Best Current Practice for Filtering ICMPv6 Messages in Firewalls
draft-davies-v6ops-icmpv6-filtering-bcp-00
| Document | Type |
Expired Internet-Draft
(individual)
Expired & archived
|
|
|---|---|---|---|
| Authors | Elwyn B. Davies , János Mohácsi | ||
| Last updated | 2005-07-12 | ||
| RFC stream | (None) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | Expired | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
This Internet-Draft is no longer active. A copy of the expired Internet-Draft is available in these formats:
Abstract
In networks supporting IPv6 the Internet Control Message Protocol version 6 (ICMPv6) plays a fundamental role with a large number of functions, and a correspondingly large number of message types and options. A number of security risks are associated with uncontrolled forwarding of ICMPv6 messages, and it is desirable to configure site firewalls to intercept inappropriate usages of ICMPv6 which might allow an attacker outside a site to probe or compromise the site network. On the other hand, compared with IPv4 and the corresponding protocol ICMP, ICMPv6 is essential to the functioning of IPv6 rather than a useful auxiliary. Hence too aggressive filtering of ICMPv6 messages can be detrimental to the establishment of IPv6 communications. This means that effective filtering of ICMPv6 requires a more complex configuration than was needed for ICMP. This document provides some recommendations for ICMPv6 firewall filter configuration that will allow propagation of ICMPv6 messages that are needed to maintain the functioning of the network but drop messages which are potential security risks.
Authors
(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)