IPv6-related Requirements for the Internet Uplink or MPLS Networks

Sat, 31 Jan 2015 00:00:00 +0000

We’re currently involved in a complex RfP procedure for global network services of a large organization. As part of that we were asked to define a list of IPv6 related requirements as for the Internet uplink and MPLS circuit connections. The involved service providers/carrier offerings will be checked to comply with those.

As a source of inspiration we mainly used the excellent “What To Ask From Your Service Provider About IPv6” document from Cisco, and enhanced that with stuff we observed in other environments (go wrong), namely with regard to MTU/PMTUD and in the space of prefix filtering. Here’s the first draft list we came up with:

Carriers Converge Their Internet and MPLS Infrastructure: Time to Redo Your Risk Assessment?

Fri, 25 Nov 2011 00:00:00 +0000

The above is the exact title of a Gartner research note published some days ago. Its main thesis is that an increased convergence of carriers’ MPLS and Internet infrastructures onto shared IP infrastructures requires that enterprises re-evaluate their security and performance risks.

While I do not agree with the overall line of reasoning in the paper, it still highlights a number of interesting points when it comes to MPLS security. Which in turn reminds me of quite some stuff we’ve done in the past, mainly our Black Hat Europe 2009 talk “All your packets are belong to us – Attacking backbone technologies”. Today we’ll release an updated version of the accompanying whitepaper as a kind-of technical report. Its title is “Practical Attacks against MPLS or Carrier Ethernet Networks” and it can be found here.

MPLS on Insinuator.net - Bold Statements

IPv6-related Requirements for the Internet Uplink or MPLS Networks

Carriers Converge Their Internet and MPLS Infrastructure: Time to Redo Your Risk Assessment?