IPv6 Security
Outline
New features of IPv6 (1998)
IPv6 security pros/cons
Immediate IPv6 concerns
IPv6 deployment risks
IPv6 security myths
Network scanning
Some IPv6 protocol attacks
Draft guidance from HEPiX IPv6 working group
IPv6 issues for security/network teams
IPv6 for Sys admins (2)
More Information?
Summary and Outlook
IPsec
Extension Header vulnerabilities
IPv6 Neighbor Discovery
Neighbor Discovery Protocol
Rogue RA
Detecting rogue RA messages
DAD
ICMPv6

Detecting rogue RA messages
Use generic IDS with customised signatures
RA whose source MAC or IP is not in a configured list
Lots of manual configuration!
Use tool NDPMon
And check against XML config file
also monitor all NS and NA
To check when NA contradicts a previous one
Intelligent switches – known RA source
Cisco RA Guard
Rafixd (and ramond)
Detect all rogue RA messages and immediately transmit another forged RA with lifetime 0 seconds (to clear the rogue info on all nodes)