Enabling IPv6 in Microsoft Windows-based Firewalls
Most of the settings available in the basic Windows Firewall are IP-agnostic, so filtering rules apply equally to IPv4 and IPv6. This has been the case since the Windows Firewall became IPv6-aware in Windows XP Service Pack 2. Even in Windows Firewall with Advanced Security, most filtering rules are still either port-oriented (specified IP ports) or application-oriented (specified applications that use those ports).
The predefined Inbound and Outbound Rules are IP-agnostic by default. Only Scope Settings made when configuring custom Inbound or Outbound Rules will be IP-protocol specific (specified IPv4 or IPv6 addresses or address ranges in the Scope Settings tab). Making Scope Settings in different Microsoft Windows versions is done as follows:
XP is shown here,
XP SP2 and SP3 is shown here,
Vista is shown here,
Windows 7 is shown here,
Windows 8/8.1 is shown here,
and Windows 10/11 is shown here and here.
Documentation for Scope Settings in different Microsoft Windows versions is available as follows:
XP SP2 and SP3 is available here,
Vista, Server 2008, Windows 7, and Server 2008 R2 is available here,
Windows Server 2012 is available here, and
Windows Server 2016 (and later) and Windows 8 (and later) is available here.
Disabling IPv6 in Microsoft Windows-based Firewalls
Rather than disabling IPv6 in the firewall (for the few individual custom Inbound or Outbound Rules that may have been configured as IP-protocol specific), it is a better practice to selectively disable it in the operating system. See the “Disabling IPv6 in Microsoft Windows” article for the appropriate version of Windows in the IP Transport section.
TIC Initiative History
The Trusted Internet Connection (TIC) Initiative, was announced in 2007 by Office of Management and Budget (OMB) memorandum M-08-05 and updated in 2009 by OMB memorandum M-09-32. A TIC Reference Architecture Document, Version 2.2, was released in June 2017. This document is applicable to all United States (US) Federal government civilian agencies, but particularly to those acting as TIC Access Providers (TICAPs) -- agencies responsible for managing their TIC internet access point's physical location and corresponding security capabilities, and those which have been designated as Multi-Service TICAPs -- agencies providing services to other agencies through a shared services model. The process for an agency to be designated as a Multi-Service TICAP by completing a TIC Statement of Capability (SOC) Form is set forth in this attachment to OMB memorandum M-08-16. All network connections external to an agency are to be monitored by a Department of Homeland Security (DHS) National Cyber Protection System (NCPS) sensor, operationally known as an EINSTEIN Enclave.
In Sept 2019 OMB Memorandum M-19-26 announced an update to the TIC Initiative called “TIC 3.0”. In accordance with OMB memorandum M-17-26 Reducing Burden for Federal Agencies by Rescinding and Modifying OMB Memoranda, June 2017, earlier memoranda related to the TIC Initiative (M-08-05, M-08-16 and M-08-27, and M-09-32) were rescinded by the OMB. Also, a new home page was established for the TIC Initiative (authentication required).
Rather than requiring agencies to employ only physical TIC access points, they may now use alternative security controls identified by TIC Use Cases contained in Appendix A of M-19-26 and Hybrid Identity Solutions Guidance, Mar, 2024.
In 2024, the DHS Cybersecurity and Infrastructure Security Agency (CISA) released updated Guidance Documents for TIC 3.0. The core Guidance Documents are available here, and guidance for their use is available here. A TIC 3.0 Frequently Asked Questions is available here. In Jan 2022, the DHS CISA released an IPv6 Considerations for TIC 3.0 document. In Dec 2023, the DHS CISA Cybersecurity Division released a TIC 3.0 Cloud Use Case document.
The CISA also released a 2-volume NCPS Cloud Interface Reference Architecture (CIRA) describing requirements for data sharing at TIC access points in cloud computing environments. The CIRA is in 2 volumes:
Volume 1 – General Guidance, May 2021, provides an overview of changes to enable NCPS to share data
with TIC 3.0, and
Volume 2 – Reporting Pattern Catalog, June 2021 draft, provides details for vendor-specific changes to enable
data sharing.
In Aug 2020, the National Institute of Standards and Technology (NIST) released Special Publication (SP) 800-207 Zero Trust Architecture (ZTA) document. Section 6 of that document discusses other Federal policies and programs including the TIC 3.0 Initiative and the older DHS EINSTEIN Program, and how the NIST ZTA complements them.
Available Managed Trusted Internet Protocol Services Providers
The General Services Administration (GSA) authorized, or will authorize pending TIC Initiative certification, multiple Networx and Enterprise Infrastructure Solutions (EIS) vendors to be Managed Trusted Internet Protocol Services (MTIPS) providers. The alignment of MTIPS with the TIC Initiative is described by this GSA web page. The list of vendors authorized to be MTIPS providers that are accessible via Internet Protocol version 6 (IPv6) is available here. MTIPS are available as a separate managed security service, or as part of an agency’s specific statement of work directly with the vendor. GSA has also provided answers to Networx IPv6 Frequently Asked Questions.
(Note: The GSA is in the midst of an EIS acquisition. The Networx contract (and others) are transitioning to EIS. See this GSA web page describing the on-going multi-year transition.)
Additional United States Government Requirements for IPv6
US government organizations' requirements for IPv6 as part of the TIC Initiative are specified in:
- Critical Capabilities line item TM.TC.03 of the TIC 3.0 Core Guidance Volume 2: Reference Architecture,
- paragraph C.2.3.1.2 Standards of an EIS Statement of Work (SOW) (see sample SOW here), and
- paragraph C.2.4.1.5.1.2 Standards, item 29, of a Networx SOW (see sample SOW here).
The requirements of the Federal Acquisition Regulations as amended Dec, 2009 (described in the IPv6 Boiler Plate Acquisitions Language article in the Deployment section) apply. Verify that connectivity via IPv6 to the MTIPS provider’s locations is available from the geographic locations included in your IPv6 deployment effort.
Firewall configuration guidance for specific manufacturers and specific open-source software may be found in the Security section of the IPv6 Knowledge Base. For commercial products, the manufacturer’s website provides guidance. For open source-software, the developer’s website provides guidance.
While not specific to any one manufacturer or software developer, this 2016 Firewall Best Practices publication contains detailed guidance for configuring packet filtering for common protocols.
The Grand European Academic NeTwork (Géant) project documented many Network Monitoring recommendations. An example is this Campus Network IPv6 and Firewalling document.
These two publications while dated are still good general references on things to do (and to avoid) when configuring firewalls:
The National Institute of Standards and Technology (NIST) published SP800-41 Rev. 1, Guidelines on Firewalls and Firewall Policies, offering security principles and guidance for configuration of firewalls (IP agnostic guidelines with limited guidance specifically for IPv6). Other NIST Special Publications (SP) on security are publicly available here.
The National Security Agency (NSA) Systems and Network Attack Center (SNAC) published Firewall Design Considerations for IPv6 offering design and security guidance to protect IPv6 networks. Other NSA Security Configuration Guides are available here (hover over the word "LIBRARY" in the row of keywords at the top of the screen to see other available subject areas). Older NSA Security Configuration Guides are archived here .
Router configuration guidance for specific manufacturers may be found in the IP Transport section of the IPv6 Knowledge Base. For commercial products, the manufacturer’s web site provides guidance.
In 2022, the National Security Agency (NSA) published Network Infrastructure Security Guidance providing comprehensive general guidance for several aspects of network security, including router configuration. In 2020, the NSA also published guidance for Hardening Network Devices to reduce the risk of unauthorized access into a network’s infrastructure.
The next two publications are earlier general references on things to do (and to avoid) when configuring routers. While dated, they are still useful references. The NSA Systems and Network Attack Center (SNAC) published a supplement to an earlier NSA Router Security Configuration Guide offering security principles and guidance for configuration of IPv6 routers, with detailed instructions for Cisco Systems routers.
Other NSA Security Configuration Guides are available here (hover over the word "LIBRARY" in the row of keywords at the top of the screen to see other subject areas). Older NSA Security Configuration Guides are archived here.
Introduction
This two part article focuses on procedures and best practices recommended for use by IPv6 network administrators and security managers, and by organizations and individuals deploying and subsequently using Internet of Things (IoT) devices in order to monitor, detect, and prevent unauthorized attempts to use networks and the devices connected to them:
Part 1: Best Practices for IPv6 Computer Security, Network Security and Cybersecurity, and
Part 2: Best Practices for Secure IoT Devices Deployment and Use.
(Note: A best practices document describes actions or practices that are known to produce good outcomes when followed.)
For more in-depth information on IPv6 security, several books are listed in part 3 of the IPv6 Training Information file referenced in the IPv6 Training and Learning article in the Deployment section. In addition, this article provides a comprehensive overview of best practices to establish and maintain security for other risk management areas of information technology (IT).
Network security and deployment and the subsequent use of IoT devices have been the subject of numerous Internet Engineering Task Force (IETF) Request For Comments (RFC) documents, including:
- RFC 4057 IPv6 Enterprise Network Scenarios,
- RFC 4301 Security Architecture for the Internet Protocol,
- RFC 4942 IPv6 Transition/Coexistence Security Considerations,
- RFC 6418 Multiple Interfaces and Provisioning Domains Problem Statement,
- RFC 7368 IPv6 Home Networking Architecture Principles,
- RFC 7381 Enterprise IPv6 Deployment Guidelines,
- RFC 7452 Architectural Considerations in Smart Object Networking,
- RFC 7548 Management of Networks with Constrained Devices,
- RFC 7556 Multiple Provisioning Domain Architecture,
- RFC 8043 Source-Address-Dependent Routing and Source Address Selection for IPv6 Hosts,
- RFC 8576 Internet of Things (IoT) Security: State of the Art and Challenges,
- RFC 8801 Discovering Provisioning Domain Names and Data,
- RFC 9006 TCF Usage Guidance in the Internet of Things (IoT),
- IETF draft document Secure IoT Bootstrapping: A Survey,
- RFC 9019 A Firmware Update Architecture for Internet of Things,
- RFC 9099 Operational Security Considerations for IPv6 Networks (which complements RFC 4942)
- RFC 9124 A Manifest Information Model for Firmware Updates to Internet of Things (IoT) devices
- RFC 9288 Recommendations on the Filtering of IPv6 Packets Containing Extension Headers at Transit Routers, and
- RFC 9334 Remote ATtestation procedureS (RATS) Architecture.
Part 1. Best Practices for IPv6 Computer Security, Network Security, and Cybersecurity
There are no easy or quick solutions when changing the security infrastructure of any network that currently supports Internet Protocol version 4 (IPv4)-only to either supporting dual-stack (IPv4 and IPv6 are both supported) or IPv6-only.
Specific examples, general recommendations, and limited product information to deploy IPv6 in an existing network or to transition to an IPv6-only network are provided by the following articles, reports, papers, tutorials, presentations and websites
- Cybersecurity and Infrastructure Security Agency (CISA) Alert AA22-137A Weak Security Controls and Practices Routinely Exploited for Initial Access, May, 2022
- CISA Cybersecurity Best Practices, best practices for various cybersecurity risk areas, a continuing series
- CISA Free Cybersecurity Services and Tools, a list of free services and tools, a continuing series
- The National Security Agency (NSA) Network Infrastructure Security Guidance PP-22-066, Mar 2022, covers many aspects of network security, including IPv6, while IPv6 Security Guidance PP-22-1805, Jan, 2023, only covers IPv6
- NSA and CISA Critical Infrastructure Partnership Advisory Council (CIPAC) Enduring Security Framework (ESF) Identify and Access Management: Recommended Best Practices for Administrators PP-23-0248_508C, Mar, 2023
- SP800-119 Guidelines for the Secure Deployment of IPv6, Dec, 2010, published by National Institute for Standards and Technology (NIST)
- Internet Society (ISOC) IPv6 Security Frequently Asked Questions (FAQ)
- MITRE Corporation, 11 Strategies of a World-Class Cybersecurity Operations Center, 2022
- ERNW Security and Privacy for Multi-Prefix and Provisioning Domains in IPv6 presentation, 2018, and video
- IPv6 Vulnerability Testing, Penetration Testing, and Vulnerability Remediation article in the Security section
- Presentations presented annually at various conferences by Cisco Systems, Inc. (for example: APNIC, Apricot, and Cisco Live 365), entitled “IPv6 Security Threats and Mitigations”. (Search the web for Cisco and the title, including the quote marks.)
- Canadian Internet Registration Authority (CIRA) internal IPv6 Policy document, July, 2011
- Infoblox Best Practices for IPv6 Security webinar
- Although written for the home and small office network, the recommendations described in the Security section of the Deploying IPv6 in the Home and Small Office/Home Office article in the Deployment section also apply when administering user systems in the workplace
- IoT Acceleration Consortium IoT Security Guidelines Ver. 1.0, Jul, 2016
- Cyber Security Division, Commerce and Information Policy Bureau, Ministry of Economy, Trade, and Industry, Japan IoT Security Safety Framework, Nov, 2020
- IPv6 Deployments, a presentation to the Réseaux IP Européens Network (RIPE), 2010
- Federal IPv6 Interagency Working Group presentation, 2013, provides suggestions for mitigating IPv6 security issues.
- IPv6 Security Best Practices by Cisco Systems, Inc., 2013
- Monolith Software blog entry, 2013, provides some best practice tips for monitoring any network
- Grand European Academic NeTwork (Géant) project documented many Network Monitoring recommendations. An example is this Practical IPv6 Monitoring on Campus Best Practice document, 2013, describing a way to monitor a dual-stack network using a combination of SNMP and Netflow
- IPv6 Security (2008), IPv6 Security, 2011, and IPv6 Attacks and Countermeasures, 2013, presentations from the Rocky Mountain IPv6 Task Force (RMv6TF).
- Master Thesis: IPv6 Security Test Laboratory, 2013, Johannes Weber (see “Countermeasures & Firewall’s Best Practices” sections)
- A collection of guides, best practices, checklists, benchmarks, tools, and other resources describing the steps to harden numerous commercial and opensource operating systems against a wide variety of attacks are available on this github project webpage.
The following are older but still useful reports and papers:
- An IPv6 Security Guide for U.S. Government Agencies, published by Juniper Networks, Inc.
- IPv6 and IPv4 Threat Comparison and Best Practice paper from Cisco Systems, Inc.
- Secure IPv6 Operation: Lessons learned from 6NET report from the European IPv6 deployment. (The 6NET project completed Jun 2005, followed by the 6DISS project which completed Sept 2007; followed by 6DEPLOY and 6DEPLOY-2 (www.6deploy.eu) which completed Feb 2013. A more recent European IPv6 project was Governments Enabled with IPv6 (GEN6) which completed May 2015. Deliverables and Presentations under the Publications tab of the GEN6 website provide additional material.) The next European IPv6 project is IPv6 Framework for European Governments which completed 2018. Then came the European Union Internet Standards Deployment Monitoring project.
The following websites contain articles discussing procedures and practices that can monitor, detect, or prevent attempts to use networks in unauthorized ways:
- Many older publications specific to IPv6, such as Fundamental Filtering of IPv6 Network Traffic and Malware Tunneling in IPv6, are no longer available on the US_CERT site, but are available in the Homeland Security Digital Library. (Caution: The Digital Library contains millions of documents. Finding a specific document in the Digital Library requires patience.)
- While specific to the Department of Defense (DoD), the publicly available Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGS) include guidance for IPv6. They are available on this DISA website.
- An NSA Cybersecurity Advisory and Guidance ongoing document series is available on this website.
Part 2. Best Practices for Secure IoT Devices Deployment and Use
There are no easy or quick solutions when deploying and subsequently using IoT devices on any network,
Best practices for establishing and maintaining network security when deploying IoT device(s) on a network and subsequently using them have been the subject of documents by many different organizations and individuals.
Organizations provided recommendations and limited amounts of product and support services, information about deploying and subsequently using IoT devices in the following articles, reports, papers, presentations and websites:
- CISA Cybersecurity Best Practices For Industrial Control Systems (ICS), and ICS Recommended Practices, are growing lists of recommended best practices,
- Institute of Electrical and Electronic Engineers (IEEE) Internet of Things (IOT) Security Best Practices, 2017
- Réseaux IP Européens (RIPE) Network Coordination Centre (NCC) Architectural Considerations for IoT Device Security in the Home
- United Kingdom GOV.UK (Government Digital Service) Department for Digital, Culture, Media & Sport "Smart Devices", secure by design, a collection ongoing since 2018
- Internet of Things Security Foundation (IoTSF) Best Practice Guidelines, ongoing since 2017
- ISOC Online Trust Alliance (OTA) Best Practices: Enterprise IoT Security Checklist, 2018
- NIST Cybersecurity for IoT Program, ongoing since 2020
- This Microsoft Security Best Practices for Internet of Things article provides profiles of the companies to involve in the deployment of IoT devices
- Amazon Web Services Internet of Things (IOT) Security Best Practices article, 2019
- Hong Kong Computer Emergency Response Team (HKCERT) Coordination Center IOT Security Best Practices Guidelines, Jan, 2020
- IoT Acceleration Consortium IoT Security Guidelines Ver. 1.0, Jul, 2016
- Cyber Security Division, Commerce and Information Policy Bureau, Ministry of Economy, Trade, and Industry IoT Security Safety Framework, Nov, 2020
- SDxCentral What are Internet of Things (IoT) Security Best Practices?, 2020
- IoT Security Foundation website articles, ongoing since 2015
- IoT Security Initiative website articles, ongoing since 2018
- Industry IoT Consortium website articles, ongoing since 2014.
Individuals provided recommendations about deploying and subsequently using IoT devices in the following articles:
- Two articles IoT for System Tests:Checking for Failure and Internet of Things security challenges and best practices describe various security measures for use when deploying and subsequently using IoT device(s) on any network, while this article asks Best Practices for IoT Security, What Does That Even Mean? These articles cannot (nor indeed can any article) consider all aspects of such a multi-dimensional question.
- The title of this Here are 7 Actionable Tips to Secure Your Smart Home and IoT Devices article describes its contents.
- The title of this Ten best practices for securing the Internet of Things in your Organization article describes its contents.
- Some security recommendations and best practices for individuals deploying and subsequently using IoT devices are described in the Security section of the IPv6 in the Home and Small Office/Home Office (SOHO) article in the Deployment section.