According to rfc4861 the source address for Router Solicitation(ICMPv6 type 133), Neighbor Solicitation(ICMPv6 type 135) and Neighbor Advertisement(ICMPv6 type 136) can be an address assigned to the interface. Am I correct, that this address can also be anything else than link-local(fe80::/10) address? The reason I'm asking is that I'm working on an ingress firewall and when I study example filters(for example rfc6192), then source address for NDP protocol is not restricted.
-
In the most scenarios ICMPv6 uses link-local as source. Of course when device advertises another address from interface, it can uses this one. But if we are talking about firewall rules, we don't need to use source address at all, only ICMP type.– Konstantin GoncharenkoCommented Jan 28, 2020 at 10:04
-
Remember that packets with Link-Local addressing cannot be routed to a different network, so firewall rules play no part in that because those packets will not pass through a firewall.– Ron Maupin ♦Commented Jan 28, 2020 at 14:30
-
@RonMaupin I meant the firewall which filters the traffic to router control plane, e.g punted traffic.– MartinCommented Jan 28, 2020 at 15:17
-
Be sure to also look at RFC 4890, Recommendations for Filtering ICMPv6 Messages in Firewalls. It has some good explanations, and what you should allow seems to shock many people with IPv4 experience.– Ron Maupin ♦Commented Jan 28, 2020 at 15:22
Add a comment
|
1 Answer
The source address is not constrained to link-local and you should not rely on that, as per your own source. One good usecase for this is to expedite population of neighbor caches. If you send a ND you can inlcude a source link-layer address (usually MAC) that can be tied to the sending source IP. That can be used to pre-populate the neighbor cache on any receiving node (the entry will not be stable but that's a technical detail that does not matter). So when soliciting for example for a GUA neighbor, it actually makes sense to use an assigned GUA source from the same prefix on that interface if available.
There is also an informational RFC 4890 that can help with these things. Relevant here are sections 4.3 and 4.4, you'll see a similar conclusion, the differentiation is on ICMPv6 type and on destination (i.e. transit/local). One note though, this RFC is useful as a help, but it's informational, don't take it too literally (it is clearly written from the perspective of a specific kind of firewall and does certainly not apply in general).
