October 2007 - ipv6-wg - mailman.ripe.net

Commercial IPv6 firewall support
by michael.dillon＠bt.com 08 Nov '07

08 Nov '07

Some people have claimed that they cannot yet sell IPv6 Internet access because there is no IPv6 firewall support. According to this ICANN study: http://www.icann.org/committees/security/sac021.pdf this is not quite true. At least 30% of the 42 vendors surveyed, had IPv6 support. According to this talk <http://www.guug.de/veranstaltungen/ecai6-2007/slides/2007-ECA-I6-Status -IPv6-Firewalling-PeterBieringer-Talk.pdf> many open-source and commercial firewalls supporting IPv6 are available. IPCop is based on Linux <http://www.ipcop.org/index.php?module=pnWikka&tag=IPCopScreenshots> m0n0wall is based on FreeBSD <http://m0n0.ch/wall/screenshots.php> pfSense is also based on FreeBSD <http://pfsense.com/index.php?id=26> FWBuilder is a management tool that builds filter setups for several different firewalls. <http://www.fwbuilder.org/archives/cat_screenshots.html> Checkpoint FW1 NGX R65 on SecurePlatform supports IPv6 FortiGate supports IPv6 in FortiOS 3.0 and up. Juniper SSG (formerly Netscreen) supports IPv6 in ScreenOS 6.0 and up. Cisco ASA (formerly PIX) supports IPv6 in version 7.0 and up. I suspect that the people complaining about IPv6 support are partially complaining because they have older hardware that the vendor does not plan to upgrade to IPv6 support until they have all features implemented in their newer products, and partially complaining because their vendor has not implemented some feature which they happen to use. Commercial firewall support may be lagging behind OS and router support, but not by much. And if commercial vendors are not responsive, maybe you should try pricing out an open source solution with a consultant. I believe there is a gap here that startup firewall companies could fill if they understand the enterprise market. --Michael Dillon

5 5

Re: [address-policy-wg] Commercial IPv6 firewall support
by jwkckid1＠ix.netcom.com 29 Oct '07

29 Oct '07

Nick and all, Chiming in here as a kinda unusual occurance. I agree with Nicks assessment here unfortunately. Seems across a broad business spectrum a disinterest in IPv6 remains or presists. Given, what I believe to be an accurate essesment by Nick below, it would seem that a more concerted effort to make IPv6 more palatable in very short order is advisable. As to how to accomplish that, I do not know. -----Original Message----- >From: Nick Hilliard <nick(a)inex.ie> >Sent: Oct 27, 2007 9:25 AM >To: michael.dillon(a)bt.com >Cc: address-policy-wg(a)ripe.net, ipv6-wg(a)ripe.net >Subject: Re: [address-policy-wg] Commercial IPv6 firewall support > >> Some people have claimed that they cannot yet sell >> IPv6 Internet access because there is no IPv6 firewall >> support. According to this ICANN study: >> http://www.icann.org/committees/security/sac021.pdf >> this is not quite true. At least 30% of the 42 vendors >> surveyed, had IPv6 support. > >There is, of course, "support" and support when talking about any feature, >whether ipv6 related or not. > >As a useful example of what "support" implies, the "support" from one of my >firewall vendors includes basic support for ipv6 packet forwarding and >filtering, but no support for configuring this from the GUI. And no support >for failover / failback on ipv6. And no support for ospfv3. Or DHCPv6. Or >v6 support for VPNs. And so on - you get the idea. There are piles more >features which just aren't there if you use v6. In fact, I would suggest >that there is such a large functionality gap between their ipv4 and ipv6 >support right now, that even if they invested heavily between now and the >current expected dates for ipv4 exhaustion, I seriously doubt that they >would achieve feature parity, not to mind stability parity for these >features. > >I have talked to them about this, and their opinion is that there is no >commercial demand for ipv6, and therefore ipv6 feature parity is on the >feature roadmap. And indeed, it is difficult for the organisation I work >for to demand ipv6 support, when other companies can talk to their vendors >with a EUR100m firewall / networking contract going a-begging. I have >little doubt that this is the reason that MOP got re-enabled by default on a >certain router vendor's products. > > >Them: "We have EUR200m to spend and we want MOP enabled by default". >Vendor: "Three bags full, sir". > >Me: "I want to you spend $50m in development costs to support ipv6, and > then i'll buy some low end kit from you" >Vendor: <laughs hysterically> > >Open source solutions tend to fare better in this regard. Lots of people >may end up using them in a future ipv6 world, but you're not going to end up >seeing F500 companies stampeding to replace their current high-end solutions >with m0n0wall installations, just because they have more-or-less parity >support for ipv4 and ipv6. > >There's a more interesting discussion of this of this linked from: > >http://www.arin.net/meetings/minutes/ARIN_XX/ppm.html > >See the talk entitled "IPv6 Support Among Commercial Firewalls", by Dave >Piscitello. > >Nick > >-- >Network Ability Ltd. | Technical Operations | Tel: +353 1 6169698 >3 Westland Square | INEX - Internet Neutral | Fax: +353 1 6041981 >Dublin 2, Ireland | Exchange Association | Email: nick(a)inex.ie > 'Regards, Jeffrey A. Williams Spokesman for INEGroup LLA. - (Over 277k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com

1 0

Re: [ipv6-wg] RIPE Community Resolution on IPv4 Depletion and Deployment of IPv6
by Andy Davidson 27 Oct '07

27 Oct '07

On 25 Oct 2007, at 10:55, JORDI PALET MARTINEZ wrote: > 1) Network operators and Internet Service Providers (ISPs) are > called to the urgent deployment of IPv6 across their networks as > soon as possible. This deployment must include providing IPv6 > access to End Users and ensuring services are accessible by IPv6. I thought that yesterday's session was useful (I watched via the webcast), and that the publication of this resolution will send the right signals to decision makers - well done everyone. We have to remember that a lot of networks use only v4 PI, as this is the model typically deployed by end sites who rely on multihoming for performance or reliability reasons. Unless and until 2006-01 becomes approved, there is no migration path to v6 for these networks. We must ratify 2006-01 in order to strengthen the impact of the publication of this resolution. Best wishes, Andy Davidson -- :: http://www.localphone.com/ - Call Global, Pay Local :: /* opinions and thoughts expressed here are my own */

2 1

RIPE Community Resolution on IPv4 Depletion and Deployment of IPv6
by JORDI PALET MARTINEZ 25 Oct '07

25 Oct '07

I don't think my comment was well understood today in the session, so I drafted how I think the community resolution should look. See below. English nits should be reviewed, but the main idea is that we start with a short kind of intro of the situation (those points from the original 5 that are generic), staying focus, keeping it short, but at the same time help each "kind of reader" to identify what is the paragraph that is *more* relevant to him. I also added a specific action for policy makers/regulators and one for users. I hope that, as very few people (in the list and session) has provided input on this, we are allowed to participate in the final drafting of the document. Not being a big group is possible to do it, as otherwise, will not really be a community resolution. Regards, Jordi At current allocation rates, the remaining pool of unallocated IPv4 address space is likely to be allocated within the next two to four years. Although the Internet will continue to function as normal after this point, this event will have a significant influence on future network operations as well as IP address management and allocation policies. Therefore we recognise that the widespread deployment of IPv6 will be essential to sustain future growth of the Internet. We recognise that the responsibility for creating policies related to the management of critical Internet resources in the RIPE NCC service region rests with the RIPE community and the proven success of the RIPE Policy Development Process (PDP). In recognition of this responsibility, we commit to continue development of effective policies for the responsible management of IPv4 and IPv6 address space. We agree that this situation requires a committed effort from network operators, ISPs and the RIPE community. We urge that the widespread deployment of IPv6 be made a high priority. In addition to that, other sectors must take their own measures in order to success on this mission: 1) Network operators and Internet Service Providers (ISPs) are called to the urgent deployment of IPv6 across their networks as soon as possible. This deployment must include providing IPv6 access to End Users and ensuring services are accessible by IPv6. 2) Vendors (hardware and software) are called to the urgent support of IPv6 support in their products, to make it possible for network operators and Internet Service Providers to provide these services. 3) Regulators and policy makers are called to make sure the relevance of the IPv6 support is considered in all their decisions, including as an immediate condition for public procurements. 4) Users must ensure, when acquiring new services, hardware or software, that it supports IPv6 (natively or by means of transition mechanisms). ********************************************** The IPv6 Portal: http://www.ipv6tf.org Bye 6Bone. Hi, IPv6 ! http://www.ipv6day.org This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

3 3

DRAFT: RIPE Community Resolution on IPv4 Depletion and Deployment of IPv6
by Gert Doering 24 Oct '07

24 Oct '07

Hello Address Policy Working Group, IPv6 Working Group, as announced yesterday on the APWG list, here's the first draft of the "we are going to tell the world what the RIPE community recommends regarding the end of IPv4 / advent of IPv6". The text has been drafted by the RIPE NCC, but the actual recommendation needs to come from "the community", so change whatever you think needs changing. Face-to-face discussion will take place in the APWG and IPv6 WG meeting on Thursday, October 25th. (Short discussion in APWG early morning, time to think about it during the day, final decision in the IPv6 WG meeting on Thursday afternoon). ----------------------- snip ----------------------- DRAFT - RIPE Community Resolution on IPv4 Depletion and Deployment of IPv6 RIPE 55: 22 - 26 October 2007 The RIPE community resolves as follows: 1) At current allocation rates, the remaining pool of unallocated IPv4 address space is likely to be allocated within the next two to four years. Although the Internet will continue to function as normal after this point this event will have a significant influence on future network operations as well as IP address management and allocation policies. Therefore we recognise that the widespread deployment of IPv6 will be essential to sustain future growth of the Internet. 2) We urge network operators and Internet Service Providers (ISPs) to deploy IPv6 across their networks as soon as possible. This deployment must include providing IPv6 access to End Users and ensuring services are accessible by IPv6. 3) We recognise that the responsibility for creating policies related to the management of critical Internet resources in the RIPE NCC service region rests with the RIPE community and the proven success of the RIPE Policy Development Process (PDP). In recognition of this responsibility, we commit to continue development of effective policies for the responsible management of IPv4 and IPv6 address space. 4) We agree that this situation requires a committed effort from network operators, ISPs and the RIPE community. We urge that the widespread deployment of IPv6 be made a high priority. ----- End forwarded message ----- Gert Doering -- APWG chair -- Total number of prefixes smaller than registry allocations: 122119 SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (89) 32356-444 USt-IdNr.: DE813185279

14 37

Agenda for ipv6 wg RIPE55
by David Kessens 19 Oct '07

19 Oct '07

During next RIPE meeting, our working group is scheduled to meet: Thu, Oct 25, 16:00 - 17:30 in Grand Ballroom, Hotel Krasnapolsky, Amsterdam The agenda became quite packed due to the last minute agenda item of a proposed community statement regarding the depletion of ipv4 and the deployment of ipv6. Note that this proposal will be discussed first in the APWG session in the early thursday morning session. I have included a link to the actual proposal in the agenda and you might want to take a look at it and the discussion that followed on the list after the first posting of the draft. Rather than cutting the discussion short, we might let the meeting run past the normal closing time of 17:30 but to no later than 18:00 (I usually ask for the afternoon slot so that we have a bit more flexibility with our time). See you all in Amsterdam, David Kessens --- Agenda for the IPv6 Working Group Meeting RIPE55 When: Thu, Oct 25, 16:00 - 17:30 Where: Grand Ballroom, Hotel Krasnapolsky, Amsterdam A. Administrative stuff - appointment of scribe - agenda bashing (David Kessens) B. Experience with ipv6 in the RIPE NCC network (Mark Guz, RIPE NCC) C. Two jokes, one and half proposal (IPv4->IPv6 transition in DSL environment) (Geza Turchanyi) D. Report(s) about *actual* v6 traffic volume as compared to v4? *what's real* out there, not what's on powerpoint? AMS-IX (Henk Steenman) & (input from the audience) E. Follow-up: Global IPv6 routing table status (discussion) (Gert Doering) F. RIPE Community Resolution on IPv4 Depletion and Deployment of IPv6 http://www.ripe.net/ripe/maillists/archives/ipv6-wg/2007/msg00047.html and follow-up mails on ipv6 and apwg mailing list (Gert Doering, David Kessens) G. Developments/initiatives regarding IPv6 in the RIPE region and beyond (input from the audience) ... Y. Input for the RIPE NCC Activity Plan (input from the audience) Z. AOB ---

1 0