Guidelines for the Secure Deployment of IPv6. Recommendations of the National Institute of Standards and Technology

摘要

Due to the exhaustion of IPv4 (Internet Protocol version 4) address space, and the Office of Management and Budget (OMB)1 mandate that U.S. federal agencies begin to use the IPv6 (Internet Protocol version 6) protocol, NIST undertook the development of a guide to help educate federal agencies about the possible security risks during their initial IPv6 deployment. This document provides guidelines for organizations to aid in securely deploying IPv6. Since the majority of organizations will most likely run both IPv6 and IPv4 on their networks for the foreseeable future, this document speaks about the deployment of IPv6 rather than the transition to IPv6.2 The deployment of IPv6 can lead to new challenges and types of threats facing an organization. The goals of this document are: To educate the reader about IPv6 features and the security impacts of those features; To provide a comprehensive survey of mechanisms that can be used for the deployment of IPv6; To provide a suggested deployment strategy for moving to an IPv6 environment. The migration to IPv6 services is inevitable as the IPv4 address space is almost exhausted. IPv6 is not backwards compatible with IPv4, which means organizations will have to change their network infrastructure and systems to deploy IPv6. Organizations should begin now to understand the risks of deploying IPv6, as well as strategies to mitigate such risks. Detailed planning will enable an organization to navigate the process smoothly and securely.