Subject: RE: [Architecture-discuss] IP virtualisation

From: "Bound, Jim" <[email-masked]>
Date: Thu, 27 Oct 2005 19:07:08 -0400

But some are supporting and developing next gen nets that will restore
end-to-end as a plan and also the data below the IP header in the packet
could be encrypted end-to-end and thus as you state all any will see in
the path is the header.  This affects the entire issue of what is a
firewall and does it become a security manager for end-to-end.  So I
think adding this question to the list at some point may happen.  It
also makes a statement that those who want to control the Internet by
snooping and filtering are basically and potentially out of business for
some deployments, unless they find a new means to operate.

/jim 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of 
> Melinda Shore
> Sent: Thursday, October 27, 2005 2:51 PM
> To: Tony Li
> Cc: [email-masked]
> Subject: Re: [Architecture-discuss] IP virtualisation
> 
> On 10/27/05 1:38 PM, "Tony Li" <[email-masked]> wrote:
> > 3) Transparency - Tunneling creates an issue for firewalls, as
> > unintended traffic can be tunneled around the policy control points.
> 
> I'm a little sympathetic to that argument but not a lot sympathetic.
> I think what you're describing is a more general problem, that the
> destination address in the IP header no longer represents the
> endpoint and various things flow from that when we're using the
> address as basically a proxy for identity and therefore for
> policy enforcements of various types (including routing).  However,
> saying that it's a problem because the address is concealed from
> the firewall is an argument that can be used against encryption, as
> well, and in fact has been used against encryption.  But it seems
> to me that there's another question here about how much information
> needs to be exposed for basic network functions to work.
> 
> Melinda
> 
> _______________________________________________
> Architecture-discuss mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/architecture-discuss
> 

_______________________________________________
Architecture-discuss mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/architecture-discuss

---

From: "Bound, Jim" <[email-masked]>
Date: Thu, 27 Oct 2005 19:14:21 -0400

To add to Dino's question this gets to the current debate is the
intelligence for the network at the app, edge, or within the network or
at all three?  Service Oriented Architecture (SOA) true believers
support control at what we view as the App layer as IP personnel or IETF
people.  Intense debate goiung on in industry and other bodies.  Serious
and obvious vendor agendas appear immediately too and will probably here
too, as vendors try to expand there markets into other vendors
territory. But, I hope not.

Are we about to open pandora's box and should we stop now?  It could get
very ugly.

/jim 

> Dino Farinacci
> Sent: Thursday, October 27, 2005 2:52 PM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]; 
> [email-masked]
>     Just joined the list. Sorry for coming in late.
> 
> >> On Thu, Oct 27, 2005 10:38:01AM -0700, Tony Li allegedly wrote:
> >> > Speaking architecturally, tunneling is necessarily a 
> second class  
> >> > solution to any problem.  That's not to say that it's 
> without value,  
> >> > rather that when we have to resort to tunneling, we're 
> kludging and  
> >> > hacking and thus should be thinking about how to perform 
> whatever  
> >> > functionality we're trying to achieve in a native 
> manner, if at all  
> >> > possible.
> >> 
> >> I used to think exactly that before you yourself convinced me
> >> otherwise.
> 
>     Since tunneling allows transparency in the core, that 
> would seem to be
>     a fairly robust architectural principle with lots of value. 
> 
>     Or would most think the transparency is a bug and not a feature?
> 
>     And I would argue a lot of application value has come to 
> us over the years
>     because of "application-level tunneling" where if the 
> infrastructure
>     would have had to be upgraded to do these things, we may 
> have less cool
>     new apps these days.
> 
> Dino     
>

---

From: "Bound, Jim" <[email-masked]>
Date: Fri, 28 Oct 2005 10:53:44 -0400

Also if the only part of the packet exposed is the header it complicates
filtering and also Intrusion Detection is affected.
/jim 

> Tom-PT Taylor
> Sent: Friday, October 28, 2005 9:18 AM
> To: Joe Touch
> Seems to me we could clarify the architectural role of firewalls.  We 
> need to line up what information is available, where, and what 
> information is needed to do the job of protecting hosts.  
> There will be 
> a division of labour between network-based firewalls and host-based 
> firewalls.  What new information does the network have to pass on to 
> hosts so their firewalls can do their jobs?
> 
> Joe Touch wrote:
> > Hi, Tony,
> > 
> > 
> ...
> 
> > 
> > Tunneling around policy control points is a feature, not a 
> bug. It is
> > why tunneling is succeeding as a way to deploy new protocols
> > incrementally, and a way to experiment with protocols at 
> the application
> > layer.
> > 
> > Firewalls make the assumption that there is information 
> available at the
> > network layer that can be used to limit traffic, and that 
> routing will
> > direct traffic towards the firewall. Both of these 
> assumptions are the
> > real bug - as Aaron noted, encryption defeats packet 
> inspection moreso
> > than tunneling anyway.
> > 
> > Joe
> > 
> > 
> > 
> > 
> --------------------------------------------------------------
> ----------
> >