draft-vandevelde-v6ops-ra-guard-01.txt1 IPv6 RA-Guard G. Van de Velde, E. Levy- Abegnoli, C. Popoviciu, J. Mohacsi IETF 71, March 11/14th 2008 Philadelphia

draft-vandevelde-v6ops-ra-guard-01.txt2 Draft objective Complement SeND where it is not (1) convenient or (2) possible to use SeND to defend against Rogue RA RA-guard is “no replacement” for SeND but a tool to work together with SeND

draft-vandevelde-v6ops-ra-guard-01.txt3 SEND deployment model router Certificate Authority CA 0 host C 0 trusted anchor certificate with pfx_list=P 0 C R certificate with pfx_list=P R CRL (revocation list) CPA (C R ) RA ( pfx_list=P R ) Subordinate Certificate Authority CA 1

draft-vandevelde-v6ops-ra-guard-01.txt4 Proposed Deployment model router CA 0 host C 0 certificate with pfx_list=P 0 C R certificate with pfx_list=P R CRL CPA (C R ) RA ( pfx_list=P R ) CA 1

draft-vandevelde-v6ops-ra-guard-01.txt5 RA-Guard complementing SeND RA-guard "SeND-validating" RA on behalf of hosts would potentially simplify some of the current deployment challenges: It may take time until SeND is ubiquitous (i.e. issues concerning provisioning hosts with trust anchors or SP access-networks with non-managed CPE) It is also reasonable to expect that some devices might not consider implementing SeND (i.e. IPv6 enabled sensors) RA-guard intends to provide simple solutions to the rogue-RA problem: Through a simple solution by filtering/snooping potential Rogue- RA In others, leverage SeND between capable devices (L2 and routers) to provide protection to devices that do not consistently use SeND

draft-vandevelde-v6ops-ra-guard-01.txt6 RA-Guard Use Considerations RA-traffic must go “through” a RA-Guard L2 controlled networking device Tunneled traffic is not protected RA-Guard could protect content of an RA

draft-vandevelde-v6ops-ra-guard-01.txt7 Next steps Adopt as WG item?

draft-vandevelde-v6ops-ra-guard-01.txt8 THANK YOU!