I was listening to excellent opening presentation Enno Rey had at Troopers 2014 IPv6 security summit (he claimed he was ranting, but it sounded more like some of my polite blog posts) and when I’ve seen this slide I could literally hear a blog post clicking together in my head.
In short: IPv6 has many shortcomings, but this might not be one of them.
The layer-2 subnet model is broken
We can either accept that fact (and work on hardening the end-systems), split our oversized layer-2 domains into smaller ones (where all hosts in a smaller domain become totally equivalent from security perspective), or implement a properly hardened network that:
- Authenticates users before allowing them to connect to the network;
- Assigns addresses to users in an auditable fashion;
- Enforces source address checks on every packet sent by the user.
Come to think of it, we do have such a network implementation. It’s called Fibre Channel.
Of course the networking industry took another approach:
- Pretending the problem doesn’t exist until enough users started screaming;
- Explaining how solving the problem breaks existing applications and is thus unreasonable;
- Implementing layers of kludges on top of broken architecture (large-scale Ethernet subnets), resulting in overly complex solutions like SAVI.
Obviously it’s not just the vendors’ problem – there are plenty of customers buying cheapest possible switches and later complaining how it’s impossible to properly secure them. Unfortunately some of the really expensive switches aren’t any more secure ;)
Some Got It Right
There’s a single company (AFAIK – I hope you’ll prove me wrong in the comments) that handles the layer-2/layer-3 boundary correctly, restoring the original meaning of data-link layer (before bridges were invented): Microsoft’s Hyper-V Network Virtualization connects VMs straight to a layer-3 virtual switch that block all rogue RA messages and terminates all ND exchanges. Amazon VPC and Juniper Contrail do something very similar, but only for IPv4.
Finally, there’s always the option of putting every single user in its own subnet. Good luck with that – you ops people and the switch vendors (who will run out of TCAM) will love you.