Microsoft: Give Xbox One users IPv6 connectivity

Tim Chown tjc at ecs.soton.ac.uk
Fri Mar 14 10:08:01 CET 2014


On 14 Mar 2014, at 00:50, SM <sm at resistor.net> wrote:

> Hi Marco,
> At 16:21 13-03-2014, Marco Sommani wrote:
>> AVM is not alone in its choices: they just do what is suggested in RFC 6092 - "Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service". I don't like what they do, but maybe we should blame IETF.
> 
> I took a quick look at some of the RFCs to figure out the guidance which was published.  The short summary is that it is confusing when security and "getting things to work" are taken together.

As others have pointed out, this is something of a bikeshed topic in the IETF discussions.  

As a result, the homenet arch text simply says, after IESG comment, the following:

  "The topic of whether future home networks as described in this
   document should have have a 'default deny' or 'default allow'
   position has been discussed at length in various IETF meetings
   without any consensus being reached on which approach is more
   appropriate.  Further, the choice of which default to apply may be
   situational, and thus this text makes no recommendation on the
   default setting beyond what is written on this topic in RFC 6092.  We
   note in Section 3.6.3 below that the implicit firewall function of an
   IPv4 NAT is commonplace today, and thus future CERs targeted at home
   networks should continue to support the option of running in 'default
   deny mode', whether or not that is the default setting.“

There are are least three IDs/RFCs documenting different models, including the recent draft-ietf-v6ops-balanced-ipv6-security-01.

Tim

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.cluenet.de/pipermail/ipv6-ops/attachments/20140314/3b283ac2/attachment.html 


More information about the ipv6-ops mailing list