Subject: Re: 6to4 security questions

From: Erik Nordmark <[email-masked]>
Date: Thu, 16 Jan 2003 20:16:52 +0100 (CET)

A long time ago Jason said:

> At Sun we are using 6to4, as an early transition mechanism, for our 
> deployment.  For the past few years we have had a few (read 3) 
> engineering sites connected by configured tunnels.  We found deployment 
> scalability problems with this approach, so we decided to go with 6to4. 

What Jason forgot to mention was that this deployment (inside Sun's firewalls)
uses exclusively 6to4 addresses. Thus there are no 6to4 relays.

   Erik

---

From: [email-masked]
Date: Sat, 18 Jan 2003 09:04:38 +0900

>uses exclusively 6to4 addresses.

	you mean that there's no external connectivity to the 6bone?  if sun's
	firewall is acting as a 6to4 border router, the box is subject to
	various attacks (as it will accept 6to4-encapsulated packet from
	anybody).

>Thus there are no 6to4 relays.

	having 6to4 relay router is totally different question from running
	a 6to4 site.

itojun

---

From: Francis Dupont <[email-masked]>
Date: Sun, 19 Jan 2003 16:47:28 +0100

>uses exclusively 6to4 addresses.
   
   	you mean that there's no external connectivity to the 6bone?

=> yes, this is what Jason and other Sun people described at the last IETF.
This is a good usage case for 6to4, with no external security issue at all.

        if sun's

   
=> and this is a cause of security and non technical burdens...   

Regards

[email-masked]

---

From: Erik Nordmark <[email-masked]>
Date: Sun, 19 Jan 2003 23:06:30 +0100 (CET)

> 	various attacks (as it will accept 6to4-encapsulated packet from

Yep.
The Sun boxes you see in the 6bone are external to the firewall.
Those boxes do not use 6to4.

> 	having 6to4 relay router is totally different question from running

Not if all of it is sitting in an isolated network (inside a proxy-based
firewall).

The point is that if you have both native IPv6 address and 6to4 addresses
in a routing realm, then you need relays.
The deployment inside the Sun firewall avoids this by only using 6to4
addresses. Hence it doesn't test the relay aspects of 6to4.

  Erik