So, we recently got our /48 prefix from our LIR, and started small-scale deploying it in a lab.
What struck me as odd is that sites like http://ipv6-test.com/ insist that you allow incoming ICMP Echo requests. I understand why you should allow ICMPv6 outgoing, but incoming? Even if it's just a ping?
So, my question is: Aside from possible DDoS attacks utilizing ICMP, are there any drawbacks in allowing incoming ICMP echo requests?
I read RFC4890 ( https://www.ietf.org/rfc/rfc4890.txt ) but couldn't find a definite answer there.
A.5. ICMPv6 Echo Request and Echo Response
It is not thought that there is a significant risk from scanning attacks on a well-designed IPv6 network (see Section 3.2), and so connectivity checks should be allowed by default.
Is this point still valid, given the RFC is almost 10 years old? Also, the RFC does not differentiate between outgoing and incoming directions.
I always felt the recommendation for v4 was to block ICMP at the gateway, but then again, v6 heavily relies on ICMP.
So, any suggestions?