draft-ietf-v6ops-ra-guard-00.txt1 IPv6 RA-Guard draft-ietf-v6ops-ra-guard-00.txt G. Van de Velde, E. Levy- Abegnoli, C. Popoviciu, J. Mohácsi 72nd IETF - Dublin, Ireland 27 July - 1 August 2008

draft-ietf-v6ops-ra-guard-00.txt2 Draft objective Complement SeND where it is not (1) convenient or (2) possible to use SeND to defend against Rogue RA RA-guard is “no replacement” for SeND but a tool to work together with SeND

draft-ietf-v6ops-ra-guard-00.txt3 RA-Guard Usage Considerations RA-traffic must go “through” a RA-Guard networking device - limited applicability in certain wireless networks Tunneled traffic is not protected RA-Guard could protect content of an RAmessage

draft-ietf-v6ops-ra-guard-00.txt4 New WG draft Updated and (hopefully) clarified from individual draft from last time Clarification of RA-guard operation modes: Deny (based on criteria), allow (based on criteria), allow from SEND authorised sources Make more clear what “pre-defined criteria” mean For the SEND authorised mode introduction of terminology of “router authorization proxy” - or should we call “SEND validating device” - which is the right terminology? Should we call ra-guard device in general cases?

draft-ietf-v6ops-ra-guard-00.txt5 Comments and Next steps Comments so far from WG: Simplify state machine (from Christian Vogt): device/interface - device level probably not necessary - the authors are working on an update state machine Define clearly pre-defined criteria (from Christian Vogt) Describe “router authorisation proxy” operation (from Arnaud Ebalard) Describe behaviour in case of multiple devices sending accepted RA messages (from Arnaud Ebalard) Next Address further comments from WG Fixing typos (Thanks to Arnaud Ebalard)

draft-ietf-v6ops-ra-guard-00.txt6 THANK YOU!

draft-ietf-v6ops-ra-guard-00.txt7 Backup slides From IETF71

draft-ietf-v6ops-ra-guard-00.txt8 SEND deployment model router Certificate Authority CA 0 host C 0 trusted anchor certificate with pfx_list=P 0 C R certificate with pfx_list=P R CRL (revocation list) CPA (C R ) RA ( pfx_list=P R ) Subordinate Certificate Authority CA 1

draft-ietf-v6ops-ra-guard-00.txt9 Proposed Deployment model router CA 0 host C 0 certificate with pfx_list=P 0 C R certificate with pfx_list=P R CRL CPA (C R ) RA ( pfx_list=P R ) CA 1

draft-ietf-v6ops-ra-guard-00.txt10 RA-Guard complementing SeND RA-guard "SeND-validating" RA on behalf of hosts would potentially simplify some of the current deployment challenges: It may take time until SeND is ubiquitous (i.e. issues concerning provisioning hosts with trust anchors or SP access-networks with non-managed CPE) It is also reasonable to expect that some devices might not consider implementing SeND (i.e. IPv6 enabled sensors) RA-guard intends to provide simple solutions to the rogue-RA problem: Through a simple solution by filtering/snooping potential Rogue- RA In others, leverage SeND between capable devices (L2 and routers) to provide protection to devices that do not consistently use SeND