ipv6 security consideration
TRANSCRIPT
-
8/2/2019 IPV6 Security Consideration
1/16
Click to edit Master subtitle style
5/5/12
-
8/2/2019 IPV6 Security Consideration
2/16
5/5/12
IPv6 Security Considerations
-
8/2/2019 IPV6 Security Consideration
3/16
5/5/12
IPv6 Security Considerations
Authorization for automatically assigned addressesand configurations
Protection of IPv6 packets
Host protection from scanning and attacks
-
8/2/2019 IPV6 Security Consideration
4/16
5/5/12
Authorization for AutomaticallyAssigned Addressesand Configurations
IPv6 hosts can use the following methods to obtain an address
configuration:
1-Neighbor Discovery (ND) with an exchange of RouterSolicitation and Router Advertisement messages.
2-Dynamic Host Configuration Protocol for IPv6 (DHCPv6).
-
8/2/2019 IPV6 Security Consideration
5/16
5/5/12
Authorization for AutomaticallyAssigned Addressesand Configurations
For ND-based IPv6 configuration, SEcure NeighborDiscovery (SEND) (defined in RFC 3971) can provideprotection for Router Solicitation and Router
Advertisement messages. SEND can also provideprotection for Neighbor Solicitation and NeighborAdvertisement message exchanges for address
resolution or neighbor unreachability detection.
IPv6 in Windows Server 2008 and Windows Vista does
not support SEND.
-
8/2/2019 IPV6 Security Consideration
6/16
5/5/12
Recommendations
To prevent unauthorized computers from communicating
on intranets, the recommendation is that you use IEEE802.1X authentication to authenticate all computers thatare connecting to your network with wired or wirelessconnections.
With IEEE 802.1Xbased authentication at the link layer,
computers cannot send any network traffic until theyhave authenticated themselves to a switch or wirelessaccess point. Only after a successful IEEE 802.1Xauthentication can an IPv6 host use addressautoconfiguration protocols such as ND or DHCPv6 to
obtain an automatically assigned IPv6 addressconfiguration.
-
8/2/2019 IPV6 Security Consideration
7/16
5/5/12
Protection of IPv6 Packets
To help protect IPv6 packets from tampering
(data modification) and interpretation
(passive capturing) by intermediate or
neighboring nodes, IPv6 packets can beprotected with Internet Protocol security (IPsec).
IPsec uses cryptographic security services toprovide tampering protection, spoofingprotection, and optional encryption for IPpackets.
-
8/2/2019 IPV6 Security Consideration
8/16
5/5/12
Host Protection from Scanningand Attacks
Address Scanning :
With IPv6, the scanning of a subnet for valid unicast IPv6addresses is made much more difficult by the large
number of possible addresses.
an attacker must theoretically scan up to 264 possible
addresses.
-
8/2/2019 IPV6 Security Consideration
9/16
5/5/12
Host Protection from Scanningand Attacks
Port Scanning :
To prevent a port scan, hosts should use a host-based stateful firewall.
Host-based stateful firewalls silently discard all incoming traffic thatdoes not correspond to either traffic sent in response to a request of thecomputer (solicited traffic) or unsolicited traffic that has been specifiedas allowed (excepted traffic).
A host-based stateful firewall will not prevent an attacker fromdetermining open ports on a host if those ports are being used for activecommunication or the ports correspond to a service being offered by thehost.
-
8/2/2019 IPV6 Security Consideration
10/16
5/5/12
Control of What Traffic IsExchanged with the Internet
To prevent unwanted traffic from the Internet,organizations typically deploy edge firewalls, proxies,and intrusion detection systems (IDSs).
These security devices attempt to ensure that anattackers traffic from the Internet .cannot penetrate tothe intranet
-
8/2/2019 IPV6 Security Consideration
11/16
5
/5/12
Recommendations
To prevent unwanted and unauthorizedIPv6 traffic from the Internet, you can dothe following:
v Upgrade your edge firewall, proxy, and IDS to include IPv6and tunneled IPv6
functionality.
v If your intranet computers must communicate with hosts onthe IPv6 Internet,
upgrade your edge firewall between your intranet and the IPv6Internet to support
stateful IPv6 firewalling.
-
8/2/2019 IPV6 Security Consideration
12/16
5
/5/12
Recommendations
v For IPv6-over-IPv4 tunneled traffic from Internet hosts tointranet hosts,
configure your IPv4-based edge firewall to drop all IPv4 protocol
41 packets on its
Internet interface. An exception is when you are using 6to4. The6to4 router must
be able to receive IPv6- over-IPv4 tunneled traffic from the
Internet.
v For Teredo traffic from intranet hosts to Internet hosts,configure your
IPv4-based edge firewall to silently discard all IPv4 traffic withthe source or
-
8/2/2019 IPV6 Security Consideration
13/16
5
/5/12
Recommendations
v Deploy ISATAP correctly on your intranet so that default route traffic isnever forwarded
to the IPv4 Internet. Default route traffic from ISATAP hosts on the IPv4
portion of your
network should be forwarded to an ISATAP router, which is connected toboth the IPv4
and IPv6-capable portions of your intranet. The default route on theISATAP router should point to the IPv6-capable portion of your intranet.
v If your ISATAP router and edge firewall is the same device, ensure thatthe devices
default route for IPv6 traffic points to the IPv6-capable portion of yournetwork,
not to the IPv4 Internet.
-
8/2/2019 IPV6 Security Consideration
14/16
5
/5/12
Recommendations
v If the ISATAP hosts on your intranet must communicate with
hosts on theIPv6 Internet, upgrade your edge firewall between your intranetand the IPv6
Internet to support stateful IPv6 firewalling.
-
8/2/2019 IPV6 Security Consideration
15/16
5
/5/12
-
8/2/2019 IPV6 Security Consideration
16/16
5
/5/12
Understanding IPv6 2nd Edition - Microsoft Press