- ipv6-wg - mailman.ripe.net

Commercial IPv6 firewall support
by michael.dillon＠bt.com 08 Nov '07

08 Nov '07

Some people have claimed that they cannot yet sell IPv6 Internet access because there is no IPv6 firewall support. According to this ICANN study: http://www.icann.org/committees/security/sac021.pdf this is not quite true. At least 30% of the 42 vendors surveyed, had IPv6 support. According to this talk <http://www.guug.de/veranstaltungen/ecai6-2007/slides/2007-ECA-I6-Status -IPv6-Firewalling-PeterBieringer-Talk.pdf> many open-source and commercial firewalls supporting IPv6 are available. IPCop is based on Linux <http://www.ipcop.org/index.php?module=pnWikka&tag=IPCopScreenshots> m0n0wall is based on FreeBSD <http://m0n0.ch/wall/screenshots.php> pfSense is also based on FreeBSD <http://pfsense.com/index.php?id=26> FWBuilder is a management tool that builds filter setups for several different firewalls. <http://www.fwbuilder.org/archives/cat_screenshots.html> Checkpoint FW1 NGX R65 on SecurePlatform supports IPv6 FortiGate supports IPv6 in FortiOS 3.0 and up. Juniper SSG (formerly Netscreen) supports IPv6 in ScreenOS 6.0 and up. Cisco ASA (formerly PIX) supports IPv6 in version 7.0 and up. I suspect that the people complaining about IPv6 support are partially complaining because they have older hardware that the vendor does not plan to upgrade to IPv6 support until they have all features implemented in their newer products, and partially complaining because their vendor has not implemented some feature which they happen to use. Commercial firewall support may be lagging behind OS and router support, but not by much. And if commercial vendors are not responsive, maybe you should try pricing out an open source solution with a consultant. I believe there is a gap here that startup firewall companies could fill if they understand the enterprise market. --Michael Dillon

5 5

OT? Ripe NCC posting on youtube
by ed 07 Nov '07

07 Nov '07

Sorry if this is off topic or old news, but I saw this on the SCLUG mailing list. Truly excellent: http://uk.youtube.com/user/RIPENCC -- The 14.4 dialup to the PS2 is doing the twist because of a power outage. AOL is playing way too much Diablo II. :: http://www.s5h.net/ :: http://www.s5h.net/gpg

1 0

Re: [address-policy-wg] Commercial IPv6 firewall support
by jwkckid1＠ix.netcom.com 28 Oct '07

28 Oct '07

Nick and all, Chiming in here as a kinda unusual occurance. I agree with Nicks assessment here unfortunately. Seems across a broad business spectrum a disinterest in IPv6 remains or presists. Given, what I believe to be an accurate essesment by Nick below, it would seem that a more concerted effort to make IPv6 more palatable in very short order is advisable. As to how to accomplish that, I do not know. -----Original Message----- >From: Nick Hilliard <nick(a)inex.ie> >Sent: Oct 27, 2007 9:25 AM >To: michael.dillon(a)bt.com >Cc: address-policy-wg(a)ripe.net, ipv6-wg(a)ripe.net >Subject: Re: [address-policy-wg] Commercial IPv6 firewall support > >> Some people have claimed that they cannot yet sell >> IPv6 Internet access because there is no IPv6 firewall >> support. According to this ICANN study: >> http://www.icann.org/committees/security/sac021.pdf >> this is not quite true. At least 30% of the 42 vendors >> surveyed, had IPv6 support. > >There is, of course, "support" and support when talking about any feature, >whether ipv6 related or not. > >As a useful example of what "support" implies, the "support" from one of my >firewall vendors includes basic support for ipv6 packet forwarding and >filtering, but no support for configuring this from the GUI. And no support >for failover / failback on ipv6. And no support for ospfv3. Or DHCPv6. Or >v6 support for VPNs. And so on - you get the idea. There are piles more >features which just aren't there if you use v6. In fact, I would suggest >that there is such a large functionality gap between their ipv4 and ipv6 >support right now, that even if they invested heavily between now and the >current expected dates for ipv4 exhaustion, I seriously doubt that they >would achieve feature parity, not to mind stability parity for these >features. > >I have talked to them about this, and their opinion is that there is no >commercial demand for ipv6, and therefore ipv6 feature parity is on the >feature roadmap. And indeed, it is difficult for the organisation I work >for to demand ipv6 support, when other companies can talk to their vendors >with a EUR100m firewall / networking contract going a-begging. I have >little doubt that this is the reason that MOP got re-enabled by default on a >certain router vendor's products. > > >Them: "We have EUR200m to spend and we want MOP enabled by default". >Vendor: "Three bags full, sir". > >Me: "I want to you spend $50m in development costs to support ipv6, and > then i'll buy some low end kit from you" >Vendor: <laughs hysterically> > >Open source solutions tend to fare better in this regard. Lots of people >may end up using them in a future ipv6 world, but you're not going to end up >seeing F500 companies stampeding to replace their current high-end solutions >with m0n0wall installations, just because they have more-or-less parity >support for ipv4 and ipv6. > >There's a more interesting discussion of this of this linked from: > >http://www.arin.net/meetings/minutes/ARIN_XX/ppm.html > >See the talk entitled "IPv6 Support Among Commercial Firewalls", by Dave >Piscitello. > >Nick > >-- >Network Ability Ltd. | Technical Operations | Tel: +353 1 6169698 >3 Westland Square | INEX - Internet Neutral | Fax: +353 1 6041981 >Dublin 2, Ireland | Exchange Association | Email: nick(a)inex.ie > 'Regards, Jeffrey A. Williams Spokesman for INEGroup LLA. - (Over 277k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com

1 0

Re: [ipv6-wg] RIPE Community Resolution on IPv4 Depletion and Deployment of IPv6
by Andy Davidson 26 Oct '07

26 Oct '07

On 25 Oct 2007, at 10:55, JORDI PALET MARTINEZ wrote: > 1) Network operators and Internet Service Providers (ISPs) are > called to the urgent deployment of IPv6 across their networks as > soon as possible. This deployment must include providing IPv6 > access to End Users and ensuring services are accessible by IPv6. I thought that yesterday's session was useful (I watched via the webcast), and that the publication of this resolution will send the right signals to decision makers - well done everyone. We have to remember that a lot of networks use only v4 PI, as this is the model typically deployed by end sites who rely on multihoming for performance or reliability reasons. Unless and until 2006-01 becomes approved, there is no migration path to v6 for these networks. We must ratify 2006-01 in order to strengthen the impact of the publication of this resolution. Best wishes, Andy Davidson -- :: http://www.localphone.com/ - Call Global, Pay Local :: /* opinions and thoughts expressed here are my own */

2 1

RIPE Community Resolution on IPv4 Depletion and Deployment of IPv6
by JORDI PALET MARTINEZ 25 Oct '07

25 Oct '07

I don't think my comment was well understood today in the session, so I drafted how I think the community resolution should look. See below. English nits should be reviewed, but the main idea is that we start with a short kind of intro of the situation (those points from the original 5 that are generic), staying focus, keeping it short, but at the same time help each "kind of reader" to identify what is the paragraph that is *more* relevant to him. I also added a specific action for policy makers/regulators and one for users. I hope that, as very few people (in the list and session) has provided input on this, we are allowed to participate in the final drafting of the document. Not being a big group is possible to do it, as otherwise, will not really be a community resolution. Regards, Jordi At current allocation rates, the remaining pool of unallocated IPv4 address space is likely to be allocated within the next two to four years. Although the Internet will continue to function as normal after this point, this event will have a significant influence on future network operations as well as IP address management and allocation policies. Therefore we recognise that the widespread deployment of IPv6 will be essential to sustain future growth of the Internet. We recognise that the responsibility for creating policies related to the management of critical Internet resources in the RIPE NCC service region rests with the RIPE community and the proven success of the RIPE Policy Development Process (PDP). In recognition of this responsibility, we commit to continue development of effective policies for the responsible management of IPv4 and IPv6 address space. We agree that this situation requires a committed effort from network operators, ISPs and the RIPE community. We urge that the widespread deployment of IPv6 be made a high priority. In addition to that, other sectors must take their own measures in order to success on this mission: 1) Network operators and Internet Service Providers (ISPs) are called to the urgent deployment of IPv6 across their networks as soon as possible. This deployment must include providing IPv6 access to End Users and ensuring services are accessible by IPv6. 2) Vendors (hardware and software) are called to the urgent support of IPv6 support in their products, to make it possible for network operators and Internet Service Providers to provide these services. 3) Regulators and policy makers are called to make sure the relevance of the IPv6 support is considered in all their decisions, including as an immediate condition for public procurements. 4) Users must ensure, when acquiring new services, hardware or software, that it supports IPv6 (natively or by means of transition mechanisms). ********************************************** The IPv6 Portal: http://www.ipv6tf.org Bye 6Bone. Hi, IPv6 ! http://www.ipv6day.org This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

3 3

DRAFT: RIPE Community Resolution on IPv4 Depletion and Deployment of IPv6
by Gert Doering 24 Oct '07

24 Oct '07

Hello Address Policy Working Group, IPv6 Working Group, as announced yesterday on the APWG list, here's the first draft of the "we are going to tell the world what the RIPE community recommends regarding the end of IPv4 / advent of IPv6". The text has been drafted by the RIPE NCC, but the actual recommendation needs to come from "the community", so change whatever you think needs changing. Face-to-face discussion will take place in the APWG and IPv6 WG meeting on Thursday, October 25th. (Short discussion in APWG early morning, time to think about it during the day, final decision in the IPv6 WG meeting on Thursday afternoon). ----------------------- snip ----------------------- DRAFT - RIPE Community Resolution on IPv4 Depletion and Deployment of IPv6 RIPE 55: 22 - 26 October 2007 The RIPE community resolves as follows: 1) At current allocation rates, the remaining pool of unallocated IPv4 address space is likely to be allocated within the next two to four years. Although the Internet will continue to function as normal after this point this event will have a significant influence on future network operations as well as IP address management and allocation policies. Therefore we recognise that the widespread deployment of IPv6 will be essential to sustain future growth of the Internet. 2) We urge network operators and Internet Service Providers (ISPs) to deploy IPv6 across their networks as soon as possible. This deployment must include providing IPv6 access to End Users and ensuring services are accessible by IPv6. 3) We recognise that the responsibility for creating policies related to the management of critical Internet resources in the RIPE NCC service region rests with the RIPE community and the proven success of the RIPE Policy Development Process (PDP). In recognition of this responsibility, we commit to continue development of effective policies for the responsible management of IPv4 and IPv6 address space. 4) We agree that this situation requires a committed effort from network operators, ISPs and the RIPE community. We urge that the widespread deployment of IPv6 be made a high priority. ----- End forwarded message ----- Gert Doering -- APWG chair -- Total number of prefixes smaller than registry allocations: 122119 SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (89) 32356-444 USt-IdNr.: DE813185279

14 37

Agenda for ipv6 wg RIPE55
by David Kessens 18 Oct '07

18 Oct '07

During next RIPE meeting, our working group is scheduled to meet: Thu, Oct 25, 16:00 - 17:30 in Grand Ballroom, Hotel Krasnapolsky, Amsterdam The agenda became quite packed due to the last minute agenda item of a proposed community statement regarding the depletion of ipv4 and the deployment of ipv6. Note that this proposal will be discussed first in the APWG session in the early thursday morning session. I have included a link to the actual proposal in the agenda and you might want to take a look at it and the discussion that followed on the list after the first posting of the draft. Rather than cutting the discussion short, we might let the meeting run past the normal closing time of 17:30 but to no later than 18:00 (I usually ask for the afternoon slot so that we have a bit more flexibility with our time). See you all in Amsterdam, David Kessens --- Agenda for the IPv6 Working Group Meeting RIPE55 When: Thu, Oct 25, 16:00 - 17:30 Where: Grand Ballroom, Hotel Krasnapolsky, Amsterdam A. Administrative stuff - appointment of scribe - agenda bashing (David Kessens) B. Experience with ipv6 in the RIPE NCC network (Mark Guz, RIPE NCC) C. Two jokes, one and half proposal (IPv4->IPv6 transition in DSL environment) (Geza Turchanyi) D. Report(s) about *actual* v6 traffic volume as compared to v4? *what's real* out there, not what's on powerpoint? AMS-IX (Henk Steenman) & (input from the audience) E. Follow-up: Global IPv6 routing table status (discussion) (Gert Doering) F. RIPE Community Resolution on IPv4 Depletion and Deployment of IPv6 http://www.ripe.net/ripe/maillists/archives/ipv6-wg/2007/msg00047.html and follow-up mails on ipv6 and apwg mailing list (Gert Doering, David Kessens) G. Developments/initiatives regarding IPv6 in the RIPE region and beyond (input from the audience) ... Y. Input for the RIPE NCC Activity Plan (input from the audience) Z. AOB ---

1 0

Call for Agenda Items & Draft Agenda (v1) for the IPv6 Working Group Meeting RIPE55
by David Kessens 14 Sep '07

14 Sep '07

During next RIPE meeting, our working group is scheduled to meet: Thu, Oct 25, 16:00 - 17:30 in Grand Ballroom, Hotel Krasnapolsky, Amsterdam To start with, I have prepared a draft agenda with all our standard items. However, to make this a successful meeting we will actually have to get more items on the agenda than just the standard topics. Please let me know if you have any suggestions for issues that need to be discussed. Note that we don't have a requirement for powerpoint or duration of your presentation: the important thing is that the issue to be discussed is relevant for the deployment of ipv6 in the RIPE service region. Thanks! David Kessens --- Draft Agenda (v1) for the IPv6 Working Group Meeting RIPE55 When: Thu, Oct 25, 16:00 - 17:30 Where: Grand Ballroom, Hotel Krasnapolsky, Amsterdam A. Administrative stuff - appointment of scribe - agenda bashing - approval of the minutes (David Kessens) B. Quick update from the RIPE NCC regarding ipv6 services (RIPE NCC) C. Follow-up: Global IPv6 routing table status (discussion) (Gert Doering) D. Report(s) about *actual* v6 traffic volume as compared to v4? *what's real* out there, not what's on powerpoint? (input from the audience) E. Developments/initiatives regarding IPv6 in the RIPE region and beyond (input from the audience) ... Y. Input for the RIPE NCC Activity Plan (input from the audience) Z. AOB ---

1 0

Re: [ipv6-wg] IPv6 news - weekly summary
by David Kessens 28 Aug '07

28 Aug '07

Jordi, I have received the following comments on my request to provide input whether people believe that your "IPv6 news - weekly summary" is something that the working group participants would like to receive on the mailing list: Prefer not to receive your summary: Daniel Roesen Geoff Huston Marc Blanchet Roger Jorgensen Bernhard Schmidt Dominik Bay Gert Doering Edward Lewis (after deadline) Would like to receive your summary: Aleksi Suhonen Neutral: Mohsen Souissi Other comments: Philip Smith would consider your message acceptable if the MessageID was the same for all lists that you post the summary to I believe the results are quite clear and I would like to ask you to stop posting your weekly messages to the mailing list. As a courtesy to you and the people who did have an interest in your mails, feel free to post one more message where people can find the weekly summary on their own and/or contains the information so that people can subscribe on their own to a mailing list that you manage to receive your summary. Thanks, David Kessens Chair IPv6 working group --- ----- Forwarded message from David Kessens <david.kessens(a)nsn.com> ----- From: David Kessens <david.kessens(a)nsn.com> To: Bernhard Schmidt <berni(a)birkenwald.de> Cc: ipv6-wg(a)ripe.net Subject: Re: [ipv6-wg] IPv6 news - weekly summary Date: Tue, 21 Aug 2007 11:34:53 -0700 Hi, Based on Bernhard's input, I would like to poll the working group whether they like to receive these weekly summaries from Jordi on the working group list. I for one was close to asking Jordi to immediately cease posting as they are readily available from other mailing list or at his website (I personally receive now 4 unwanted copies of his mail). However, I can see that other people might have a different opinion. Please send your comments directly to me by Sunday 8/26, without CC'ing the list as their is no need to make this a lengthy discussion. I will post a summary to the list (but I will as a matter of principle mention your name in the summary). Thanks, David Kessens IPv6 working group chair --- On Mon, Aug 20, 2007 at 10:24:23PM +0200, Bernhard Schmidt wrote: > Hi Jordi, > > will it become standard to post this weekly summary of IPv6 news, where > some of your featured stories mention IPv6 just in one small sentence? > Example > > >IT security: Too big for government > >http://www.ipv6tf.org/index.php?page=news/newsroom&id=3154 > ><http://www.ipv6tf.org/index.php?page=news/newsroom&id=3154> > > | However, there are bright spots. Companies are beginning to reduce the > | scope of vulnerabilities in their software and IPv6 is slowly moving > | forward, especially in Asia. > > This is the only occurence of IPv6 in this text. > > Occasional posting of really interesting news to this ml is fine in my > point of views, but gating every unrelated story that happens to have > "IPv6" somewhere in the text through your "portal" page isn't. > > Just my 2 cents, > Bernhard ----- End forwarded message -----

2 1

IPv6 news - weekly summary
by JORDI PALET MARTINEZ 26 Aug '07

26 Aug '07

Main News: Other News: Govt expects users to migrate to IPv6 in 3 years http://www.ipv6tf.org/index.php?page=news/newsroom&id=3171 The Tech Lab: Vint Cerf http://www.ipv6tf.org/index.php?page=news/newsroom&id=3170 Is the Internet Over? http://www.ipv6tf.org/index.php?page=news/newsroom&id=3168 IPv6 readiness is key as IPv4 peters out http://www.ipv6tf.org/index.php?page=news/newsroom&id=3167 Posts Face IPv6 Challenges http://www.ipv6tf.org/index.php?page=news/newsroom&id=3166 Don¹t miss the forest for the trees http://www.ipv6tf.org/index.php?page=news/newsroom&id=3165 Security: Corporate and Products: Centennial Discovery 2007 Eases Management of IT Hardware and Software Assets http://www.ipv6tf.org/index.php?page=news/newsroom&id=3169 ********************************************** The IPv6 Portal: http://www.ipv6tf.org Bye 6Bone. Hi, IPv6 ! http://www.ipv6day.org This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

1 0