Operational Security Considerations for IPv6 Networks
Metadata
- Publisher
- IETF
- Doc Type
- Informational
- Pages
- 48
- Abstract
- Knowledge and experience on how to operate IPv4 networks securely is available, whether the operator is an Internet Service Provider (ISP) or an enterprise internal network. However, IPv6 presents some new security challenges. RFC 4942 describes security issues in the protocol, but network managers also need a more practical, operations-minded document to enumerate advantages and/or disadvantages of certain choices. This document analyzes the operational security issues associated with several types of networks and proposes technical and procedural mitigation techniques. This document is only applicable to managed networks, such as enterprise networks, service provider networks, or managed residential networks.
- Publication Date
- 2021-08-01
- Status Note
- Informational
- DOI
10.17487/RFC9099- Link
- https://doi.org/10.17487/RFC9099
- Author(s)
- Éric VynckeKK ChittimaneniMerike KaeoEnno Rey
- Keyword(s)
- IPv6, Security, Operational Security
Latest version of IETF RFC 9099
Document Versions — IETF RFC 9099
-
▶ IETF RFC 9099 (2021-08-01)THIS DOC [ACTIVE] [LATEST VERSION]
Normative Reference(s)
- IETF RFC 2119 [Active*]
- IETF RFC 8174 [Active*]
- IETF RFC 8200 [Active*]
Bibliographic Reference(s)
- IEEE.STD802.1X.2020 — IEEE-802.1X EXTERNAL
- IETF.draft-ietf-opsec-ipv6-eh-filtering-08 — I-D.ietf-opsec-ipv6-eh-filtering EXTERNAL
- IETF.draft-kampanakis-6man-ipv6-eh-parsing-01 — I-D.kampanakis-6man-ipv6-eh-parsing EXTERNAL
- ISBN.1587055945 — IPv6_Security_Book EXTERNAL
- NIST.SP.800-119 — NIST EXTERNAL
- Kaeo, M., Green, D., Bound, J., and Y. Pouffary, "North American IPv6 Task Force (NAv6TF) Technology Report "IPv6 Security Technology Paper", July 2006, <http://www.ipv6forum.com/dl/white/NAv6TF_Security_Report.pdf>. EXTERNAL
- European Union, "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)", Official Journal of the European Union, April 2016, <https://eur-lex.europa.eu/eli/reg/2016/679/oj>. EXTERNAL
- Foremski, P., Plonka, D., and A. Berger, "Entropy/IP: Uncovering Structure in IPv6 Addresses", November 2016, <http://www.entropy-ip.com/>. EXTERNAL
- Team Cymru, "The Bogon Reference", <https://team-cymru.com/community-services/bogon-reference/>. EXTERNAL
- Kristoff, J., Ghasemisharif, M., Kanich, C., and J. Polakis, "Plight at the End of the Tunnel: Legacy IPv6 Transition Mechanisms in the Wild", March 2021, <https://dataplane.org/jtk/publications/kgkp-pam-21.pdf>. EXTERNAL
- Weber, J., "Dynamic IPv6 Prefix - Problems and VPNs", March 2018, <https://blog.webernetz.net/wp-content/uploads/2018/03/TR18-Johannes-Weber-Dynamic-IPv6-Prefix-Problems-and-VPNs.pdf>. EXTERNAL
- Barnes, R., Altmann, R., and D. Kerr, "Mapping the Great Void - Smarter scanning for IPv6", February 2012, <http://www.caida.org/workshops/isma/1202/slides/aims1202_rbarnes.pdf>. EXTERNAL
- Rey, E., "Local Packet Filtering with IPv6", July 2017, <https://labs.ripe.net/Members/enno_rey/local-packet-filtering-with-ipv6>. EXTERNAL
- Europol, "Are you sharing the same IP address as a criminal? Law enforcement call for the end of Carrier Grade Nat (CGN) to increase accountability online", October 2017, <https://www.europol.europa.eu/newsroom/news/are-you-sharing-same-ip-address-criminal-law-enforcement-call-for-end-of-carrier-grade-nat-cgn-to-increase-accountability-online>. EXTERNAL
- Merit Network, Inc., "RADb: The Internet Routing Registry", <https://www.radb.net/>. EXTERNAL
- IANA, "IP Flow Information Export (IPFIX) Entities", <http://www.iana.org/assignments/ipfix>. EXTERNAL
- IETF RFC 826 [Active*]
- IETF RFC 1918 [Active*]
- IETF RFC 2131 [Active*]
- IETF RFC 2460 [Superseded*]
- IETF RFC 2529 [Active*]
- IETF RFC 2663 [Active*]
- IETF RFC 2784 [Active*]
- IETF RFC 2827 [Active*]
- IETF RFC 2866 [Active*]
- IETF RFC 3056 [Active*]
- IETF RFC 3068 [Superseded*]
- IETF RFC 3627 [Superseded*]
- IETF RFC 3704 [Active*]
- IETF RFC 3756 [Active*]
- IETF RFC 3964 [Active*]
- IETF RFC 3971 [Active*]
- IETF RFC 3972 [Active*]
- IETF RFC 4033 [Active*]
- IETF RFC 4107 [Active*]
- IETF RFC 4193 [Active*]
- IETF RFC 4293 [Active*]
- IETF RFC 4301 [Active, Amended*]
- IETF RFC 4302 [Active*]
- IETF RFC 4303 [Active*]
- IETF RFC 4364 [Active*]
- IETF RFC 4380 [Active*]
- IETF RFC 4381 [Active*]
- IETF RFC 4443 [Active*]
- IETF RFC 4552 [Active*]
- IETF RFC 4649 [Active*]
- IETF RFC 4659 [Active*]
- IETF RFC 4795 [Active*]
- IETF RFC 4798 [Active*]
- IETF RFC 4861 [Active*]
- IETF RFC 4864 [Active*]
- IETF RFC 4890 [Active*]
- IETF RFC 4942 [Active*]
- IETF RFC 5082 [Active*]
- IETF RFC 5214 [Active*]
- IETF RFC 5340 [Active*]
- IETF RFC 5635 [Active*]
- IETF RFC 5952 [Active*]
- IETF RFC 5969 [Active*]
- IETF RFC 6092 [Active*]
- IETF RFC 6104 [Active*]
- IETF RFC 6105 [Active*]
- IETF RFC 6144 [Active*]
- IETF RFC 6146 [Active*]
- IETF RFC 6147 [Active*]
- IETF RFC 6164 [Active*]
- IETF RFC 6169 [Active*]
- IETF RFC 6177 [Active*]
- IETF RFC 6192 [Active*]
- IETF RFC 6221 [Active*]
- IETF RFC 6241 [Active*]
- IETF RFC 6264 [Active*]
- IETF RFC 6269 [Active*]
- IETF RFC 6296 [Active*]
- IETF RFC 6302 [Active*]
- IETF RFC 6324 [Active*]
- IETF RFC 6333 [Active*]
- IETF RFC 6343 [Active*]
- IETF RFC 6434 [Superseded*]
- IETF RFC 6459 [Active*]
- IETF RFC 6547 [Active*]
- IETF RFC 6564 [Active*]
- IETF RFC 6583 [Active*]
- IETF RFC 6598 [Active*]
- IETF RFC 6620 [Active*]
- IETF RFC 6666 [Active*]
- IETF RFC 6762 [Active*]
- IETF RFC 6763 [Active*]
- IETF RFC 6775 [Active*]
- IETF RFC 6877 [Active*]
- IETF RFC 6888 [Active*]
- IETF RFC 6939 [Active*]
- IETF RFC 6964 [Active*]
- IETF RFC 6967 [Active*]
- IETF RFC 6980 [Active*]
- RFC7010 — RFC7010 EXTERNAL
- IETF RFC 7011 [Active*]
- IETF RFC 7012 [Active*]
- IETF RFC 7039 [Active*]
- IETF RFC 7045 [Active*]
- IETF RFC 7084 [Active*]
- IETF RFC 7112 [Active*]
- IETF RFC 7113 [Active*]
- IETF RFC 7123 [Active*]
- IETF RFC 7166 [Active*]
- IETF RFC 7217 [Active*]
- IETF RFC 7359 [Active*]
- IETF RFC 7381 [Active*]
- IETF RFC 7404 [Active*]
- RFC7422 — RFC7422 EXTERNAL
- IETF RFC 7454 [Active*]
- IETF RFC 7513 [Active*]
- IETF RFC 7526 [Active*]
- IETF RFC 7552 [Active*]
- IETF RFC 7597 [Active*]
- IETF RFC 7599 [Active*]
- IETF RFC 7610 [Active*]
- IETF RFC 7707 [Active*]
- IETF RFC 7721 [Active*]
- IETF RFC 7772 [Active*]
- RFC7785 — RFC7785 EXTERNAL
- IETF RFC 7824 [Active*]
- IETF RFC 7844 [Active*]
- IETF RFC 7857 [Active*]
- IETF RFC 7872 [Active*]
- IETF RFC 7915 [Active*]
- IETF RFC 7934 [Active*]
- IETF RFC 8040 [Active*]
- IETF RFC 8064 [Active*]
- IETF RFC 8177 [Active*]
- IETF RFC 8190 [Active*]
- IETF RFC 8210 [Active*]
- IETF RFC 8273 [Active*]
- IETF RFC 8343 [Active*]
- IETF RFC 8344 [Active*]
- IETF RFC 8415 [Superseded*]
- IETF RFC 8504 [Active*]
- IETF RFC 8520 [Active*]
- RFC8541 — RFC8541 EXTERNAL
- IETF RFC 8981 [Active*]
Source Data (JSON)
Full registry record with provenance metadata. Open directly: /api/doc/RFC9099.json
Reference Tree
Explore all references and references to this document, as a navigable tree.
Open Reference TreeReference this Doc
Plain text (ISO 690 compliant)
Preview:
IETF RFC 9099, Operational Security Considerations for IPv6 Networks. Available at https://doi.org/10.17487/RFC9099
Snippet:
IETF RFC 9099, Operational Security Considerations for IPv6 Networks. Available at https://doi.org/10.17487/RFC9099
HTML (ISO 690 compliant)
Preview:
IETF RFC 9099, Operational Security Considerations for IPv6 Networks. Available at https://doi.org/10.17487/RFC9099
Snippet:
<span class="citation"><cite>IETF RFC 9099</cite>, Operational Security Considerations for IPv6 Networks. Available at <a href="https://doi.org/10.17487/RFC9099" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9099</a></span>
SMPTE's HTML Pub
Preview:
IETF RFC 9099, Operational Security Considerations for IPv6 Networks
doi: 10.17487/RFC9099
url: https://doi.org/10.17487/RFC9099
doi: 10.17487/RFC9099
url: https://doi.org/10.17487/RFC9099
Snippet:
<li> <cite id="bib-rfc9099">IETF RFC 9099</cite>, Operational Security Considerations for IPv6 Networks <span class="doi">10.17487/RFC9099</span> </li>
Referenced By
- IETF RFC 9268 [Active*]
- IETF RFC 9386 [Active*]
- IETF RFC 9568 [Active*]