<div dir="ltr"><div>Hi folks,</div><div><br></div><div>I thought my understanding of IPv6 versus IPv4 would be stale and out of date and have been reluctant to expound further since this is in effect an email list for network experts....<br></div><div><br></div><div>This discussion on NAT has disavowed me of that. Clearly there is a big gulf in understanding of what IPv6 is like and it's capacities.</div><div><br></div><div><br></div><div>So allow me to provide a short potted version - that may be wrong, since it's been a decade or so since I last looked at it in detail...</div><div><br></div><div><br></div><div>IPv6 first creates a link local IP address that is routable within the local broadcast domain, and asks for the details of the local router configuration. Think of this as creating your own automatic private address (aka IPv4 private address). This will always be unique, given the size of the address space and will never route outside the broadcast domain.</div><div><br></div><div>Right there you have everything that a private network needs. In addition, all comms on the network are IPSEC secured.</div><div><br></div><div>If your network needs to connect to other networks - local or external - the router will tell you the network address range - and you will assign yourself an address in that range... Now you are routable outside your network and indeed theoretically to the entire internet.</div><div><br></div><div>This is where everyone seems to panic. But it's no different to having an external IPv4:port pair NAT reachable address, except now the device doesn't need to do anything - if the traffic is allowed through the firewall to that address it gets through. Exactly the same as a NAT firewall rule - allowed? yes, Not allowed? no.</div><div><br></div><div>and all that external traffic is IPSEC secured too - no snooping, no man in the middle, etc. - without you doing ANYTHING.</div><div><br></div><div>Now your device has 2 addresses. one local and one global. How you set your firewall up depends entirely and only on what services you want to allow into your network... Only now it's much easier, because you don't have to worry about translating addresses, configuring different ports to the standard set, running out of your NAT pool, leaking internal addresses to external networks, or ANYTHING that plagues firewall configuration now. Did I mention your processor load on your firewall is decreased? that too.</div><div><br></div><div><br></div><div>Sorry if I sound a bit harsh, but frankly, the reason IPv6 isn't supported in industry is because you don't understand it, not because it's not good.</div><div><br></div><div><br></div><div>And yes, I am in a grumpy mood today - why, is it showing?</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Nov 6, 2014 at 11:05 AM, Mark Newton <span dir="ltr"><<a href="mailto:newton@atdot.dotat.org" target="_blank">newton@atdot.dotat.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><br>
On Nov 6, 2014, at 9:12 AM, Nathanael Bettridge <<a href="mailto:nathanael@prodigy.com.au">nathanael@prodigy.com.au</a>> wrote:<br>
<br>
> I like and regularly use the ability to remap ports between disparate machines or to different ports transparently, without having to use a port proxy.<br>
> I like and regularly use the ability to present an arbitrary number of addresses as one to another network, or map between different address structures.<br>
<br>
</span>I like and regularly use networks which keep concentrations of state on the edge.<br>
<br>
(why do you even care about ports? Oh, substandard application architecture which forces you to micromanage 16 bit numbers. Never mind, carry on…)<br>
<span class=""><br>
> These are really handy tools to have to solve problems.<br>
<br>
</span>They’re also really handy tools to turn yourself into a DoS-magnet.<br>
<br>
An important plank of security is “availability.” You’re reducing that every time you put another bit of state in your core. These people who claim that NAT is helping their security seem to have a somewhat more limited view of “security” than the commonly accepted one that network professionals strive to attain.<br>
<span class="HOEnZb"><font color="#888888"><br>
- mark<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">Dr Paul van den Bergen<br><br></div>
</div>