Subject: RE: [midcom] MIDCOM SEmantics: Policy Rule Content

From: "Sanjoy Sen"<[email-masked]>
Date: Thu, 4 Apr 2002 20:00:01 -0600

I was just trying to point out that there may be situations where the Midcom
Agent may not have complete knowledge of application endpoint addresses and
would be forced to open a range of pinholes. 

> -----Original Message-----
> From: Jiri Kuthan [mailto:[email-masked]]
> Sent: Thursday, April 04, 2002 7:01 PM
> To: Sen, Sanjoy [NGC:B692:EXCH]; Taylor, Tom-PT [CAR:B800:EXCH];
> [email-masked]
> Cc: Aoun, Cedric [QPD:MA01:EXCH]
> Subject: RE: [midcom] MIDCOM SEmantics: Policy Rule Content
> 
> 
> At 01:46 AM 4/5/2002, Sanjoy Sen wrote:
> 
> >Jiri, 
> >  Why wouldn't a network/firewall administration application 
> be able to use the same Midcom protocol for opening/closing 
> firewall pinholes? Nothing in the charter says that this out 
> of scope. 
> 
> Sanjoy,
> 
> I think simplicity is good. If we focus on the issues which are indeed
> compelling we will have good chances to come out with a 
> usable protocol.
> Building a management protocol is not precluded in charter, but it is
> neither stated there. That makes me think that management 
> protocols are
> better discussed in a BOF in the management area.
> 
> >Also, what you're suggesting may be too retrictive. I can't 
> possibly assume that all NAT's & firewalls will be 
> Midcom-enabled at the same time. So there might be a 
> situation where a Midcom agent would like to open pinhole in 
> a firewall which is sandwitched between two NAT's which are 
> not Midcom-aware. The Agent doesn't have any idea about the 
> exact NAT binds that will be used on both sides of the FW but 
> knows about the range of possible binds. There'll be overlap 
> in this case between rulesets of agents controlling the firewall.
> 
> Well, I'm not sure whether we want to align midcom protocol 
> design to such
> cumbersome scenarios. If so, it should be probably documented in the
> Midcom Scenarios I-D.
> 
> -Jiri
>

---

From: "Cullen Jennings" <[email-masked]>
Date: Thu, 4 Apr 2002 19:37:16 -0800

When setting up existing firewalls, people often use a list of rules that
either allow or disallow a packet or do nothing and just go to the next rule
on the list. This would lean towards a priority list of rules approach.

When setting up NAT style holes - the idea that a hole that is allocated to
one person could just be appropriated and given to someone else seems very
disturbing. This leans to a first come first severed approach.

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom