IPv6 Security

98 Chapter 3: IPv6 Internet SecurityExample 3-6BGP neighbor. The concept is that if link-local addresses are used, there would be no wayfor any other attacker to try to create a peering session with the routers. The attacker couldnot communicate with either peer in the first place. Furthermore, the attacker would notknow the IPv6 addresses of either peer and, as shown in Chapter 2, the reconnaissance ofthese addresses would not be feasible. Because many organizations might question whetherto use global addresses or link-local addresses for BGP peering, it is important to cover thisin more detail. The following sections review the positive and negative aspects of usinglink-local addresses instead of global addresses.When using link-local addresses for BGP peers, you must explicitly configure the link-localaddress of the neighbor. Because DNS is not used for link-local addresses, you mustmanually enter these addresses. As a result, you could easily make a mistake that might takesome time to troubleshoot.Also be aware that the link-local address of a router can be shared among multipleinterfaces. Therefore, you must configure the router for the neighbor’s link-local addressand specify the interface that is being used for the directly connected addresses. There aretwo ways of doing this. In earlier software versions, you would specify the interfaceidentifier following the link-local address (for example,FE80::C800:17FF:FE88:0%Serial1/0). Another newer technique uses the update-sourceneighbor parameter to specify the interface. Example 3-6 shows how this configuration canappear.BGP Peering Using Link-Local Addresseshostname R1!interface Serial1/0description ISP interconnectipv6 address 2001:DB8:12::1/64ipv6 traffic-filter ALLOWBGP in!router bgp 100bgp router-id 1.1.1.1neighbor FE80::C801:15FF:FE44:0 remote-as 200neighbor FE80::C801:15FF:FE44:0 ttl-security hops 1neighbor FE80::C801:15FF:FE44:0 password cisco123neighbor FE80::C801:15FF:FE44:0 update-source Serial1/0!address-family ipv4no neighbor FE80::C801:15FF:FE44:0 activateexit-address-family!address-family ipv6neighbor FE80::C801:15FF:FE44:0 activateneighbor FE80::C801:15FF:FE44:0 prefix-list FILTERV6ISPIN inneighbor FE80::C801:15FF:FE44:0 prefix-list FILTERV6ISPOUT outneighbor FE80::C801:15FF:FE44:0 route-map SETNEXTHOP outneighbor FE80::C801:15FF:FE44:0 maximum-prefix 250000network 2001:DB8:1::/48