Presentation is loading. Please wait.

Presentation is loading. Please wait.

May 17, 2009 McAfee Security and IPv6 David LePage Enterprise Solutions Architect – Network Security Business Unit, McAfee.

Published byDale Barber Modified over 8 years ago

Similar presentations

Presentation on theme: "May 17, 2009 McAfee Security and IPv6 David LePage Enterprise Solutions Architect – Network Security Business Unit, McAfee."— Presentation transcript:

1 May 17, 2009 McAfee Security and IPv6 David LePage Enterprise Solutions Architect – Network Security Business Unit, McAfee

2 Confidential McAfee Internal Use Only September 9, 2015McAfee Firewall Enterprise Sales Presentation2 Agenda Very brief overview of McAfee + Secure Computing IPv6 Overview McAfee Firewall Enterprise (Sidewinder) McAfee Web (SmartFilter) McAfee TrustedSource/URL Database McAfee Web Merge Tool Questions / Comments

3 Confidential McAfee Internal Use Only September 9, 2015McAfee Firewall Enterprise Sales Presentation3 Agenda Very brief overview of McAfee + Secure Computing IPv6 Overview McAfee Firewall Enterprise (Sidewinder) McAfee Web (SmartFilter) McAfee TrustedSource McAfee Web Merge Tool Questions / Comments

4 Confidential McAfee Internal Use Only September 9, 2015Title of presentation4 Did You Know? >$500M+ Revenue and growing at 20+% Over 600 dedicated development staff 250 threat researchers in 23 countries Over 22,000 customers Over 400,000 Appliances in service Over 2500 Network Security partners McAfee Network Security Stats: Recognized Product Line Leadership Core to McAfee’s Total Security Strategy Complete Protection, Fastest Time to Confidence

5 Confidential McAfee Internal Use Only September 9, 2015McAfee Firewall Enterprise Sales Presentation5 Agenda Very brief overview of McAfee + Secure Computing IPv6 Overview McAfee Firewall Enterprise (Sidewinder) McAfee Web (SmartFilter) McAfee TrustedSource/URL Database McAfee Web Merge Tool Questions / Comments

6 Confidential McAfee Internal Use Only IPv6 Overview A Primary reason for the existence of IPv6 is address depletion in IPv4: IPv4 = 32 bit addresses 111.1.1.200 = 110111100000001000000011101111 4,294,967,296 (4.29 x 10 9 ) Possible Addresses IPv6 = 128 bit addresses fd4c:4547:4f53:111::200 = 11111101010011000100010101000111010011110101001100000001 00010001000000000000000000000000000000000000000000000000 0000001000000000 340,282,366,920,938,463,463,374,607,431,768,211,456 (3.4×10 38 ) Possible Addresses

7 Confidential McAfee Internal Use Only IPv6 Conventions – The Interfaces IPv6 Address types: –Loopback(::1) –Unicast (2000::/3 –Link-Local (FE80::/10) –Multicast (FF00::/8) –Anycast IPv6 Host Interface Requirements: –Loopback address –Link-local address –Unicast Address –All-nodes multicast address –Solicited-node multicast address Router requirements –All IPv6 Host Interface Requirements –Subnet-router anycast address –All-routers multicast address

8 Confidential McAfee Internal Use Only IPv6 Conventions – The Initial Allocations From: http://www.iana.org/assignments/ipv6-address-space: –2000::/3 (Global Unicast) –FC00::/7 (Unique Local Unicast) –FE80::/10 (Link Local Unicast) –FF00::/8 (Multicast) Current Allocation of Global Unicast addresses: 2001:0000::/23 IANA 2001:0200::/23 APNIC 2001:0400::/23 ARIN 2001:0600::/23 RIPE 2001:0800::/23 RIPE 2001:0A00::/23 RIPE 2001:0C00::/23 APNIC 2001:0E00::/23 APNIC 2001:1200::/23 LACNIC 2001:1400::/23 RIPE 2001:1600::/23 RIPE 2001:1800::/23 ARIN 2001:1A00::/23 RIPE 2001:1C00::/22 RIPE 2001:2000::/20 RIPE 2001:3000::/21 RIPE 2001:3800::/22 RIPE 2001:3C00::/22 RESERVED 2001:4000::/23 RIPE 2001:4200::/23 AfriNIC 2001:4400::/23 APNIC 2001:4600::/23 RIPE 2001:4800::/23 ARIN 2001:4A00::/23 RIPE 2001:4C00::/23 RIPE 2001:5000::/20 RIPE 2001:8000::/19 APNIC 2001:A000::/20 APNIC 2001:B000::/20 APNIC 2002:0000::/16 6to4 2003:0000::/18 RIPE 2400:0000::/12 APNIC 2600:0000::/12 ARIN 2610:0000::/23 ARIN 2620:0000::/23 ARIN 2800:0000::/12 LACNIC 2A00:0000::/12 RIPE 2C00:0000::/12 AfriNIC

9 Confidential McAfee Internal Use Only Changes from IPv4 to IPv6 NAT goes away Network address configuration becomes automatic (-ish) Broadcast traffic goes away ARP goes away IP packet format changes to lower overhead on routers Packet fragmentation goes away Better address allocation to lower BGP overhead on the Internet’s core routers

10 Confidential McAfee Internal Use Only September 9, 2015McAfee Firewall Enterprise Sales Presentation10 Agenda Very brief overview of McAfee + Secure Computing IPv6 Overview McAfee Firewall Enterprise (Sidewinder) McAfee Web (SmartFilter) McAfee TrustedSource/URL Database McAfee Web Merge Tool Questions / Comments

11 Confidential McAfee Internal Use Only SECURE COMPUTING CONFIDENTIAL 11 Wednesday, September 09, 2015Wednesday, September 09, 2015Wednesday, September 09, 2015Wednesday, September 09, 2015Wednesday, September 09, 2015Wednesday, September 09, 2015Wednesday, September 09, 2015Wednesday, September 09, 2015Wednesday, September 09, 2015 Commonly understood IPv6 Requirements Which requirements apply to McAfee Firewall Enterprise –Section 2 (“Baseline Requirements”) –Section 3.6 (“Security Device Requirements”) Our read on the requirements –Security devices do not have to meet the requirements in end-node, router or host systems –No transition requirements in the Security Device section Status –First support for IPv6 was complete and implemented at a customer site in March of 2008 using a “dual stack” approach. –JITC certification has been achieved for McAfee Firewall v7.0.1 platform in Jan 2009: http://jitc.fhu.disa.mil/apl/ipv6.html –See next slides for details

12 Confidential McAfee Internal Use Only General IPv6 functionality SECURE COMPUTING CONFIDENTIAL12 Wednesday, September 09, 2015 Sidewinder currently supports IPv6! IPv6 currently supported for stateful inspection rules, DNS, ICMP, DHCP. Sidewinder rules can be written using source or destination addresses based on IPv4, IPv6 or both – allowing for flexible deployment 3 different modes for interface configuration (static, stateless autoconfig, stateful autoconfig)

13 Confidential McAfee Internal Use Only Information Assurance Device Requirements SECURE COMPUTING CONFIDENTIAL13 Wednesday, September 09, 2015 RequirementResponse RFC 1981:Path MTU Discovery for IPv6Compliant RFC 2460:Internet Protocol v6 (IPv6) SpecificationCompliant RFC 2461:Neighbor Discovery for IPv6Compliant RFC 2464: IPv6 Stateless Address Auto- Configuration or RFC 3315 Dynamic Host Configuration Compliant RFC 2462:IPv6 Stateless Address Auto- Configuration (Section 5.5) Compliant RFC 4007:IPv6 ScopedAddress ArchitectureCompliant RFC 4193:Unique Local IPv6UnicastAddressesCompliant

14 Confidential McAfee Internal Use Only Information Assurance Device Requirements (cont) SECURE COMPUTING CONFIDENTIAL14 Wednesday, September 09, 2015 RequirementResponse RFC 4291:IP Version 6 Addressing Architecture Compliant RFC4443:Internet Control Message Protocol (ICMPv6) Compliant RFC 2710:Multicast Listener Discovery (MLD) for IPv6 Compliant RFC 2710:Transmission of IPv6 Packets over Ethernet Networks Compliant RFC4213:Basic Transition Mechanisms for IPv6 Hosts and Routers (Dual Stack) Compliant

15 Confidential McAfee Internal Use Only IPv6 Security Requirements for VPN SECURE COMPUTING CONFIDENTIAL15 Wednesday, September 09, 2015 Requirement : : Response All nodes MUST supportIPsecEncapsulating Security Payload (ESP) with 3DESCBC/AES128CBC/SHA1 transforms as defined in the following RFCS:  RFC 4301, Security Architecture for the Internet Protocol  RFC 4303, IP Encapsulating Security Payload (ESP)  RFC 4305, (ESP and AH) Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH) Compliant (2H 2009) RFC 4308: Cryptographic Suites forIPsecCompliant (2H 2009) RFC 4309: Using Advanced Encryption Standard (AES) CCM Mode withIPsecEncapsulating Security Payload (ESP) Compliant (2H 2009)

16 Confidential McAfee Internal Use Only IPv6 Security Requirements for VPN (cont) 16 Wednesday, September 09, 2015 RequirementResponse All nodes MUST support manual keying Compliant(2H 2009) All nodes SHOULD support Authentication Header (AH). All AH implementations MUST support SHA1 as defined in:  RFC 4302, IP Authentication Header (AH)  RFC 4305, (ESP and AH) Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH) Compliant (2H 2009) If a security device must distribute IP Security Policy information to other devices, it SHOULD also implement:  RFC 3585,IPsecConfiguration Policy Information Model  RFC 3586, IP Security Policy Requirements Compliant (2H2009)

17 Confidential McAfee Internal Use Only IPv6 Security Requirements for VPN (cont) SECURE COMPUTING CONFIDENTIAL17 Wednesday, September 09, 2015 RequirementResponse All nodes SHOULD support automatic key management and exchange as defined in:  RFC 4304, Extended Sequence Number (ESN) Addendum to IPsecDomain of Interpretation (DOI) for Internet Security Association and Key Management Protocol (ISAKMP)  RFC 4306: (ISAKMPSEC) Internet Key Exchange (IKEv2) Protocol  RFC 4307: Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2) Compliant (2H 2009) Nodes needing to maintain interoperability with current/legacy support Internet Key Exchange (IKE) SHOULD support IKE original version by supporting the following algorithms  RFC 2407, The Internet IP Security Domain of Interpretation for ISAKMP  RFC 2408, Internet Security Association and Key Management Protocol  RFC 2409, The Internet Key Exchange (IKE)  RFC 4109, Algorithms for Internet Key Exchange Version 1 (IKEv1) Compliant

18 Confidential McAfee Internal Use Only Configuring IPv6 on Sidewinder IPv6 has three different methods of configuring an Interface 1)Static Address Configuration Set an IP address and prefix length by hand on the interface. 2)Stateless Automatic Configuration (SLA) Routers supply prefix and prefix length on the subnet Actual IPv6 address is based on prefix and EUI-64 version of MAC address Hosts are responsible for executing Duplicate Address Detection (DAD) protocol before using an IP address Network services such as DNS and NTP are reached via well known multicast groups 3)Stateful Automatic Configuration Routers supply prefix and prefix length on the subnet DHCPv6 servers are contacted via multicast IP addresses are assigned by the DHCPv6 server September 9, 2015McAfee Firewall Enterprise Sales Presentation18

19 Confidential McAfee Internal Use Only September 9, 2015McAfee Firewall Enterprise Sales Presentation19 Agenda Very brief overview of McAfee + Secure Computing IPv6 Overview McAfee Firewall Enterprise (Sidewinder) McAfee Web (SmartFilter) McAfee TrustedSource/URL Database McAfee Web Merge Tool Questions / Comments

20 Confidential McAfee Internal Use Only McAfee SmartFilter brief overview September 9, 201520 SmartFilter is a URL content filter currently supported on multiple platforms, including the Sidewinder Firewall platform SmartFilter running on the Sidewinder platform is a native implementation, meaning that all functionality present in the standalone software versions are also available on the Sidewinder platform SmartFilter leverages a world class URL database which categorizes URL content based on a pre-defined set of categories.

21 Confidential McAfee Internal Use Only September 9, 2015McAfee Firewall Enterprise Sales Presentation21 Agenda Very brief overview of McAfee + Secure Computing IPv6 Overview McAfee Firewall Enterprise (Sidewinder) McAfee Web (SmartFilter) McAfee TrustedSource/URL Database McAfee Web Merge Tool Questions / Comments

22 Confidential McAfee Internal Use Only TrustedSource / URL Database SECURE COMPUTING CONFIDENTIAL22 Wednesday, September 09, 2015 It’s more than just a URL Filtering Database! McAfee® TrustedSource™ is a global threat correlation engine and intelligence base of global messaging and communication behavior, including reputation, volume, and trends, including email, web traffic and malware. Trusted Source has integrated the URL Filtering categorizations and use other information gathered from different threat vectors to enhance our ability to accurately categorize sites. The additional knowledge provided by TrustedSource™ data enables appliances and services to more accurately filter communications and protect electronic communications and transactions between people, companies and countries. McAfee® TrustedSource™ researchers work to ensure the safety and security of all Internet communications from the firewall to the PDA, sharpening the intelligence gathering and applications.

23 Confidential McAfee Internal Use Only September 9, 2015McAfee Firewall Enterprise Sales Presentation23 Agenda Very brief overview of McAfee + Secure Computing IPv6 Overview McAfee Firewall Enterprise (Sidewinder) McAfee Web (SmartFilter) McAfee TrustedSource McAfee Web Merge Tool Questions / Comments

Download ppt "May 17, 2009 McAfee Security and IPv6 David LePage Enterprise Solutions Architect – Network Security Business Unit, McAfee."

Similar presentations

Introduction to IPv6 Network & Application Passakon Prathombutr Next Generation Internet (NGI) National Electronics and Computer Technology Center.

Introduction to IPv6 Network & Application Passakon Prathombutr Next Generation Internet (NGI) National Electronics and Computer Technology Center.
Future Directions For IP Architectures Ipv6 Cs686 Sadik Gokhan Caglar.

Future Directions For IP Architectures Ipv6 Cs686 Sadik Gokhan Caglar.
© 2007 – 2010, Cisco Systems, Inc. All rights reserved. Cisco Public IPv6 Intro – Part 1 1 IPv6 Intro Part 1: Overview and Addressing Basics.

© 2007 – 2010, Cisco Systems, Inc. All rights reserved. Cisco Public IPv6 Intro – Part 1 1 IPv6 Intro Part 1: Overview and Addressing Basics.
Transitioning to IPv6 April 15,2005 Presented By: Richard Moore PBS Enterprise Technology.

Transitioning to IPv6 April 15,2005 Presented By: Richard Moore PBS Enterprise Technology.
Computer Networks20-1 Chapter 20. Network Layer: Internet Protocol 20.1 Internetworking 20.2 IPv4 20.3 IPv6.

Computer Networks20-1 Chapter 20. Network Layer: Internet Protocol 20.1 Internetworking 20.2 IPv IPv6.
1 IPv6. 2 Problem: 32-bit address space will be completely allocated by 2008. Solution: Design a new IP with a larger address space, called the IP version.

1 IPv6. 2 Problem: 32-bit address space will be completely allocated by Solution: Design a new IP with a larger address space, called the IP version.
IPv6 Addressing. Agenda OSI & TCP/IP Model IPv4 Addressing IPv6 Addressing.

IPv6 Addressing. Agenda OSI & TCP/IP Model IPv4 Addressing IPv6 Addressing.
IPv6 Victor T. Norman.

IPv6 Victor T. Norman.
© 2006 Cisco Systems, Inc. All rights reserved.IP6FD v2.0—2-1 IPv6 Operations Defining and Configuring Neighbor Discovery.

© 2006 Cisco Systems, Inc. All rights reserved.IP6FD v2.0—2-1 IPv6 Operations Defining and Configuring Neighbor Discovery.
Implementing IPv6 Module B 8: Implementing IPv6

Implementing IPv6 Module B 8: Implementing IPv6
© 2007 Cisco Systems, Inc. All rights reserved.ICND2 v1.0—7-1 Address Space Management Transitioning to IPv6.

© 2007 Cisco Systems, Inc. All rights reserved.ICND2 v1.0—7-1 Address Space Management Transitioning to IPv6.
© 2008 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 1 Introduction to IPv4 Introduction to Networks.

© 2008 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 1 Introduction to IPv4 Introduction to Networks.
IPv4 vs. IPv6 Anne-Marie Ethier Andrei Iotici This report was prepared for Professor L. Orozco- Barbosa in partial fulfillment of the requirements for.

IPv4 vs. IPv6 Anne-Marie Ethier Andrei Iotici "This report was prepared for Professor L. Orozco- Barbosa in partial fulfillment of the requirements for.
1 Internet Protocol Version 6 (IPv6) What the caterpillar calls the end of the world, nature calls a butterfly. - Anonymous.

1 Internet Protocol Version 6 (IPv6) What the caterpillar calls the end of the world, nature calls a butterfly. - Anonymous.
IP Version 6 Next generation IP Prof. P Venkataram ECE Dept. IISc.

IP Version 6 Next generation IP Prof. P Venkataram ECE Dept. IISc.
IPv6 Network Security.

IPv6 Network Security.
2: Comparing IPv4 and IPv6 Rick Graziani Cabrillo College

2: Comparing IPv4 and IPv6 Rick Graziani Cabrillo College
Understanding Internet Protocol

Understanding Internet Protocol
Chapter 8b Intro to Routing & Switching.  Upon completion of this chapter, you should be able to:  Describe the structure of an IPv4 address.  Describe.

Chapter 8b Intro to Routing & Switching.  Upon completion of this chapter, you should be able to:  Describe the structure of an IPv4 address.  Describe.
1 IP Security Outline of the session –IP Security Overview –IP Security Architecture –Key Management Based on slides by Dr. Lawrie Brown of the Australian.

1 IP Security Outline of the session –IP Security Overview –IP Security Architecture –Key Management Based on slides by Dr. Lawrie Brown of the Australian.

Similar presentations

Ads by Google