BCP38 considerations in IPv6

Mailman List Mirror (Read Only)
1

Hello NANOGers -

What considerations should be made with respect to implementing egress
filtering based on source IPv6 addresses? Things like allowing traffic
sourced from fe80::/10 in said filters for on-link communication (for the
interface that the filter is applied to). Is there anything else that
should be taken into account while implementing BCP38 egress filtering in
IPv6?

Ryan

2

:

Hello NANOGers -

What considerations should be made with respect to implementing egress
filtering based on source IPv6 addresses? Things like allowing traffic
sourced from fe80::/10 in said filters for on-link communication (for the
interface that the filter is applied to). Is there anything else that
should be taken into account while implementing BCP38 egress filtering in
IPv6?

Ryan

You should definitely make sure you block ULA prefixes leaving your
site by default.

e.g.
  add unreach admin all from any to fc00::/7 via gif0
  add unreach admin all from fc00::/7 to any via gif0

3

There's a lot of language in the RFCs about this type of addresses not being forwarded by routers, so filtering shouldn't be necessary. I know that Cisco lets neighbor discovery through before the implicit deny is applied, so specifically allowing link locals for neighbor discovery isn't necessary either. (I would assume other vendors do the same, but it's of course a good idea to check.)

The only time you have to be careful is when you do a deny all, because you need neighbor discovery unless you use static neighbor cache entries. ND also uses multicast, so you need to let that through as appropriate, too.

4

That's a consideration, and one other candidate which has already been welcomed to my black-hole server: 2001:DB8::/32.

I'll leave that as an exercise to everyone to see who's block that is. :slight_smile:

wfms

5

Have look at some icmpv6 consideration in RFC 4890.

Regards,
     Janos