356 Understanding IPv6, Second Edition

protection against ND-based denial of service (DoS) attacks by nodes with manually configured IPv6 addresses, which are not derived from an exchange of Router Solicitation and Router Advertisement messages. In contrast, there is no protection against Address Resolution Protocol (ARP) DoS attacks for IPv4. However, IPv6 in Windows Server 2008 and Windows Vista does not support SEND.

RFC 3118 defines a method to authenticate message exchanges for stateful address configuration with DHCPv6. IPv6 in Windows Server 2008 and Windows Vista supports DHCPv6 but does not support RFC 3118.

Another configuration consideration is that IPv6 hosts can configure additional routes based on received Router Advertisement messages. A malicious node could configure IPv6 hosts with improper routes and disrupt IPv6-based network connectivity. IPv6 nodes that support RFC 4191 can detect unreachable routes and prevent them from being added to the IPv6 routing table. IPv6 in Windows Server 2008 and Windows Vista supports RFC 4191.

Recommendations

To prevent unauthorized computers from communicating on intranets, the recommendation is that you use IEEE 802.1X authentication to authenticate all computers that are connecting to your network with wired or wireless connections. With IEEE 802.1X–based authentication at the link layer, computers cannot send any network traffic until they have authenticated themselves to a switch or wireless access point. Only after a successful IEEE 802.1X authentication can an IPv6 host use address autoconfiguration protocols such as ND or DHCPv6 to obtain an automatically assigned IPv6 address configuration.

In Windows Server 2008 and Windows Vista, the Network Access Protection (NAP) platform provides additional protection for 802.1X-authenticated connections by requiring that computers meet system health requirements before obtaining a connection that allows unlimited access to the intranet. For more information about NAP, see http://www.microsoft.com/nap.

Protection of IPv6 Packets

To help protect IPv6 packets from tampering (data modification) and interpretation (passive capturing) by intermediate or neighboring nodes, IPv6 packets can be protected with Internet Protocol security (IPsec). IPsec uses cryptographic security services to provide tampering protection, spoofing protection, and optional encryption for IP packets. IPsec is defined in RFCs 4301, 4302, and 4303 for both IPv4 and IPv6 traffic.

Windows Server 2008 and Windows Vista provide full support for IPsec for both IPv4 and IPv6 with negotiation of security associations using Internet Key Exchange (IKE) or Authenticated IP (AuthIP), automatic determination of cryptographic keys, and a graphical user interface to configure IPsec policy settings. You can configure IPsec policy settings as part of Computer Configuration Group Policy and easily propagate IPsec policy settings throughout an organization that uses Active Directory domain services.