Default security functions on an IPv6 CPE

[Guillaume.Leclanche at swisscom.com]

Hello,

As a service provider, we deliver CPEs to our broadband customers as part of the service. We're currently enabling v6 on our network, and before going into production we have an open question regarding security that we're not able to answer internally, so let's check the community : 

** A SP deliver the CPEs with a stateful IPv6 firewall providing the same security features as an IPv4 NAPT, should it be turned ON or OFF by default ?

(and of course it's user configurable afterwards, that's not the question)

Guillaume