| Preface |
|
xiii | |
| About the Authors |
|
xv | |
|
Introduction, Overview, and Motivations |
|
|
1 | (68) |
|
Introduction and Motivations |
|
|
1 | (7) |
|
|
|
8 | (25) |
|
Overview of Traditional Security Approaches and Mechanisms |
|
|
33 | (36) |
|
|
|
47 | (3) |
|
Appendix A: Six-Month Listing of IPv6 Press |
|
|
50 | (19) |
|
Basic IPv6 Protocol Mechanisms |
|
|
69 | (36) |
|
|
|
69 | (1) |
|
IPv6 Addressing Mechanisms |
|
|
69 | (7) |
|
|
|
70 | (2) |
|
|
|
72 | (1) |
|
Addressing Issues/Reachability |
|
|
72 | (3) |
|
|
|
75 | (1) |
|
|
|
76 | (6) |
|
|
|
76 | (1) |
|
Aggregatable Global Unicast Addresses |
|
|
77 | (1) |
|
Link-Local (Unicast) Addresses |
|
|
77 | (1) |
|
Unspecified (Unicast) Address |
|
|
78 | (1) |
|
Loopback (Unicast) Address |
|
|
78 | (1) |
|
Compatibility (Unicast) Addresses |
|
|
78 | (1) |
|
|
|
78 | (3) |
|
|
|
81 | (1) |
|
Addresses for Hosts and Routers |
|
|
81 | (1) |
|
|
|
82 | (3) |
|
Mapping EUI-64 Addresses to IPv6 Interface Identifiers |
|
|
83 | (1) |
|
Mapping IEEE 802 Addresses to IPv6 Interface Identifiers |
|
|
84 | (1) |
|
Randomly Generated Interface Identifiers |
|
|
84 | (1) |
|
IPv6 Addressing (Details) |
|
|
85 | (1) |
|
|
|
85 | (11) |
|
Text Representation of Addresses |
|
|
86 | (1) |
|
Text Representation of Address Prefixes |
|
|
87 | (1) |
|
Address Type Identification |
|
|
88 | (1) |
|
|
|
88 | (1) |
|
|
|
89 | (1) |
|
|
|
90 | (1) |
|
|
|
90 | (1) |
|
|
|
90 | (1) |
|
IPv6 Addresses with Embedded IPv4 Addresses |
|
|
91 | (1) |
|
|
|
91 | (1) |
|
Local-Use IPv6 Unicast Addresses |
|
|
91 | (1) |
|
|
|
92 | (1) |
|
|
|
93 | (1) |
|
|
|
93 | (1) |
|
Predefined Multicast Addresses |
|
|
94 | (2) |
|
A Node's Required Addresses |
|
|
96 | (1) |
|
|
|
96 | (1) |
|
|
|
97 | (1) |
|
Creating Modified EUI-64 Format Interface Identifiers |
|
|
97 | (2) |
|
Links or Nodes with IEEE EUI-64 Identifiers |
|
|
97 | (1) |
|
Links or Nodes with IEEE 802 48-bit MACs |
|
|
98 | (1) |
|
Links with Other Kinds of Identifiers |
|
|
98 | (1) |
|
Links without Identifiers |
|
|
99 | (1) |
|
64-Bit Global Identifier (EUI-64) Registration Authority |
|
|
99 | (6) |
|
|
|
100 | (1) |
|
Distribution Restrictions |
|
|
100 | (1) |
|
Application Documentation |
|
|
100 | (1) |
|
Manufacturer-Assigned Identifiers |
|
|
101 | (1) |
|
|
|
101 | (4) |
|
More Advanced IPv6 Protocol Mechanisms |
|
|
105 | (58) |
|
|
|
105 | (1) |
|
IPv6 and Related Protocols (Details) |
|
|
106 | (1) |
|
|
|
107 | (1) |
|
|
|
107 | (1) |
|
|
|
108 | (14) |
|
|
|
109 | (1) |
|
|
|
110 | (2) |
|
|
|
112 | (1) |
|
Hop-by-Hop Options Header |
|
|
112 | (1) |
|
|
|
113 | (3) |
|
|
|
116 | (1) |
|
|
|
117 | (4) |
|
Destination Options Header |
|
|
121 | (1) |
|
|
|
122 | (1) |
|
|
|
122 | (1) |
|
|
|
123 | (1) |
|
|
|
123 | (1) |
|
Upper-Layer Protocol Issues |
|
|
124 | (2) |
|
|
|
124 | (1) |
|
|
|
125 | (1) |
|
Maximum Upper-Layer Payload Size |
|
|
125 | (1) |
|
Responding to Packets Carrying Routing Headers |
|
|
125 | (1) |
|
Semantics and Usage of the Flow Label Field |
|
|
126 | (1) |
|
Formatting Guidelines for Options |
|
|
127 | (3) |
|
|
|
130 | (4) |
|
|
|
130 | (1) |
|
Protocol-Support Mechanisms |
|
|
130 | (4) |
|
Routing and Route Management |
|
|
134 | (2) |
|
|
|
136 | (2) |
|
Dynamic Host Configuration Protocol for IPv6 |
|
|
138 | (4) |
|
More on Transition Approaches and Mechanisms |
|
|
142 | (21) |
|
|
|
144 | (1) |
|
Appendix A: Neighbor Discovery for IP Version 6 (IPv6) Protocol |
|
|
145 | (1) |
|
|
|
145 | (5) |
|
Appendix B: Mobile IP Version 6 (MIPv6) |
|
|
150 | (1) |
|
Basic Operation of Mobile IPv6 |
|
|
151 | (5) |
|
Appendix C: Enabling IPv6 in Cisco Routers |
|
|
156 | (1) |
|
Enabling IPv6 Routing and Configuring IPv6 Addressing |
|
|
156 | (1) |
|
Enabling IPv6 Processing Globally on the Router |
|
|
156 | (1) |
|
Configuring IPv6 Addresses |
|
|
156 | (1) |
|
Verifying IPv6 Operation and Address Configuration |
|
|
157 | (3) |
|
IPv6 Routing and IPv6 Address Configuration Example |
|
|
160 | (3) |
|
Security Mechanisms and Approaches |
|
|
163 | (32) |
|
|
|
163 | (1) |
|
|
|
163 | (11) |
|
Review of Firewall-Based Perimeter Security |
|
|
174 | (8) |
|
|
|
176 | (1) |
|
Network Address Translation (NAT) |
|
|
177 | (1) |
|
Virtual Private Network (VPN) |
|
|
177 | (1) |
|
Demilitarized Zones (DMZ) |
|
|
177 | (1) |
|
|
|
177 | (1) |
|
|
|
178 | (1) |
|
|
|
179 | (1) |
|
|
|
179 | (1) |
|
|
|
180 | (1) |
|
|
|
181 | (1) |
|
IPv6 Areas of Security Concerns: Addresses |
|
|
182 | (4) |
|
|
|
182 | (4) |
|
IPv6 Anycast Address Security |
|
|
186 | (1) |
|
Documented Issues for IPv6 Security |
|
|
186 | (9) |
|
|
|
188 | (2) |
|
Appendix A: Risks and Vulnerabilities |
|
|
190 | (1) |
|
|
|
190 | (1) |
|
|
|
191 | (1) |
|
Denial of Service (Flooding Attacks) |
|
|
192 | (1) |
|
|
|
193 | (1) |
|
Cause Packets to Be Sent to the Attacker |
|
|
193 | (1) |
|
``Classic'' Redirection Attack |
|
|
193 | (1) |
|
|
|
194 | (1) |
|
Cause Packets to Be Sent to a Black Hole |
|
|
194 | (1) |
|
Third Party Denial-of-Service Attacks |
|
|
194 | (1) |
|
Basic IPv6 Security Considerations |
|
|
195 | (12) |
|
|
|
195 | (1) |
|
|
|
195 | (2) |
|
|
|
197 | (1) |
|
Neighbor Discovery Issues |
|
|
198 | (4) |
|
|
|
202 | (1) |
|
|
|
203 | (1) |
|
|
|
204 | (3) |
|
|
|
205 | (2) |
|
IPsec and Its Use in IPv6 Environments |
|
|
207 | (18) |
|
|
|
207 | (1) |
|
|
|
208 | (2) |
|
|
|
210 | (3) |
|
IP Authentication Header (AH) |
|
|
213 | (1) |
|
IP Encapsulating Security Protocol (ESP) |
|
|
214 | (3) |
|
Supportive Infrastructure: IPsec Architecture |
|
|
217 | (3) |
|
|
|
220 | (5) |
|
|
|
222 | (3) |
|
Firewall Use in IPv6 Environments |
|
|
225 | (18) |
|
|
|
225 | (1) |
|
Role of Firewalls for IPv6 Perimeters |
|
|
226 | (5) |
|
|
|
231 | (4) |
|
Extension Headers and Fragmentation |
|
|
235 | (2) |
|
|
|
237 | (1) |
|
|
|
237 | (1) |
|
|
|
238 | (5) |
|
|
|
241 | (1) |
|
Appendix A: Market Status |
|
|
241 | (2) |
|
Security Considerations for Migrations/Mixed IPv4-IPv6 Networks |
|
|
243 | (24) |
|
|
|
243 | (1) |
|
|
|
243 | (6) |
|
Security Issues Associated with Transition |
|
|
249 | (7) |
|
Threats and the Use of IPsec |
|
|
256 | (4) |
|
|
|
256 | (1) |
|
|
|
257 | (1) |
|
|
|
257 | (1) |
|
Site-to-Router/Router-to-Site Tunnels |
|
|
258 | (1) |
|
|
|
258 | (2) |
|
NATs, Packet Filtering, and Teredo |
|
|
260 | (2) |
|
Use of Host-Based Firewalls |
|
|
262 | (2) |
|
Use of Distributed Firewalls |
|
|
264 | (3) |
|
|
|
265 | (2) |
| Index |
|
267 | |