What are the most important security considerations when configuring your LAN switching network for IPv6?

1 Address spoofing and filtering

One of the main security threats in IPv6 networks is address spoofing, which is when an attacker pretends to have a legitimate IPv6 address to bypass authentication or access controls. Address spoofing can lead to denial of service, man-in-the-middle, or data theft attacks. To prevent address spoofing, you need to filter the incoming and outgoing traffic on your LAN switches, and verify the source and destination addresses of each packet. You can use access control lists (ACLs) or firewall rules to filter the traffic based on the IPv6 header fields, such as source and destination addresses, hop limit, or extension headers. You can also use Secure Neighbor Discovery (SEND) protocol, which uses cryptographic mechanisms to authenticate the IPv6 addresses of the neighboring nodes.

3 IPv6 transition mechanisms and tunneling

IPv6 transition mechanisms are methods that allow IPv6 and IPv4 networks to coexist and interoperate during the migration process. Some of the common transition mechanisms are dual-stack, tunneling, and translation. Tunneling is a technique that encapsulates IPv6 packets within IPv4 packets, and vice versa, to cross different network domains. However, tunneling can also pose security risks, such as bypassing security policies, hiding malicious traffic, or creating performance issues. To secure your LAN switching network from tunneling threats, you need to monitor and control the tunnel endpoints, and apply the same security policies and measures to the tunneled traffic as to the native traffic. You can use tools such as IPsec, which provides encryption and authentication for the tunnel packets, or Intrusion Detection and Prevention Systems (IDPS), which detect and block anomalous or malicious traffic patterns.

5 IPv6 privacy and encryption

IPv6 privacy is a concern that relates to the protection of your identity and data from unauthorized access or tracking. IPv6 addresses can reveal information about your network topology, location, device type, or activity patterns. Moreover, IPv6 traffic can be intercepted, modified, or stolen by attackers or eavesdroppers. To enhance your IPv6 privacy and encryption, you need to use techniques that mask or randomize your IPv6 addresses, and encrypt your data in transit and at rest. You can use Privacy Extensions for Stateless Address Autoconfiguration (SLAAC), which generate temporary and random IPv6 addresses for your hosts, or Cryptographically Generated Addresses (CGAs), which derive IPv6 addresses from public keys. You can also use IPsec or Transport Layer Security (TLS) protocols, which provide end-to-end encryption and authentication for your IPv6 traffic.

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?