Subject: [midcom] Some thoughts on Policy Rule Contents

From: Martin Stiemerling <[email-masked]>
Date: Mon, 15 Apr 2002 11:08:10 +0200

Hi folks,

I have seen a lot of emails concerning the policy rule conflict 
resolution and for me the discussion looks like a sponge, i.e. there are 
so many topics which are mixing everything and you actually can't grip 
it anymore. The mix is of:
- mixing NAT binding allocation with packet filter rule allocation or 
what behaviour do the people assume at all in their examples
- mixing policy rule conflict resolution and allowance of installing 
policy rules

A proposal for solving the policy rule conflict:
- the midcom server processes incoming request from agents on a first 
come first server base
- the detection of conflicts (if any) is up to the middle box, out of 
our scope.
- the midcom server simply reports any failure in installing the rule to 
the agent with an appropriate reason (e.g. too many wildcarding, rule 
conflicts, rule rejected)

Otherwise the discussion can continue the discussion to infinity. 
Because packet filters and NATs can be configured in multiple ways and 
you can't think about all possible configurations and combination of 
them at all (I'm eager to present nasty rule combinations to everyone 
who is interested).

Regards
Martin

-- 
Martin Stiemerling

NEC Europe Ltd. -- Network Laboratories  [email-masked]
IPv4: http://www.ccrle.nec.de  IPv6: http://www.ipv6.ccrle.nec.de

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom