In reply to peter mckenzie.

Hi Peter, Thanks so much. All very good questions. Yes, no NATs will be needed with a complete IPv6 deployment and that will enable devices to connect directly to the internet. NATs are not responsible for security though. There is a nice blog on the Internet Society which talks about NAT, IPv6 and security as well. And yes, IPv6 has a few gaps and cannot prevent attacks on layers above the network layer in the network protocol stack which include brute -force attacks and password guessing attacks on authentication modules. Spoofing IPv6 addresses is as easy as spoofing IPv4 addresses (assuming that IPsec Authentication Header [AH] is not used in either of the protocol families). The mitigation technique is also identical: bogon filters (dropping obviously wrong source/destination addresses) and unicast reverse path forwarding checks. As the address space of IPv6 is larger, a purely random source address has a small probability of having a recognized prefix and hence a high probability of being dropped by the first router. While I don’t consider myself a security expert, you can visit Cisco Security Solutions for Service Providers to see the companies full portfolio of solutions. For further information, you can watch Cisco security experts on the public Security and IoT webinar.