North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Assigning IPv6 /48's to CPE's?

  • From: William Herrin
  • Date: Thu Jan 03 12:55:37 2008
  • Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth; bh=Y3NpznqxLWSBe6FvvFXdZkKEByAXkEeQnvNhcEu42bM=; b=Zu56RZkLY06Vl6ZUaXuQC2qEGUVXl8H63YhVlPZVpzpGBBM51aiOwDWiHWbOCmVdJOzewKtNniP9340TPTOAKROVLoJN9q3WLXPhqP3KhbvxQOkNowAZCxnixm3GflcqeWG4R16sSi2q7+yYcH4Sbw+niA7wt6D9u/e0DI0WJRg=
  • Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth; b=D34NDnIUXi8JNStoET2dykDbmLCQ7/fVd9NjUC4RvfbW41P+y2yJBioaoiMZlcLcjFpGfYj4cp/OG6sYM81kEwadlZsAxMD0nFVdlawvm0PwXk3J0hvcISbe6hm3wb1lsvUJDqT61gELs4FITCQ13F5k596huF0QixYNFqpBRdw=
On Jan 3, 2008 11:25 AM, Tim Franklin <[email protected]> wrote:
> Only assuming the nature of your mistake is 'turn it off'.
>
> I can fat-finger a 'port-forward *all* ports to important internal
> server', rather than just '80/TCP' pretty much exactly as easily as I can
> fat-finger 'permit *all* external to important internal server' rather
> than just '80/TCP'.

Tim,

While that's true of firewalled servers that are intended to provide
services to the Internet at large, the vast majority of equipment
behind a typical NAT firewall provides no services whatsoever to the
Internet and do not each map to their own global IP address. They are
client PCs and a scattering of LAN servers.

You can fat-finger "allow all ports inbound" in a stateful firewall
far easier than you fat finger "translate a bank of global IP
addresses I don't actually have on a one-to-one basis to this large
list of local-scope IP addresses -and- allow all ports inbound" in a
NAT firewall. Actually, the latter is pretty hard to configure at all,
let alone fat-finger by mistake.


> I'll grant the 'everything is disconnected' case is easier to spot, though
> - especially if you don't have proper change management to test that the
> change you made is the change you think you made.

Do you mean to tell me there's actually such a thing as a network
engineer who creates and uses a test plan every single time he makes a
change to every firewall he deals with? I thought such beings were a
myth, like unicorns and space aliens!

Regards,
Bill Herrin



-- 
William D. Herrin                  [email protected]  [email protected]
3005 Crane Dr.                        Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004