Subject: [v6ops] Passive IP addresses - 2th iteration

From: "Gunter Van de Velde (gvandeve)" <[email-masked]>
Date: Sun, 7 Oct 2012 09:29:40 +0000

Hi WG,

I am picking the ball up again wrt Passive IP addresses, particular in the light of all the discussions around the tools.ietf.org/html/draft-ietf-opsec-lla-only IP addresses.
(http://www.ietf.org/id/draft-baker-opsec-passive-ip-address-01.txt)

One of the considerations regarding usage of LLA-Only is that network visibility is undermined for a part.
This is exactly one of the things that Passive addresses can aid with. It provides network visilbility, while still protecting the network from some external influences.

So in a nutshell:
Q) What is a passive address?
A) any kind of address you configure on a device or interface

Q) is there need for a new address type specified by IANA
A) No

Q) what makes an address a passive address
A) during configuration of that address on an interface/device you specify for example: ip address foo 'passive'

Q) what does the passive keyword result into
A) If the recipient device receives an IP packet with this passive address in the destination address and is destined for this device, then the packet will be dropped. However, when the device gets for example a packet with TTL expired (for trace-route) then this passive address could be used as the source address

Q) can a passive address be used to build a session with?
A) nope, it only accommodates unidirectional traffic

G/

---

From: "Gunter Van de Velde (gvandeve)" <[email-masked]>
Date: Sun, 7 Oct 2012 10:32:43 +0000

Edge ACL tend to be wrong after a while (too much operation involved etc...)

This is just another way to shield the infrastructure. 

Often within a network non-LLA's are used for traffic path visibility, or for trace-routes.
Passive addresses will in that case reduce the attack vector as they are useless as a destination address, because the recipient target box will drop any packet received where this address is used as destination address.

It does not mean that you should not use perimeter ACL or FW's at all.
That is still good practice.

G/

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dobbins, Roland
Sent: 07 October 2012 12:27
To: opsec wg mailing list
Cc: v6ops v6ops WG ([email-masked])
Subject: Re: [OPSEC] Passive IP addresses - 2th iteration

On Oct 7, 2012, at 4:29 PM, Gunter Van de Velde (gvandeve) wrote:

> A) If the recipient device receives an IP packet with this passive address in the destination address and is destined for this device, then the packet will be dropped.

What's the advantage to this over ACLs?  It seems just another way to fragment (pardon the pun, heh) network access policy even further than it already is.

-----------------------------------------------------------------------
Roland Dobbins <[email-masked]> // <http://www.arbornetworks.com>

	  Luck is the residue of opportunity and design.

		       -- John Milton

_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec

---

From: "Gunter Van de Velde (gvandeve)" <[email-masked]>
Date: Sun, 7 Oct 2012 11:50:23 +0000

I fairly do not see what ACL have to do with Passive addresses?
They serve completely different goals (and are to some degree ortogonal).

ACls should still be used where ever found usefull. Passive address can be used where deemed usefull for device protection while still allowing limited troubleshooting within the network (traceroute, traps as most important onces).
Please feel free to read the draft.

G/

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Dobbins, Roland
Sent: 07 October 2012 12:42
To: opsec wg mailing list
Cc: v6ops v6ops WG ([email-masked])
Subject: Re: [OPSEC] Passive IP addresses - 2th iteration

> Edge ACL tend to be wrong after a while (too much operation involved etc...)

Operational entropy applies to all forms of policy.

> This is just another way to shield the infrastructure. 

A potentially duplicative, confusing and unnecessary way, IMHO.

		       -- John Milton

---

From: "Dobbins, Roland" <[email-masked]>
Date: Sun, 7 Oct 2012 10:27:05 +0000

-- John Milton

---

From: "Dobbins, Roland" <[email-masked]>
Date: Sun, 7 Oct 2012 10:41:31 +0000

-- John Milton

---

From: "Dobbins, Roland" <[email-masked]>
Date: Sun, 7 Oct 2012 12:36:39 +0000

On Oct 7, 2012, at 6:50 PM, Gunter Van de Velde (gvandeve) wrote:

>  Passive address can be used where deemed usefull for device protection while still allowing limited troubleshooting within the network (traceroute, traps as most important onces).

What you're describing is a policy function already encapsulated by ACLs.

And in general, it seems to follow the deplorable trend of continuing to overload IP addresses with more and more significance when a) they're already grossly overloaded and b) we're supposedly going to a world of IPv6 addresses, which should imply *less* significance, not more.

		       -- John Milton

---

From: Gert Doering <[email-masked]>
Date: Mon, 8 Oct 2012 13:00:58 +0200

Hi,

> I fairly do not see what ACL have to do with Passive addresses?

Well, I have to agree with Roland - a "passive IP address" would be one
that has a "receive ACL", or "control plane policy with drop-all" or
however a vendor calls that feature "do not accept packets for a certain
IP address" attached to it.

Don't confuse with transit ACLs.

(Now, not all vendors ship useful implementations of rRACLs or CoPP today,
but those wouldn't know what a passive IP address is either)

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

---

From: Fernando Gont <[email-masked]>
Date: Mon, 22 Oct 2012 22:43:32 -0300

Folks,

[Disclaimer: I'm catching up with email, and may ahve missed important
discussions]

On 10/07/2012 06:29 AM, Gunter Van de Velde (gvandeve) wrote:
> A) If the recipient device receives an IP packet with this passive
> address in the destination address and is destined for this device, then
> the packet will be dropped. However, when the device gets for example a
> packet with TTL expired (for trace-route) then this passive address
> could be used as the source address

Is this any different from an IPv6 "alias" + the corresponding ACLs?

Cheers,
-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1