Re: 6to4 security questions

[Francis Dupont <Francis.Dupont@enst-bretagne.fr>]

 In your previous mail you wrote:

   >A long time ago Jason said:
   >
   >> At Sun we are using 6to4, as an early transition mechanism, for our 
   >> deployment.  For the past few years we have had a few (read 3) 
   >> engineering sites connected by configured tunnels.  We found deployment 
   >> scalability problems with this approach, so we decided to go with 6to4. 
   >
   >What Jason forgot to mention was that this deployment (inside Sun's firewalls)
   >uses exclusively 6to4 addresses.
   
   	you mean that there's no external connectivity to the 6bone?

=> yes, this is what Jason and other Sun people described at the last IETF.
This is a good usage case for 6to4, with no external security issue at all.

        if sun's
   	firewall is acting as a 6to4 border router, the box is subject to
   	various attacks (as it will accept 6to4-encapsulated packet from
   	anybody).
   
   >Thus there are no 6to4 relays.
   
   	having 6to4 relay router is totally different question from running
   	a 6to4 site.
   
=> and this is a cause of security and non technical burdens...   

Regards

Francis.Dupont@enst-bretagne.fr