3

We're operating an IPv4 network (on ethernet & Wifi) in a student dorm with ~200 users and want to deploy IPv6 in the long term, with stateless autoconfiguration on a single /64 prefix.

Unfortunately, the university providing the uplink requires us to be able to identify the users behind an address. They're currently running a firewall blocking IPv4 addresses in case of misuse (viruses etc.), which is a viable solution because every user currently has only 2 fixed v4 addresses. We already have a list of all MAC addresses that belong to a user (to configure dhcpd) and want to selectively allow/block users ourselves (network fee payment, misbehavior etc.).

In my first tests with a Raspberry Pi running radvd I found out that the majority of connected devices have privacy extensions enabled, making it impossible for the uplink provider to block a misbehaving IPv6 address for longer than its validity time.

So far I only see a few options:

  • Track Neighbor Discoveries on the router and create a firewall whitelist entry in real time. Somehow provide an API to the uplink provider to block the user of a given IP. (high effort)
  • Disallow privacy extensions and block all IPs without ..ff:fe..
  • Add a custom IPv6 extension header for the uplink provider including a unique user ID, so they can block the whole user by just matching an IPv6 header field.

Is there any rather simple solution using existing software? Should we change our plans and use DHCPv6 instead (said to work not as good as SLAAC)? I already thought about requesting a bigger subnet (/48) and giving a separate /64 to each user, but this would require having a huge radvd.conf with 200 prefixes (+ probably 200 VLANs) and unicast RAs changing a few times per hour, as far as I see.

1 Answer 1

4

Well, first off, relying on MAC addresses as identifying information is not a good idea - they can be trivially changed by the user.

Regarding SLAAC, as you've found out, it's very much not suited for an environment that you need control over. As such, consider switching to DHCPv6.

Once you've switched to DHCP, the solution to your MAC address problem is to enable 802.1x authentication for your users. This way, they sign in with their credentials (instead of you relying on MAC addresses) and you can then log what username got which IP address, both for v4 and v6.

You've perhaps already thought of this, but another thing you want to take care of is to filter RAs on your switch gear. Without doing this, a rogue user could manage to MITM IPv6 traffic on the network.

2
  • Thanks so far, I think I should start playing with DHCPv6. We already have RA-Guard activated on the switches but decided against 802.1X at an earlier point, maybe we should do some more extended testing as well. Also, we're aware of the risks of MAC-based auth, but had no problems so far in the last 2 years.
    – cbix
    Apr 29, 2015 at 13:29
  • 4
    @flo No problems that you know of. Apr 29, 2015 at 15:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .