A challenge (was Re: Default security functions on an IPv6 CPE)

[S.P.Zeidler]

Thus wrote Mark Smith (msmith at internode.com.au):

> On 19/05/2011 3:54 PM, S.P.Zeidler wrote:
> >Thus wrote Mark Smith (nanog at 85d5b20a518b8f6864949bd940457dc124746ddc.nosense.org):
> >
> >>The part of the threat model that people are using to justify IPv6 CPE
> >>firewalling is invalid, because it is based on the invalid assumptions
> >>that:
> >>
> >>o  IPv6's address space is the same size as IPv4's
> >[...]
> >>o  that inbound unsolicited address scanning is the most likely attack
> >>vector.
> >
> >No. There are other ways to get at addresses but scanning, as has been
> >mentioned several times.
> 
> The original question was whether to enable a CPE firewall by
> default. The discussion is therefore constrained to threats for
> which a CPE firewall is a possible mitigation.

So you are assuming that the ONLY thing a CPE firewall EVER could do is
prevent an address scan?

Your argument "CPE firewalls / extra device firewalls are useless with
IPv6 because you can't scan for addresses with IPv6" makes not a
particular amount of sense, if you do admit that inside addresses may
be known by other means.

"address scanning" IMHO is entirely irrelevant to the discussion, and
only serves to cloud the issues that actually -are- there. Not all of
your points are bad, but this one is.

regards,
	spz
-- 
spz at serpens.de (S.P.Zeidler)