Scribd Logo
Upload

Welcome to Scribd!

  • IPv6Security Appendix Devices Overview

    Uploaded by

    Chỉnh Nguyễn Thế
    6 views2 pages
    This document summarizes IPv6 security considerations for different device types on a network, including hosts, switches, routers, customer premise equipment (CPE), and security equipment. It recommends securing the control plane through protocols like NDP, MLD, DHCPv6, and IGP/BGP. It also recommends securing the forwarding plane through techniques like IPv6 ACLs, ingress filtering, header validation, and firewalls/switches to filter IPv6 traffic and encapsulated traffic. Control plane and forwarding plane security work together to secure an IPv6 network.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    This document summarizes IPv6 security considerations for different device types on a network, including hosts, switches, routers, customer premise equipment (CPE), and security equipment. It recommends securing the control plane through protocols like NDP, MLD, DHCPv6, and IGP/BGP. It also recommends securing the forwarding plane through techniques like IPv6 ACLs, ingress filtering, header validation, and firewalls/switches to filter IPv6 traffic and encapsulated traffic. Control plane and forwarding plane security work together to secure an IPv6 network.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    6 views2 pages

    IPv6Security Appendix Devices Overview

    Uploaded by

    Chỉnh Nguyễn Thế
    This document summarizes IPv6 security considerations for different device types on a network, including hosts, switches, routers, customer premise equipment (CPE), and security equipment. It recommends securing the control plane through protocols like NDP, MLD, DHCPv6, and IGP/BGP. It also recommends securing the forwarding plane through techniques like IPv6 ACLs, ingress filtering, header validation, and firewalls/switches to filter IPv6 traffic and encapsulated traffic. Control plane and forwarding plane security work together to secure an IPv6 network.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    of 2

    IPv6 Security Considerations Per Device Type

    Security
    Host Switch Router CPE
    Equipment

    IPSec (if needed) HOST + HOST + HOST + Router


    RH0 [RFC5095] IPv6 ACLs Ingress Filtering Header chain Security
    and RPF [RFC7112] Equipment
    Overlapping Frags FHS
    [RFC5722] DHCPv6 Relay
    Support EHs DHCPv6 Server
    RA-Guard [RFC8213]
    Inspection Privacy Issues
    Atomic Fragments [RFC6105]
    OSPFv3
    [RFC6946] ICMPv6 fine
    DHCPv6 guard Auth. [RFC4552] grained filtering
    NDP IPv6 snooping
    Fragmentation or / and [RFC7166] Encapsulated
    [RFC6980] IPv6 source / Traffic Inspection
    prefix guard IS-IS
    Header chain
    [RFC5310] IPv6 Traffic
    [RFC7112] IPv6 destination
    Filtering
    guard or, less preferred,
    Stable IIDs [RFC5304]
    [RFC8064][RFC7217] MLD snooping
    [RFC7136] [RFC4541]
    MBGP
    Temp. Address DHCPv6-Shield
    Extensions [RFC7610] TCP-AO [RFC5925]
    [RFC8981] Obsoleted MD5
    Signature Option
    Disable if not used: [RFC2385]
    LLMNR, mDNS,
    DNS-SD, transition MBGP Bogon
    mechanisms prefix filtering
    Version: 20210423

    IPv6 Security Considerations On Your Network

    Control Plane Security Forwarding Plane Security


    IPv6 Internet

    BGP

    R Router
    IPv6

    P2P links
    IGP NDP
    R
    MLD

    R R
    Firewall FW

    NDP Switch FHS


    DHCPv6
    MLD
    DNS* IPv6

    Hosts Servers

    * All Name resolution related protocols


    Version: 20210423

    You might also like