<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On 14 Mar 2014, at 00:50, SM <<a href="mailto:sm@resistor.net">sm@resistor.net</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi Marco,<br>At 16:21 13-03-2014, Marco Sommani wrote:<br><blockquote type="cite">AVM is not alone in its choices: they just do what is suggested in RFC 6092 - "Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service". I don't like what they do, but maybe we should blame IETF.<br></blockquote><br>I took a quick look at some of the RFCs to figure out the guidance which was published. The short summary is that it is confusing when security and "getting things to work" are taken together.<br></blockquote><div><br></div>As others have pointed out, this is something of a bikeshed topic in the IETF discussions. </div><div><br></div><div>As a result, the homenet arch text simply says, after IESG comment, the following:</div><div><br></div><div> "<span style="line-height: 1.2em;">The topic of whether future home networks as described in this</span><pre style="line-height: 1.2em; margin-top: 0px; margin-bottom: 0px;"><font face="Helvetica"> document should have have a 'default deny' or 'default allow'
position has been discussed at length in various IETF meetings
without any consensus being reached on which approach is more
appropriate. Further, the choice of which default to apply may be
situational, and thus this text makes no recommendation on the
default setting beyond what is written on this topic in RFC 6092. We
note in Section 3.6.3 below that the implicit firewall function of an
IPv4 NAT is commonplace today, and thus future CERs targeted at home
networks should continue to support the option of running in 'default
deny mode', whether or not that is the default setting.“</font></pre><div><br></div><div>There are are least three IDs/RFCs documenting different models, including the recent draft-ietf-v6ops-balanced-ipv6-security-01.</div><div><br></div></div>Tim<div><br></div></body></html>