[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: draft-ietf-v6ops-cpe-simple-security-12.txt feedback

Hi Fred,

On Sun, 8 Aug 2010 16:05:36 -0700
Fred Baker <fred@cisco.com> wrote:

> 
> On Aug 8, 2010, at 3:00 AM, Mark Smith wrote:
> 
> > It might be better to say in this draft something like, "all
> > multicast traffic is not to be forwarded by the CPE, unless appropriate
> > multicast traffic security mechanisms have been implemented. Such
> > multicast security mechanisms are out of scope for this memo." (or
> > addressed in a multicast security RFC that I'm not aware of.)
> 
> Again, I'm wrestling with the distinction between the security draft and the CPE Router draft. Absent the configuration of some form of multicast routing, I would be surprised by the router forwarding anything at all. Configuration of routing protocols or mechanisms, and routing behaviors on or off by default, sounds more like the subject of the CPE Router draft to me. I should think that the security draft is about filters - "presuming that a standard router would choose to forward the datagram, is there any other policy that would prevent it?" A standard router doesn't do a thing with MLD unless it is configured to do so.

I suppose that might mean there are three levels/layers of problem,
with parts of the layers covered by the two drafts (and possibly
are to be covered by other drafts)

- what are the capabilities of the CPE (unicast routing is the
  baseline, capable of routing multicast is optional)

- what capabilities are enabled by default

- what are appropriate security measures for those capabilities, with
  whether they're enabled by default being an influence on what is
  appropriate.

I suppose my comments have been a bit influenced by some of the IPv6 CPE
I've been working with. They have multicast capabilities, and options
relating to IGMP or MLD snooping. Since they're low end residential
CPE at a low price point, inherently I think I've started to accept
that their capabilities are the baseline IPv6 CPE functionality that
will be common.

Regards,
Mark.