We are considering enabling ipv6 on our webservers, so that we are reachable with both ipv4 and ipv6. Are there any security issues we should consider when enabling ipv6?
IPv6 Attacks With Strong IPv4 Similarities:
IPv4 and IPv6 dual stack (as you mentioned):
Many sites use private addressing inside their network, and the router runs NAT so that outgoing connections are feasible. The NAT thing implies, by construction, the same effect than a firewall which would prevent any incoming connection from the outer world to one of the machines in the inner network.
When you enable IPv6, inner machines become externally visible. So you'd better setup baseline filtering rules on the firewall before enabling IPv6. Think about an unpatched old Windows system, full of remotely exploitable holes, which was harmless as long as it simply sat in the inner network without doing any network activity with the Internet at large (e.g. a workstation used only to connect to some intranet).
This is not really IPv6's fault. It is that IPv6 was designed so that there is no address shortage, making NAT unnecessary. I believe that most security issues which will occur with IPv6 deployment will follow that pattern: IPv6 nullifies the "inherent firewall" effect of NAT, uncovering many vulnerable hosts. To some extent, this is the same story than the advent of WiFi, which nullifies the inherent physical security of plain wires.
I ran across a recent paper on the subject: CPNI VIEWPOINT - SECURITY IMPLICATIONS OF IPv6 - MARCH 2011. The main points it makes are risks shared by many new technologies:
So before deploying IPv6, you should take the time to become familiar with the technology, work with savvy suppliers, and have a plan to address these issues.
The report goes into a bit more discussion of e.g. the NAT-free option.
Sounds like a good market developing out there for IPv6-savvy security folks. (As if there weren't other opportunities out there....)