Security Implications of IPv6 on IPv4 Networks
RFC 7123

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00
• 01
• 02
• 03
• 04
• 05
• 06
• 07

Internet Engineering Task Force (IETF)                           F. Gont
Request for Comments: 7123                          SI6 Networks/UTN-FRH
Category: Informational                                           W. Liu
ISSN: 2070-1721                                      Huawei Technologies
                                                           February 2014

             Security Implications of IPv6 on IPv4 Networks

Abstract

   This document discusses the security implications of native IPv6
   support and IPv6 transition/coexistence technologies on "IPv4-only"
   networks and describes possible mitigations for the aforementioned
   issues.

Status of This Memo

   This document is not an Internet Standards Track specification; it is
   published for informational purposes.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Not all documents
   approved by the IESG are a candidate for any level of Internet
   Standard; see Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc7123.

Copyright Notice

   Copyright (c) 2014 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Gont & Liu                    Informational                     [Page 1]
RFC 7123           Sec. Impl. of IPv6 on IPv4 Networks     February 2014

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Security Implications of Native IPv6 Support  . . . . . . . .   4
     2.1.  Filtering Native IPv6 Traffic . . . . . . . . . . . . . .   4
   3.  Security Implications of Tunneling Mechanisms . . . . . . . .   5
     3.1.  Filtering 6in4  . . . . . . . . . . . . . . . . . . . . .   6
     3.2.  Filtering 6over4  . . . . . . . . . . . . . . . . . . . .   7
     3.3.  Filtering 6rd . . . . . . . . . . . . . . . . . . . . . .   7
     3.4.  Filtering 6to4  . . . . . . . . . . . . . . . . . . . . .   8
     3.5.  Filtering ISATAP  . . . . . . . . . . . . . . . . . . . .   9
     3.6.  Filtering Teredo  . . . . . . . . . . . . . . . . . . . .   9
     3.7.  Filtering Tunnel Broker with Tunnel Setup Protocol (TSP)   11
     3.8.  Filtering AYIYA . . . . . . . . . . . . . . . . . . . . .  11
   4.  Additional Considerations when Filtering IPv6 Traffic . . . .  12
   5.  Security Considerations . . . . . . . . . . . . . . . . . . .  13
   6.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . .  13
   7.  References  . . . . . . . . . . . . . . . . . . . . . . . . .  13
     7.1.  Normative References  . . . . . . . . . . . . . . . . . .  13
     7.2.  Informative References  . . . . . . . . . . . . . . . . .  14
   Appendix A.  Summary of Filtering Rules . . . . . . . . . . . . .  18

1.  Introduction

   Most general-purpose operating systems implement and enable native
   IPv6 [RFC2460] support and a number of transition/coexistence
   technologies by default.  Support of IPv6 by all nodes is intended to
   become best current practice [RFC6540].  Some enterprise networks
   might, however, choose to delay active use of IPv6.

   This document describes operational practices to prevent security
   exposure in enterprise networks resulting from unplanned use of IPv6
   on such networks.  This document is only applicable to enterprise
   networks: networks where the network operator is not providing a
   general-purpose internet, but rather a business-specific network.
   The solutions proposed here are not practical for home networks, nor
   are they appropriate for provider networks such as ISPs, mobile
   providers, WiFi hotspot providers, or any other public internet
   service.

   In scenarios in which IPv6-enabled devices are deployed on enterprise
   networks that are intended to be IPv4-only, native IPv6 support and/
   or IPv6 transition/coexistence technologies could be leveraged by
   local or remote attackers for a number of (illegitimate) purposes.
   For example,

Gont & Liu                    Informational                     [Page 2]
RFC 7123           Sec. Impl. of IPv6 on IPv4 Networks     February 2014

   o  A Network Intrusion Detection System (NIDS) might be prepared to