From Perimeter Router Security Technical Implementation Guide Juniper
Part of Embedded IPv4-Mapped IPv6 ADDR are not blocked
The IPv6 transition mechanisms include a technique for hosts and routers to dynamically tunnel IPv6 packets over IPv4 routing infrastructure. IPv6 nodes that use this technique are assigned special IPv6 unicast addresses that carry a global IPv4 address in the low-order 32 bits. IPv4-mapped IPv6 addresses should never appear as a source or destination address. These addresses begin with 0000 and have ‘FFFF’ in the 16 bit field preceding the IPv4 address. There is little use for the IPv4-mapped addresses and there has been some confusion for what their intended use was. There were three revisions of IPv6 Basic API specification (RFC 2133, 2553, and 3493). Under the current usage of the API, no packets should appear on the wire with these addresses so blocking them is the policy.
Base Procedure: Review the premise router configuration to ensure filters are in place to restrict the IP addresses explicitly, or inexplicitly. Verify that ingress and egress ACLs for IPv6 have been defined to deny the embedded IPv4-mapped IPv6 addresses and log all violations.
The administrator will configure the router ACLs to restrict IP addresses that contain any embedded IPv4-mapped IPv6 addresses.
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer