Re: On saving end-to-end transparency

[Joel Jaeggli <joelja@bogus.com>]

you've got ipv4 without a filter... also there's about 2000 unmanaged
devices inside the perimeter.

On 03/23/2010 08:00 AM, RÃmi DesprÃs wrote:
> For information: the IPv6 we have here is WITHOUT any filter (confirmed by the IETF NOC).
> Does anyone report a security problem ;-) ?
> RD
> 
>  
> Le 23 mars 2010 Ã 06:32, Mohacsi Janos a Ãcrit :
> 
>>
>>
>>
>> On Mon, 22 Mar 2010, Gert Doering wrote:
>>
>>> Hi,
>>>
>>> On Mon, Mar 22, 2010 at 08:32:38AM -0700, Fred Baker wrote:
>>>> That will have to be a working group decision. We have your opinion on the record.
>>>>
>>>> On Mar 22, 2010, at 8:25 AM, Mark Townsley wrote:
>>>>
>>>>> Let's err on the side of our ideals here. Publish draft-ietf-v6ops-cpe-simple-security, but do so without default-deny rules on by default. Let's not break end-to-end IPv6 before it even has a chance to grow up.
>>>
>>> Add another opinion to that.
>>>
>>> - have firewalling in there
>>> - default to "end-to-end communication permitted"
>>
>> Yes to have the firewalling capabilities in CPE (reflective session state if you like)
>> Yes to be default end-to-end communication permitted - but could be switched to default to deny by the end users, if he or she prefers NAT like behaviour.
>>
>> Best Regards,
>> 		Janos Mohacsi
>>
>>
> 
> 
>