Home page logo

nanog logo nanog mailing list archives

Re: HP IPv6 RA Guard
From: Ray Soucy <rps () maine edu>
Date: Tue, 6 Dec 2011 08:46:22 -0500

I think of RA Guard as a Layer-2 stability feature, rather than a
security feature.

You're correct that it is unable to deal with RA crafted in a
fragmented packet on the majority (if not all) of implementations.

The issue of rogue RA exists on every network, regardless of whether
or not the IT group has deployed IPv6 or is aware of the IPv6 traffic
on that network.

Windows ICS is the most common "accidental" cause of rogue RA on a LAN.

On Mon, Dec 5, 2011 at 10:35 PM, Daniel Espejel
<daniel.unam.ipv6 () gmail com> wrote:
So,still assuming the fact that attackers will use the same "traditional
ipv4" methods to alter the correct functioning over a network?...Well,
maybe. Toda's IPv6 expertise for some network andmins and security
experts is minimal. So most trainning and understanding before
implementing its a good idea.

For example, the RA-Guard method has a significant vulnerability: It's
not designed to identify a "complex" IPv6-many extension headers formed
packet (F. Gont - 6Networks). Some other security oriented mechanisms
may fail because of the low IPv6 compliance.


Daniel Espejel Pérez
Técnico Académico
D.G.T.I.C. - U.N.A.M.

Ray Soucy

Epic Communications Specialist

Phone: +1 (207) 561-3526

Networkmaine, a Unit of the University of Maine System

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]