Re: draft-ietf-v6ops-nap-04

[Brian E Carpenter <brc@zurich.ibm.com>]

As Fred has pointed out, NAT is functionally
equivalent to a stateful firewall. What we can say is:

NAT provides exactly the same level of security as a stateful
firewall, and no more. Therefore, IPv6 users behind a stateful
firewall are entitled to exactly the same feeling of security
as users behind an IPv4 NAT; no more and no less.

   Brian


Gunter Van de Velde (gvandeve) wrote:
> I was wondering on the message we agree upon here for this particular
> point, so we can work on a re-write?
>
> <>
> NAT does provide a feeling of security that should not be there, however
> with IPv6 people will receive more indicative signals on more secure
> topologies for their infrastructure/applications/OperatingSoftware?
> <>
>
> G/
>
>
> -----Original Message-----
> From: owner-v6ops@ops.ietf.org [mailto:owner-v6ops@ops.ietf.org] On
> Behalf Of Brian E Carpenter
> Sent: Wednesday, November 01, 2006 4:50 PM
> To: Margaret Wasserman
> Cc: v6ops@ops.ietf.org; Jari Arkko
> Subject: Re: draft-ietf-v6ops-nap-04
>
> Margaret Wasserman wrote:
>
> > Hi Brian,
> >
> > On Oct 31, 2006, at 6:07 AM, Brian E Carpenter wrote:
> >
> >
> > > > the right place to define a new untraceable addressing mechanim.
> > >
> > >
> > > It certainly can't purport to be a formal spec. But removing it would
>
>
> > > leave a hole. Would you be OK with adding some clear disclaimer text 
> > > saying that it is not a formal spec?
> >
> >
> > I can live with that.
> >
> >
> > > > >   o  On a local network, any user will have more security
>
> awareness.
>
> > > > >      This awareness will motivate the usage of simple firewall
> > > > >      applications/devices to be inserted on the border between
>
> the
>
> > > > >      external network and the local (or home network) as there
>
> is no
>
> > > > >      Address Translator and hence no false safety perception.
> > > > [Substantive] IPv6 will not make users have more security awareness.
> > > > When we say something like this, we are emitting the same type of 
> > > > marketing hype that we deride in the vendors of NAT products.  This 
> > > > bullet should just be omitted.
> > >
> > >
> > > Yes, it's a bit slack, and naive about the way real users behave.
> >
> >
> > Based on your indication that there are two issues that you are not 
> > going to fix, I gather you aren't going to fix this one, even though 
> > you agree that it is slack and naive?  Why not?
>
>
> That's really not what I meant. I think this text does need fixing.
> I'm a bit reluctant to delete it because I think there is a nugget of
> value in there. But we authors need to get together; I can't speak for
> the others.
>
>      Brian