Re: Requirements for IPv6 Firewalls

2014-04-19 Thread Eugeniu Patrascu
On Sun, Apr 20, 2014 at 4:27 AM, Dobbins, Roland wrote: > > On Apr 20, 2014, at 2:32 AM, George William Herbert < > george.herb...@gmail.com> wrote: > > > I have 20-30,000 counterexamples in mind that I worked with directly in > the last decade. > > People do stupid things all the time - but gene

Re: Requirements for IPv6 Firewalls

2014-04-19 Thread Dobbins, Roland
On Apr 20, 2014, at 2:32 AM, George William Herbert wrote: > I have 20-30,000 counterexamples in mind that I worked with directly in the > last decade. People do stupid things all the time - but generally, it's hard to do them at scale. ;> --

AT&T Wireless

2014-04-19 Thread Neil Davidson
Can someone from AT&T Wireless contact me off-list? ... thanks ... n

Re: Requirements for IPv6 Firewalls

2014-04-19 Thread Doug Barton
On 04/18/2014 07:58 PM, Enno Rey wrote: Hi, On Fri, Apr 18, 2014 at 11:59:04AM -0700, Doug Barton wrote: On 04/18/2014 12:57 AM, Enno Rey wrote: I fully second Sander's input. I've been involved in IPv6 planning in a number of very large enterprises now and_none_ of them required/asked for (

Re: Requirements for IPv6 Firewalls

2014-04-19 Thread George William Herbert
On Apr 19, 2014, at 11:44 AM, Jimmy Hess wrote: > There is not widespread use of stateful firewall units with the > stateful element as a single point of failure in front of large public > web farms. I have 20-30,000 counterexamples in mind that I worked with directly in the last decade. An

Re: Requirements for IPv6 Firewalls

2014-04-19 Thread Jimmy Hess
On Sat, Apr 19, 2014 at 1:08 PM, George William Herbert wrote: > On Apr 18, 2014, at 9:10 PM, "Dobbins, Roland" wrote: > I don't know where you find ideas like this. > > There are stateful firewalls in the security packages in front of all the > internet facing servers in all the major service p

Re: Requirements for IPv6 Firewalls

2014-04-19 Thread Łukasz Bromirski
On 19 Apr 2014, at 20:08, George William Herbert wrote: > On Apr 18, 2014, at 9:10 PM, "Dobbins, Roland" wrote: > >> You can 'call' it all you like - but people who actually want to keep their >> servers up and running don't put stateful firewalls in front of them, > > I don't know where you

Re: Requirements for IPv6 Firewalls

2014-04-19 Thread George William Herbert
Sent from Kangphone On Apr 18, 2014, at 9:10 PM, "Dobbins, Roland" wrote: > You can 'call' it all you like - but people who actually want to keep their > servers up and running don't put stateful firewalls in front of them, I don't know where you find ideas like this. There are stateful fi

NANOG Mail Server Maintenance

2014-04-19 Thread Larry J. Blunk
Greetings, The NANOG Mail server will be transitioning to a new system next Saturday, April 26th. The maintenance window for this transition will be from 10:00 - 10:30 UTC. This will impact the main NANOG list and associated lists hosted on mailman.nanog.org. The addresses for the server will

Re: Requirements for IPv6 Firewalls

2014-04-19 Thread Gary Buhrmaster
On Sat, Apr 19, 2014 at 2:29 PM, joel jaeggli wrote: > On 4/18/14, 7:04 PM, Jeff Kell wrote: >> PCI requirement 1.3.8 pretty much requires RFC1918 >> addressing of the computers in scope... > > It does not You are correct. In theory. However, for those organizations that have chosen to use a f

Re: Requirements for IPv6 Firewalls

2014-04-19 Thread joel jaeggli
On 4/18/14, 7:04 PM, Jeff Kell wrote: > PCI requirement 1.3.8 pretty much requires RFC1918 > addressing of the computers in scope... It does not 1.3.8 Do not disclose private IP addresses and routing information to unauthorized parties. Note : Methods to obscure IP addressing may include, but a

Re: Requirements for IPv6 Firewalls

2014-04-19 Thread Florian Weimer
* Simon Perreault: > Le 2014-04-18 13:25, Mike Hale a écrit : >> I agree with Bill. You can poopoo NAT all you want, but it's a fact >> of most networks and will continue to remain so until you can make a >> compelling case to move away from it. > > Does that mean all IPv6 firewalls should suppor

Re: Requirements for IPv6 Firewalls

2014-04-19 Thread Eugeniu Patrascu
On Sat, Apr 19, 2014 at 5:04 AM, Jeff Kell wrote: > On 4/18/2014 9:53 PM, Dobbins, Roland wrote: > > On Apr 19, 2014, at 1:20 AM, William Herrin wrote: > > > >> There isn't much a firewall can do to break it. > > As someone who sees firewalls break the Internet all the time for those > whose pac

Re: Requirements for IPv6 Firewalls

2014-04-19 Thread Eugeniu Patrascu
On Sat, Apr 19, 2014 at 2:03 AM, Matthew Kaufman wrote: > Ignoring security, A is superior because I can change it to DNAT to the > new server, or DNAT to the load balancer now that said server needs 10 > replicas, etc. > > B requires re-numbering the server or *if* I am lucky enough that it is >