Subject: [bmwg] NGFW Security Features Text

From: Timothy Carlin <[email-masked]>
Date: Tue, 2 Jun 2020 12:44:51 -0400

Hi all,

I wanted to mention that I have read draft-ietf-bmwg-ngfw-performance-03
and I support it.

I have additional text I would like to suggest be included to help to
clarify an ambiguity with regards to security feature processing.
Specifically, in the case that a DUT discontinues processing a security
feature (for example, SSL Inspection), traffic should still be processed by
the remainder of the applicable security features.  Said another way, the
traffic should NOT "fail open".

Here is some proposed text to add to Section 4.2, in the itemized list as
the 2nd item (below "All security inspection enabled"):

==
* All applicable traffic MUST be processed by the configured security
feature(s) in table 1.  In the case that applicable traffic can no longer
be processed for a given security feature (e.g. due to processing or
throughput limits, etc.), the portion of traffic which exceeds the limit
SHOULD be blocked and this MAY be configurable.
==

Please let us know if you have any questions or comments.

Best Regards,
Tim C.
UNH-IOL

---

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Tue, 2 Jun 2020 22:25:42 +0000

Hi Tim,

Thanks for doing your volunteer work with this review, much appreciated!

May I make a small suggestion on your proposed text?
I think we achieve some clarity if we add “limit” near the end:

s/ this MAY be configurable../ this limit MAY be configurable./

assuming that’s what you meant!

thanks again and regards,
Al

From: bmwg [mailto:[email-masked]] On Behalf Of Timothy Carlin
Sent: Tuesday, June 2, 2020 12:45 PM
To: [email-masked]
Subject: [bmwg] NGFW Security Features Text

Hi all,

I wanted to mention that I have read draft-ietf-bmwg-ngfw-performance-03 and I support it.

I have additional text I would like to suggest be included to help to clarify an ambiguity with regards to security feature processing.  Specifically, in the case that a DUT discontinues processing a security feature (for example, SSL Inspection), traffic should still be processed by the remainder of the applicable security features.  Said another way, the traffic should NOT "fail open".

Here is some proposed text to add to Section 4.2, in the itemized list as the 2nd item (below "All security inspection enabled"):

==
* All applicable traffic MUST be processed by the configured security feature(s) in table 1.  In the case that applicable traffic can no longer be processed for a given security feature (e.g. due to processing or throughput limits, etc.), the portion of traffic which exceeds the limit SHOULD be blocked and this MAY be configurable..
==

Best Regards,
Tim C.
UNH-IOL

---

From: Timothy Carlin <[email-masked]>
Date: Wed, 3 Jun 2020 08:52:21 -0400

Hi Al,

Thank you for the consideration and review of the text.  I agree with your
suggestion, that seems like a helpful addition!

I also wanted to add that this review follows from testing NGFW products,
and overall the draft seems solid in that context.

Thanks again,
Tim

On Tue, Jun 2, 2020 at 6:25 PM MORTON, ALFRED C (AL) <[email-masked]>
wrote:

> *From:* bmwg [mailto:[email-masked]] *On Behalf Of *Timothy Carlin
> *Sent:* Tuesday, June 2, 2020 12:45 PM
> *To:* [email-masked]
> *Subject:* [bmwg] NGFW Security Features Text
>
>
>
> Hi all,
>
>
>
> SHOULD be blocked and this MAY be configurable..
>
> ==
>
>
>