[171147] in North American Network Operators' Group
Re: Requirements for IPv6 Firewalls
daemon@ATHENA.MIT.EDU (Dobbins, Roland)
Sat Apr 19 00:11:39 2014
From: "Dobbins, Roland" <rdobbins@arbor.net>
To: "nanog@nanog.org" <nanog@nanog.org>
Date: Sat, 19 Apr 2014 04:10:26 +0000
In-Reply-To: <5351EDA4.6030009@utc.edu>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Apr 19, 2014, at 10:29 AM, Jeff Kell <jeff-kell@utc.edu> wrote:
> I call BS...
You can 'call' it all you like - but people who actually want to keep their=
servers up and running don't put stateful firewalls in front of them, beca=
use it's very easy to knock them over due to state exhaustion. In fact, it=
's far easier to knock them over than to knock over properly-tuned naked ho=
sts.
Also, you might want to search the NANOG email archive on this topic. Ther=
e's lots of previous discussion, which boils down to the fact that serious =
organizations running serious applications/services don't put stateful fire=
walls (or 'IPS', or NATs, et. al.) in front of their servers.
The only way to secure hosts/applications/service against compromise is via=
those hosts/applications/services themselves. Inserting stateful middlebo=
xes doesn't actually accomplish anything to enhance confidentiality and int=
egrity, actually increases the attack surface due to middlebox exploits (re=
ad the numerous security notices for various commercial and open-source sta=
teful firewalls for compromise exploits), and has a negative impact on avai=
lability.
Again, take a look at this preso:
<https://app.box.com/s/a3oqqlgwe15j8svojvzl>
And take a look at pp. 17-18 of this preso:
<https://app.box.com/s/ko8lk4vlh1835p36na3u>
I've seen 3mb/sec of spoofed SYN-flooding take down a supposedly 20gb/sec s=
tateful firewall due to state exhaustion in about 2 minutes; I've seen 6kpp=
s of HOIC take down a supposedly 10gb/sec load-balancer due to state-table =
exhaustion in 60 seconds. Each of those devices required an ~30-minute har=
d reboot - and those are just two of too many examples to keep track of, he=
h.
-----------------------------------------------------------------------
Roland Dobbins <rdobbins@arbor.net> // <http://www.arbornetworks.com>
Luck is the residue of opportunity and design.
-- John Milton
