffic from the MN to the CN | 4.5. Bi-directional tunnelled data traffic from the MN to the CN | |||
| through HA | through HA | |||
| If a MN tries to initiate traffic to a CN through the HA using bi- | If a MN tries to initiate traffic to a CN through the HA using bi- | |||
| directional tunnelling, a stateful firewall would prevent these | directional tunnelling, a stateful firewall would prevent these | |||
| connection requests to pass through as there is no established state | connection requests to pass through as there is no established state | |||
| on the firewall. This is usually a problem as CNs often provide | on the firewall. This is usually a problem as CNs often provide | |||
| services. A solution is to static configure the firewall to let this | services. A solution is to static configure the firewall to let this | |||
| traffic pass through. However, this is only an acceptable option if | traffic pass through. However, this is only an acceptable option if | |||
| skipping to change at page 9, line 15 | skipping to change at page 6, line 51 | |||
| Destination Port: Application Ports | Destination Port: Application Ports | |||
| If the ports are unknown, it is necessary to install a pinhole with | If the ports are unknown, it is necessary to install a pinhole with | |||
| only the Destination Address as pattern. Allowing this traffic might | only the Destination Address as pattern. Allowing this traffic might | |||
| allow any kind of traffic, including malicious traffic, to traverse | allow any kind of traffic, including malicious traffic, to traverse | |||
| to the CN. Allowing this traffic might allow any kind of traffic, | to the CN. Allowing this traffic might allow any kind of traffic, | |||
| including malicious traffic, to pass through unfiltered to the CN. | including malicious traffic, to pass through unfiltered to the CN. | |||
| This would expose the CN to any type of possibly malicious traffic, | This would expose the CN to any type of possibly malicious traffic, | |||
| resulting in a denial of service or exploitation of known security | resulting in a denial of service or exploitation of known security | |||
| vulnerabilities. This practice is NOT RECOMMENDED | vulnerabilities. This practice is NOT RECOMMENDED. | |||
| 5. Mobile Node behind a firewall | 5. Mobile Node behind a firewall | |||
| This section presents the recommendations for configuring a firewall | This section presents the recommendations for configuring a firewall | |||
| that protects the network a mobile node visiting. For each type of | that protects the network a mobile node visiting. For each type of | |||
| traffic that needs to pass through this firewall, recommendations are | traffic that needs to pass through this firewall, recommendations are | |||
| presented on how to identify that traffic. The following types of | presented on how to identify that traffic. The following types of | |||
| traffic are considered | traffic are considered | |||
| o Signaling between MN and HA | o Signaling between MN and HA | |||
| o Route Optimization Signaling between MN and CN | o Route Optimization Signaling between MN and CN | |||
| o IKEv2 signaling between MN and HA for establishing SAs | o IKEv2 signaling between MN and HA for establishing SAs | |||
| o Data traffic from and to MN | ||||
| 5.1. Signaling between MN and HA | 5.1. Signaling between MN and HA | |||
| As described in Section 3.1, the signaling between the MN and HA is | As described in Section 3.1, the signaling between the MN and HA is | |||
| protected using IPSec ESP. Currently, a lot of firewalls are | protected using IPSec ESP. Currently, a lot of firewalls are | |||
| configured to block the incoming ESP packets. Moreover, from the | configured to block the incoming ESP packets. Moreover, from the | |||
| view of the firewall, both source and destination addresses of these | view of the firewall, both source and destination addresses of these | |||
| messages from/to mobile node are variable. Fortunately, for a | messages from/to mobile node are variable. Fortunately, for a | |||
| stateful firewall, if the initial traffic is allowed through the | stateful firewall, if the initial traffic is allowed through the | |||
| firewall, then the return traffic is also allowed. A mobile node is | firewall, then the return traffic is also allowed. A mobile node is | |||
| always the initiator for the BU. Since MN's CoA is not able to be | always the initiator for the BU. Since MN's CoA is not able to be | |||
| known in advance, the firewall can use following pattern to permit | known in advance, the firewall can use following patterns to permit | |||
| these messages through. | these messages through. | |||
| Source Address: Visited subnet prefix | Source Address: Visited subnet prefix | |||
| IP payload protocol number: 50 (ESP) | ||||
| Destination Address: Address of HA | ||||
| Next Header: 50 (ESP) | ||||
| Mobility Header Type: 1 (HoTI) | ||||
| Source Address: Visited subnet prefix | ||||
| Destination Address: Address of HA | ||||
| Next Header: 50 (ESP) | ||||
| Mobility Header Type: 5 (BU) | ||||
| This pattern will allow the initial packets (e.g. BU from MNs to HA, | This pattern will allow the initial packets (e.g. BU from MNs to HA, | |||
| HoTI, etc.) to pass through the firewall. Then the return packets | HoTI, etc.) to pass through the firewall. Then the return packets | |||
| (BA from HA to MN, HoT) is also able to pass through accordingly. | (BA from HA to MN, HoT) is also able to pass through accordingly. | |||
| 5.2. Signaling between MN and CN | 5.2. Signaling between MN and CN | |||
| Route Optimization allows direct communication of data packets | Route Optimization allows direct communication of data packets | |||
| between the MN and a CN without tunneling it back through the HA. It | between the MN and a CN without tunneling it back through the HA. It | |||
| includes 3 pairs of messages: HoTI/HoT, CoTI/CoT and BU/BA. The | includes 3 pairs of messages: HoTI/HoT, CoTI/CoT and BU/BA. The | |||
| first pair can pass through the firewall using the pattern described | first pair can pass through the firewall using the pattern described | |||
| in section 5.1. Here we discuss CoTI/CoT and BU/BA messages. | in section 5.1. Here we discuss CoTI/CoT and BU/BA messages. | |||
| Following pattern permits these messages through the firewall. | Following pattern permits these messages through the firewall. | |||
| Source Address: Visited subnet prefix | Source Address: Visited subnet prefix | |||
| IP payload protocol number: 135 (Mobility Header) | Mobility Header Type: 2 (CoTI) | |||
| Source Address: Visited subnet prefix | ||||
| Mobility Header Type: 5 (BU) | ||||
| This pattern allows the initial messages (CoTI and BU) from the MN to | This pattern allows the initial messages (CoTI and BU) from the MN to | |||
| the CN pass through the firewall. The return messages (CoT and BA) | the CN pass through the firewall. The return messages (CoT and BA) | |||
| from the CN to the MN can also passes through the firewall | from the CN to the MN can also passes through the firewall | |||
| accordingly. | accordingly. | |||
| 5.3. IKEv2 signaling between MN and HA for establishing SAs | 5.3. IKEv2 signaling between MN and HA for establishing SAs | |||
| The MN and HA exchange IKEv2 signaling in order to establish the | The MN and HA exchange IKEv2 signaling in order to establish the | |||
| security associations. The security associations so established will | security associations. The security associations so established will | |||
| later be used for securing the mobility signaling messages. Due to | later be used for securing the mobility signaling messages. Due to | |||
| variable source/destination IP addresses and MN always as initiator, | variable source/destination IP addresses and MN always as initiator, | |||
| the following pattern will let the negotiation pass. | the following pattern will let the negotiation pass. | |||
| Source Address: Visited subnet prefix | Source Address: Visited subnet prefix | |||
| Transport Protocol: UDP | Transport Protocol: UDP | |||
| Destination UDP Port: 500 | Destination UDP Port: 500 | |||
| 5.4. Data traffic from and to the MN | ||||
| After sending the home binding update, every traffic packet between | ||||
| MN and HA will be encapsulated by ESP. As described in section 5.1, | ||||
| the firewall allows theses packets pass through. However, if a CN | ||||
| tries to initiate traffic to an MN, a stateful firewall would prevent | ||||
| these connection requests to pass through as there is no established | ||||
| state on the firewall. We may use following steps to establish a | ||||
| channel state between MN and CN: | ||||
| 1. When detecting BU message from MN to CN with protocol number 135 | ||||
| and mobility header type 5, the firewall extracts the home | ||||
| address from the destination option. | ||||
| 2. Firewall adds a security rule to its table with following | ||||
| pattern. | ||||
| Destination Address: CoA | ||||
| Source Address: CN | ||||
| Routing Header Type 2 Address: HoA | ||||
| Thereafter any packets to MN will be filtered by above pattern. | ||||
| 6. Contributors | 6. Contributors | |||
| This document is one of the deliverables of the MIPv6 firewall | This document is one of the deliverables of the MIPv6 firewall | |||
| design. The following members of the team were involved in the | design. The following members of the team were involved in the | |||
| creation of this document. | creation of this document. | |||
| Hannes Tschofenig Hannes.Tschofenig@gmx.net | Hannes Tschofenig Hannes.Tschofenig@gmx.net | |||
| Gabor Bajko Gabor.Bajko@nokia.com | Gabor Bajko Gabor.Bajko@nokia.com | |||
| Suresh Krishnan suresh.krishnan@ericsson.com | Suresh Krishnan suresh.krishnan@ericsson.com | |||
| Hesham Soliman solimanhs@gmail.com | Hesham Soliman solimanhs@gmail.com | |||
| Yaron Sheffer yaronf@checkpoint.com | Yaron Sheffer yaronf@checkpoint.com | |||
| Qiu Ying qiuying@i2r.a-star.edu.sg | Qiu Ying qiuying@i2r.a-star.edu.sg | |||
| Ram Vishnu vishnu@motorola.com | ||||
| Niklas Steinleitner steinleitner@cs.uni-goettingen.de | Niklas Steinleitner steinleitner@cs.uni-goettingen.de | |||
| Vijay Devarapalli vijay.devarapalli@AzaireNet.com | Vijay Devarapalli vijay.devarapalli@AzaireNet.com | |||
| 7. IANA Considerations | 7. IANA Considerations | |||
| This document does not require any IANA action. | This document does not require any IANA action. | |||
| 8. Security Considerations | 8. Security Considerations | |||
| This document specifies recommendations for firewall administrators | This document specifies recommendations for firewall administrators | |||
| to allow Mobile IPv6 traffic to pass through unhindered. Since some | to allow Mobile IPv6 traffic to pass through unhindered. Since some | |||
| skipping to change at page 14, line 15 | skipping to change at page 9, line 20 | |||
| 8. Security Considerations | 8. Security Considerations | |||
| This document specifies recommendations for firewall administrators | This document specifies recommendations for firewall administrators | |||
| to allow Mobile IPv6 traffic to pass through unhindered. Since some | to allow Mobile IPv6 traffic to pass through unhindered. Since some | |||
| of this traffic is encrypted it is not possible for firewalls to | of this traffic is encrypted it is not possible for firewalls to | |||
| discern whether it is safe or not. This document recommends a | discern whether it is safe or not. This document recommends a | |||
| liberal setting so that all legitimate traffic can pass. This means | liberal setting so that all legitimate traffic can pass. This means | |||
| that some malicious traffic may be permitted by these rules. These | that some malicious traffic may be permitted by these rules. These | |||
| rules may allow the initiation of Denial of Service attacks against | rules may allow the initiation of Denial of Service attacks against | |||
| Mobile IPv6 capable nodes (the MNs, CNs and the HAs). Especially the | Mobile IPv6 capable nodes (the MNs, CNs and the HAs). Especially the | |||
| rules specified in Section 3.4 and Section 4.5 are broadly defined | rules specified in Section 3.3 and Section 4.5 are broadly defined | |||
| and hence possess the most potential for abuse. Hence, if these | and hence possess the most potential for abuse. Hence, if these | |||
| rules are implemented, the firewalls SHOULD be configured to rate- | rules are implemented, the firewalls SHOULD be configured to rate- | |||
| limit such traffic on a per-destination basis. This would allow the | limit such traffic on a per-destination basis. This would allow the | |||
| firewall to mitigate possible denial of service attacks on the | firewall to mitigate possible denial of service attacks on the | |||
| endpoints. Please note that such measures would not mitigate other | endpoints. Please note that such measures would not mitigate other | |||
| potential security issues. | potential security issues. | |||
| 9. Normative References | 9. Normative References | |||
| [MIP6FWVENDOR] | ||||
| Krishnan, S., "Guidelines for firewall vendors regarding | ||||
| MIPv6 traffic", draft-krishnan-mip6-firewall-vendor-01 | ||||
| (work in progress), November 2007. | ||||
| [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | |||
| Requirement Levels", BCP 14, RFC 2119, March 1997. | Requirement Levels", BCP 14, RFC 2119, March 1997. | |||
| [RFC3775] Johnson, D., Perkins, C., and J. Arkko, "Mobility Support | [RFC3775] Johnson, D., Perkins, C., and J. Arkko, "Mobility Support | |||
| in IPv6", RFC 3775, June 2004. | in IPv6", RFC 3775, June 2004. | |||
| [RFC4487] Le, F., Faccin, S., Patil, B., and H. Tschofenig, "Mobile | [RFC4487] Le, F., Faccin, S., Patil, B., and H. Tschofenig, "Mobile | |||
| IPv6 and Firewalls: Problem Statement", RFC 4487, | IPv6 and Firewalls: Problem Statement", RFC 4487, | |||
| May 2006. | May 2006. | |||
| End of changes. 28 change blocks. | ||||
| 106 lines changed or deleted | 73 lines changed or added | |||
This html diff was produced by rfcdiff 1.34. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ | ||||