[ipv6-wg] [v6ops] Extension Headers / Impact on Security Devices

On 6/18/2015 3:00 PM, Gert Doering wrote:
> Hi,
>
> On Wed, Jun 17, 2015 at 04:46:03PM +0000, Fred Baker (fred) wrote:
>> Tell me this. Would you be happier if the fragmentation rule said that the first fragment had to contain the entire IPv6 header, plus the transport layer header (for ACL support)? I think Fernando would support such a statement (I think I have "heard" him make such a statement).

It makes sense to require all of the HBH and routing headers in the 
first fragment.

The rest is impossible to mandate and irrelevant. Anything that looks 
far enough into a packet to need to find the transport header might be 
looking several layers of encapsulation in; that's acting as an 
endpoint, and ought to reassemble the packet at that point.

Joe