360Understanding IPv6, Second Edition

■If your ISATAP router and edge firewall are different devices, configure your IPv4-based edge firewall to silently discard all IPv4 traffic with the IPv4 Protocol field set to 41 on the interface attached to the intranet. This will prevent IPv4 Internet connectivity to ISATAP hosts on the intranet.

■If the ISATAP hosts on your intranet must communicate with hosts on the IPv6 Internet, upgrade your edge firewall between your intranet and the IPv6 Internet to support stateful IPv6 firewalling.

For more information about 6to4, see Chapter 13, “6to4.” For more information about ISATAP, see Chapter 12, “ISATAP.” For more information about Teredo, see Chapter 14, “Teredo.”

Summary

When deploying IPv6 on your network, you should be aware of the following security considerations: authorization for automatically assigned addresses and configurations, protection of IP packets, host protection from scanning and attacks, and control of what traffic is exchanged with the Internet.

References

The following references were cited in this chapter:

■RFC 3118 — “Authentication for DHCP Messages”

■RFC 3315 — “Dynamic Host Configuration Protocol for IPv6 (DHCPv6)”

■RFC 3971 — “SEcure Neighbor Discovery (SEND)”

■RFC 4191 — “Default Router Preferences and More-Specific Routes”

■RFC 4301 — “Security Architecture for the Internet Protocol”

■RFC 4302 — “IP Authentication Header”

■RFC 4303 — “IP Encapsulating Security Payload (ESP)”

■RFC 4861 — “Neighbor Discovery for IP Version 6 (IPv6)”

You can obtain these RFCs from the \RFCs_and_Drafts folder on the companion CD-ROM or from http://www.ietf.org/rfc.html.

Testing for Understanding

To test your understanding of IPv6 security considerations, answer the following questions. See Appendix D, “Testing for Understanding Answers,” to check your answers.

1.Without support for SEND or DHCP message authentication, what can you do to help prevent unauthorized intranet hosts from obtaining an IPv6 address and configuration?

2.Why are IPv6 addresses with EUI-64-based interface IDs more vulnerable to address scans than addresses with randomly derived interface IDs?

3.Will a port scan be able to detect a server service on a host even when a host-based stateful firewall is running?

4.What is the recommended configuration for exchanging IPv6 traffic between an intranet and the IPv6 Internet?