1 / 23

McAfee Security and IPv6

McAfee Security and IPv6. David LePage Enterprise Solutions Architect – Network Security Business Unit, McAfee. Agenda. Very brief overview of McAfee + Secure Computing IPv6 Overview McAfee Firewall Enterprise (Sidewinder) McAfee Web (SmartFilter) McAfee TrustedSource/URL Database

shiri
Download Presentation

McAfee Security and IPv6

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. McAfee Security and IPv6 David LePage Enterprise Solutions Architect – Network Security Business Unit, McAfee

  2. Agenda • Very brief overview of McAfee + Secure Computing • IPv6 Overview • McAfee Firewall Enterprise (Sidewinder) • McAfee Web (SmartFilter) • McAfee TrustedSource/URL Database • McAfee Web Merge Tool • Questions / Comments McAfee Firewall Enterprise Sales Presentation

  3. Agenda • Very brief overview of McAfee + Secure Computing • IPv6 Overview • McAfee Firewall Enterprise (Sidewinder) • McAfee Web (SmartFilter) • McAfee TrustedSource • McAfee Web Merge Tool • Questions / Comments McAfee Firewall Enterprise Sales Presentation

  4. Did You Know? McAfee Network Security Stats: • >$500M+ Revenue and growing at 20+% • Over 600 dedicated development staff • 250 threat researchers in 23 countries • Over 22,000 customers • Over 400,000 Appliances in service • Over 2500 Network Security partners Recognized Product Line Leadership Core to McAfee’s Total Security Strategy Complete Protection, Fastest Time to Confidence Title of presentation

  5. Agenda • Very brief overview of McAfee + Secure Computing • IPv6 Overview • McAfee Firewall Enterprise (Sidewinder) • McAfee Web (SmartFilter) • McAfee TrustedSource/URL Database • McAfee Web Merge Tool • Questions / Comments McAfee Firewall Enterprise Sales Presentation

  6. IPv6 Overview A Primary reason for the existence of IPv6 is address depletion in IPv4: IPv4 = 32 bit addresses 111.1.1.200 = 110111100000001000000011101111 4,294,967,296 (4.29 x 109) Possible Addresses IPv6 = 128 bit addresses fd4c:4547:4f53:111::200 = 11111101010011000100010101000111010011110101001100000001000100010000000000000000000000000000000000000000000000000000001000000000 340,282,366,920,938,463,463,374,607,431,768,211,456 (3.4×1038) Possible Addresses

  7. IPv6 Conventions – The Interfaces • IPv6 Address types: • Loopback(::1) • Unicast (2000::/3 • Link-Local (FE80::/10) • Multicast (FF00::/8) • Anycast • IPv6 Host Interface Requirements: • Loopback address • Link-local address • Unicast Address • All-nodes multicast address • Solicited-node multicast address • Router requirements • All IPv6 Host Interface Requirements • Subnet-router anycast address • All-routers multicast address

  8. IPv6 Conventions – The Initial Allocations • From: http://www.iana.org/assignments/ipv6-address-space: • 2000::/3 (Global Unicast) • FC00::/7 (Unique Local Unicast) • FE80::/10 (Link Local Unicast) • FF00::/8 (Multicast) • Current Allocation of Global Unicast addresses:

  9. Changes from IPv4 to IPv6 • NAT goes away • Network address configuration becomes automatic (-ish) • Broadcast traffic goes away • ARP goes away • IP packet format changes to lower overhead on routers • Packet fragmentation goes away • Better address allocation to lower BGP overhead on the Internet’s core routers

  10. Agenda • Very brief overview of McAfee + Secure Computing • IPv6 Overview • McAfee Firewall Enterprise (Sidewinder) • McAfee Web (SmartFilter) • McAfee TrustedSource/URL Database • McAfee Web Merge Tool • Questions / Comments McAfee Firewall Enterprise Sales Presentation

  11. Commonly understood IPv6 Requirements • Which requirements apply to McAfee Firewall Enterprise • Section 2 (“Baseline Requirements”) • Section 3.6 (“Security Device Requirements”) • Our read on the requirements • Security devices do not have to meet the requirements in end-node, router or host systems • No transition requirements in the Security Device section • Status • First support for IPv6 was complete and implemented at a customer site in March of 2008 using a “dual stack” approach. • JITC certification has been achieved for McAfee Firewall v7.0.1 platform in Jan 2009: http://jitc.fhu.disa.mil/apl/ipv6.html • See next slides for details SECURE COMPUTING CONFIDENTIAL

  12. General IPv6 functionality • Sidewinder currently supports IPv6! • IPv6 currently supported for stateful inspection rules, DNS, ICMP, • DHCP. • Sidewinder rules can be written using source or destination addresses based on IPv4, IPv6 or both – allowing for flexible deployment • 3 different modes for interface configuration (static, stateless autoconfig, stateful autoconfig) SECURE COMPUTING CONFIDENTIAL

  13. Information Assurance Device Requirements Requirement Response RFC 1981 : Path MTU Discovery for IPv6 Compliant RFC 2460 : Internet Protocol v6 (IPv6) Specification Compliant RFC 2461 : Neighbor Discovery for IPv6 Compliant RFC 2464 : IPv6 Stateless Address Auto - Configuration or RFC 3315 Dynamic Host Compliant Configuration RFC 2462 : IPv6 Stateless Address Auto - Compliant Configuration (Section 5.5) RFC 4007: IPv6 Scoped Address Architecture Compliant RFC 4193: Unique Local IPv6 Unicast Addresses Compliant SECURE COMPUTING CONFIDENTIAL

  14. Information Assurance Device Requirements (cont) Requirement Response RFC 4291 : IP Version 6 Addressing Compliant Architecture RFC 4443 :Internet Control Message Compliant Protocol (ICMPv6) RFC 2710 : Multicast Listener Compliant Discovery (MLD) for IPv6 RFC 2710 : Transmission of IPv6 Compliant Packets over Ethernet Networks RFC 4213: Basic Transition Compliant Mechanisms for IPv6 Hosts and Routers (Dual Stack) SECURE COMPUTING CONFIDENTIAL

  15. IPv6 Security Requirements for VPN Requirement Response Requirement All nodes MUST support IPsec Encapsulating Security Compliant (2H 2009) Payload (ESP) with 3DESCBC/AES128CBC/SHA1 : transforms as defined in the following RFCS: RFC 4301, Security Architecture for the Internet § Protocol : RFC 4303, IP Encapsulating Security Payload § (ESP) RFC 4305, (ESP and AH) Cryptographic Algorithm § Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH) RFC 4308: Cryptographic Suites for IPsec Compliant (2H 2009) RFC 4309: Using Advanced Encryption Standard Compliant (2H 2009) (AES) CCM Mode with IPsec Encapsulating Security Payload (ESP) SECURE COMPUTING CONFIDENTIAL

  16. IPv6 Security Requirements for VPN (cont) Requirement Response All nodes MUST support manual keying Compliant (2H 2009) All nodes SHOULD support Authentication Header Compliant (2H 2009) (AH). All AH implementations MUST support SHA1 as defined in: § RFC 4302, IP Authentication Header (AH) § RFC 4305, (ESP and AH) Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH) If a security device must distribute IP Security Policy Compliant (2H 2009) information to other devices, it SHOULD also implement: § RFC 3585, IPsec Configuration Policy Information Model § RFC 3586, IP Security Policy Requirements

  17. IPv6 Security Requirements for VPN (cont) Requirement Response All nodes SHOULD support automatic key management and exchange Compliant (2H 2009) as defined in: RFC 4304, Extended Sequence Number (ESN) Addendum to § IPsec Domain of Interpretation (DOI) for Internet Security Association and Key Management Protocol (ISAKMP) RFC 4306: (ISAKMPSEC) Internet Key Exchange (IKEv2) Protocol § RFC 4307: Cryptographic Algorithms for Use in the Internet Key § Exchange Version 2 (IKEv2) Nodes needing to maintain interoperability with current/legacy support Compliant Internet Key Exchange (IKE) SHOULD support IKE original version by supporting the following algorithms RFC 2407, The Internet IP Security Domain of Interpretation for § ISAKMP RFC 2408, Internet Security Association and Key Management § Protocol RFC 2409, The Internet Key Exchange (IKE) § RFC 4109, Algorithms for Internet Key Exchange Version 1 (IKEv1) § SECURE COMPUTING CONFIDENTIAL

  18. Configuring IPv6 on Sidewinder • IPv6 has three different methods of configuring an Interface • Static Address Configuration • Set an IP address and prefix length by hand on the interface. • Stateless Automatic Configuration (SLA) • Routers supply prefix and prefix length on the subnet • Actual IPv6 address is based on prefix and EUI-64 version of MAC address • Hosts are responsible for executing Duplicate Address Detection (DAD) protocol before using an IP address • Network services such as DNS and NTP are reached via well known multicast groups • Stateful Automatic Configuration • Routers supply prefix and prefix length on the subnet • DHCPv6 servers are contacted via multicast • IP addresses are assigned by the DHCPv6 server McAfee Firewall Enterprise Sales Presentation

  19. Agenda • Very brief overview of McAfee + Secure Computing • IPv6 Overview • McAfee Firewall Enterprise (Sidewinder) • McAfee Web (SmartFilter) • McAfee TrustedSource/URL Database • McAfee Web Merge Tool • Questions / Comments McAfee Firewall Enterprise Sales Presentation

  20. McAfee SmartFilter brief overview • SmartFilter is a URL content filter currently supported on multiple platforms, • including the Sidewinder Firewall platform • SmartFilter running on the Sidewinder platform is a native implementation, • meaning that all functionality present in the standalone software versions are • also available on the Sidewinder platform • SmartFilter leverages a world class URL database which categorizes URL • content based on a pre-defined set of categories. 20 April 1, 2014

  21. Agenda • Very brief overview of McAfee + Secure Computing • IPv6 Overview • McAfee Firewall Enterprise (Sidewinder) • McAfee Web (SmartFilter) • McAfee TrustedSource/URL Database • McAfee Web Merge Tool • Questions / Comments McAfee Firewall Enterprise Sales Presentation

  22. TrustedSource / URL Database • It’s more than just a URL Filtering Database! • McAfee® TrustedSource™ is a global threat correlation engine and intelligence base of global messaging and communication behavior, including reputation, volume, and trends, including email, web traffic and malware. • Trusted Source has integrated the URL Filtering categorizations and use other information gathered from different threat vectors to enhance our ability to accurately categorize sites. • The additional knowledge provided by TrustedSource™ data enables appliances and services to more accurately filter communications and protect electronic communications and transactions between people, companies and countries. • McAfee® TrustedSource™ researchers work to ensure the safety and security of all Internet communications from the firewall to the PDA, sharpening the intelligence gathering and applications. SECURE COMPUTING CONFIDENTIAL

  23. Agenda • Very brief overview of McAfee + Secure Computing • IPv6 Overview • McAfee Firewall Enterprise (Sidewinder) • McAfee Web (SmartFilter) • McAfee TrustedSource • McAfee Web Merge Tool • Questions / Comments McAfee Firewall Enterprise Sales Presentation

More Related