Security “Automatic Border Detection” is essential – For service discovery scope – For prefix assignment and routing – For security Default filters (ULAs?) Firewall (enabling simple, advanced, or none)

Host firewalls don’t provide simple controls for “limit this traffic depending on where its from.” ex: local vs. Internet Windows provides concept of network location, but that’s about the host.

Allow incoming connections from your home Allow incoming connections from the Internet Allow incoming connections from your home Allow incoming connections from the Internet

Problem Home network topologies are varied and ambiguous. Clear definition of local security boundary could enable higher-order security promises to users. Is there a “local” security boundary? What defines the “local” security boundary? – ULAs – Link-local – Prefix pushed down by RA – Magic?

Advanced Security User Feedback (attack stats) IPS Dynamic Policy & Signatures Update On-line Access to IP Address Reputation

Why is this important to IPv6? Security policy can be adjusted to match the threat as attacks arrive We don’t break end-to-end IPv6, unless we absolutely have to While providing arguably better security, troubleshooting, etc. than we would otherwise