Subject: Re: [OPSEC] Operational Security Considerations for IPv6 Networks (draft-ietf-opsec-v6)

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Wed, 17 Jul 2019 08:24:57 +0000

Jen, Ron,

As co-author of the document, the latest -17 revision dated 2019-07-05 addresses (at least from the authors point of view):
- the comments received during the WG meeting at IETF-104
- the OPSDIR review by Tim Chown dated 2018-07-02
- the WGLC ended in 2017-09-29

The state of the document in the datatracker is still "Revised I-D Needed - Issue raised by WGLC" since 2017-09-29 though. As I was co-chair at that point of time, I should have reset the state to a more suitable one... Would you mind resetting the state to a more suitable one?

Note: I have requested a slot to present this work at V6OPS https://datatracker.ietf.org/meeting/105/materials/agenda-105-v6ops-03

With all the reviews and the updates, may I kindly suggest, if the WG chairs and members agree, to request publication? Happy to talk to you in Montreal of course.

Thank you for considering this request,

-éric

On 06/07/2019, 18:43, "OPSEC on behalf of Enno Rey" <[email-masked] on behalf of [email-masked]> wrote:

    Dear WG Chairs, All,
    
    we've considered & mostly incorporated the input from the mailing list (thanks for the latest reviews and comments!) and from the IETF104 session, and we'd hence like to ask for WGLC of the document.
    
    thanks
    
    Enno

    -- 
    Enno Rey
    
    ERNW GmbH - Carl-Bosch-Str. 4 - 69115 Heidelberg - www.ernw.de
    Tel. +49 6221 480390 - Fax 6221 419008 - Cell +49 173 6745902 
    
    Handelsregister Mannheim: HRB 337135
    Geschaeftsfuehrer: Florian Grunow, Michael Schaefer 
    
    =======================================================
    Blog: www.insinuator.net || Conference: www.troopers.de
    Twitter: @Enno_Insinuator
    =======================================================
    
    _______________________________________________
    OPSEC mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/opsec

---

From: Ron Bonica <[email-masked]>
Date: Thu, 18 Jul 2019 15:02:10 +0000

Let's chat about this draft next week.

                   Ron

Juniper Business Use Only

-----Original Message-----
From: OPSEC <[email-masked]> On Behalf Of Eric Vyncke (evyncke)
Sent: Wednesday, July 17, 2019 4:25 AM
To: Enno Rey <[email-masked]>; [email-masked]
Subject: Re: [OPSEC] Operational Security Considerations for IPv6 Networks (draft-ietf-opsec-v6)

Jen, Ron,

Note: I have requested a slot to present this work at V6OPS https://urldefense.proofpoint.com/v2/url?u=https-3A__datatracker.ietf.org_meeting_105_materials_agenda-2D105-2Dv6ops-2D03&d=DwIGaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=Fch9FQ82sir-BoLx84hKuKwl-AWF2EfpHcAwrDThKP8&m=tKDbeL1CoA61cOYB4qes-qPlA6OoF-JpHL8i4N-84R4&s=WFsvLndSkHeRVrxUEQ5XD1rud9aErI8WpU_d-fGG8F8&e= 

-éric

    Dear WG Chairs, All,

    thanks
    
    Enno

    -- 
    Enno Rey

    
    
    _______________________________________________
    OPSEC mailing list
    [email-masked]
    https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_opsec&d=DwIGaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=Fch9FQ82sir-BoLx84hKuKwl-AWF2EfpHcAwrDThKP8&m=tKDbeL1CoA61cOYB4qes-qPlA6OoF-JpHL8i4N-84R4&s=MMHNZoI8mO00UpKvIkSdMEJDVMiHIxjBDKuTmrFBQ30&e= 

_______________________________________________
OPSEC mailing list
[email-masked]
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_opsec&d=DwIGaQ&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=Fch9FQ82sir-BoLx84hKuKwl-AWF2EfpHcAwrDThKP8&m=tKDbeL1CoA61cOYB4qes-qPlA6OoF-JpHL8i4N-84R4&s=MMHNZoI8mO00UpKvIkSdMEJDVMiHIxjBDKuTmrFBQ30&e=

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Sun, 21 Jul 2019 11:49:21 -0400

Hi Eric,

Thanks for considering my previous inputs.

However, I think it is still important to remark the different implications of MAP-T vs MAP-E and also consider lw4o6.

Same for the implications of not having a DNS proxy in some transition mechanism, as stated in RFC8585.

Also, in section 5.  Residential Users Security Considerations
    
    Replace
   If the Residential Gateway has IPv6 connectivity, [RFC7084] defines
   the requirements of an IPv6 CPE and does not take position on the
   debate of default IPv6 security policy as defined in [RFC6092]:
    
    with 
    If the Residential Gateway has IPv6 connectivity, [RFC7084] and [RFC8585] 
    define the requirements of an IPv6 CPE and does not take position on the 
    debate of default IPv6 security policy as defined in [RFC6092]:
    
    I think in this section, it makes sense a reference to Section 5.  UPnP Support of draft-ietf-v6ops-transition-ipv4aas, which also includes a reference to PCP support.

Does it make sense to mention a specific operator or should this paragraph be anonymized?
   There is also an alternate solution which has been deployed notably
   by Swisscom: open to all outbound and inbound connections at the
   exception of an handful of TCP and UDP ports known as vulnerable.

In any case "an handful" -> "a handful"?

Some nits:
2.1.1 more feasable -> more feasible ?

2.7.2 some bullets finish with ";" others with "."

3.2 Missing ending "." for paragraph at the end of "provided in Section 2.8"

Regards,
Jordi
@jordipalet

El 17/7/19 4:25, "OPSEC en nombre de Eric Vyncke (evyncke)" <[email-masked] en nombre de [email-masked]> escribió:

    Jen, Ron,

    

    
    -éric

        Dear WG Chairs, All,

        thanks
        
        Enno

        -- 
        Enno Rey

        

**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.theipv6company.com
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.