Subject: [bmwg] Review and action items from NGFW draft discussion

From: <[email-masked]>
Date: Mon, 2 Aug 2021 13:54:54 -0400

Sarah et al.

Below is a summary of the results of our discussions at the IETF 111 BMWG
meeting. You will need to access the slides for the proper context. The
slides can be found at:

https://datatracker.ietf.org/meeting/111/materials/slides-111-bmwg-benchmark
ing-methodology-for-network-security-device-performance-00

After the meeting, It now appears Sarah has three items to provide text for
- items 5, 6 and 9. Once we receive the proposed text for those items,
assuming we are all in agreement, we will be able to produce another draft.
Sarah, if possible, we would like to start working on the next version of
the draft on August 9th with a goal of posting it around August 15th.  Let
me know if that timeframe works for you. We have several other changes we
have to make as well.

Thanks in advance.

Brian

1.	Authors' Proposal: Define Next-generation firewall (NGFW) as: "This
term is widely used for the modern, state-of-the-art technology firewalls
(as of 2021) that can do application-level traffic inspection including
several, sometimes optional features."

Accepted.

2.	Authors' Proposal: Update list of security features that security
devices can have; describe that security devices must be configured in
in-line mode.

Accepted.

3.	Authors' Poposal: Clarify that passive security devices are out of
scope; explain more clearly that devices must be configured in "fail close"
mode.

Accepted.

4.	Authors' Proposal: No change to draft.

Authors' accepted suggestion that notes be added to the draft to clarify
testbed setup.

5.	Authors' Proposal: No change to draft.

Sarah to come back with proposed text.

6.	Authors' Proposal: No change to draft.

This is related to the above item and will be addressed by Sarah at the same
time.

7.	Comment withdrawn.

8.	Authors' Proposal: Explicitly remove IDS from scope..

Accepted.

9.	Authors' Proposal: No change to draft..

Sarah to come back with feedback and proposed text..

10.	Comment withdrawn.

11.	Authors' Proposal: Modify 7.1.1, 2nd paragraph, 1st sentence: "Based
on customer use case, users can choose the relevant application traffic mix
for this test. The details about the traffic mix MUST be documented in the
report. At least the following traffic mix details MUST be documented and
reported together with the test results.

Accepted.

---------

Brian Monkman

Executive Director, NetSecOPEN

Office: +1-717-610-0808 

Fax: +1-717-506-0460

Mobile: +1-717-462-5422

 <https://www.netsecopen.org> https://www.netsecopen.org

---

From: Sarah Banks <[email-masked]>
Date: Wed, 11 Aug 2021 09:39:58 -0700

Hi all,
   I have a few action items, which I'm following up on below.

Thanks
Sarah

Item 5:
No proposed text at this time - I accept what's written currently. 

Item 6: 
Same as above; no proposed text at this time - I accept what's written here.

(I read this originally on my phone, which perhaps broke the formatting in some odd way - reading the draft on my Mac, i see that the emulated routers are not some external function, but rather, part of the test tool (well, if they support it) and that makes sense.)

Item 9: 
I really like the specificity of the options here, and propose we continue using this text as written, since the original reply to my comment was that the vendors as authors confirm their tools expose/share this information already. I apologize that this wasn't made clear at IETF111.

> On Aug 2, 2021, at 10:54 AM, [email-masked] wrote:
> 
> Sarah et al.
>  
> Below is a summary of the results of our discussions at the IETF 111 BMWG meeting. You will need to access the slides for the proper context. The slides can be found at:
>  
> https://datatracker.ietf.org/meeting/111/materials/slides-111-bmwg-benchmarking-methodology-for-network-security-device-performance-00 <https://datatracker.ietf.org/meeting/111/materials/slides-111-bmwg-benchmarking-methodology-for-network-security-device-performance-00>
>  
> After the meeting, It now appears Sarah has three items to provide text for – items 5, 6 and 9. Once we receive the proposed text for those items, assuming we are all in agreement, we will be able to produce another draft.  Sarah, if possible, we would like to start working on the next version of the draft on August 9th with a goal of posting it around August 15th.  Let me know if that timeframe works for you. We have several other changes we have to make as well.
>  
> Thanks in advance.
>  
> Brian
>  
> Authors‘ Proposal: Define Next-generation firewall (NGFW) as: “This term is widely used for the modern, state-of-the-art technology firewalls (as of 2021) that can do application-level traffic inspection including several, sometimes optional features.”
>  
> Accepted.
>  
> Authors‘ Proposal: Update list of security features that security devices can have; describe that security devices must be configured in in-line mode.
>  
> Accepted.
>  
> Authors‘ Poposal: Clarify that passive security devices are out of scope; explain more clearly that devices must be configured in „fail close“ mode.
>  
> Accepted.
>  
> Authors‘ Proposal: No change to draft.
>  
> Authors’ accepted suggestion that notes be added to the draft to clarify testbed setup.
>  
> Authors‘ Proposal: No change to draft.
>  
> Authors‘ Proposal: No change to draft.
>  
> This is related to the above item and will be addressed by Sarah at the same time.
>  
> Comment withdrawn.
>  
> Authors‘ Proposal: Explicitly remove IDS from scope..
>  
> Accepted.
>  
> Authors’ Proposal: No change to draft..
>  
> Comment withdrawn.
> Authors’ Proposal: Modify 7.1.1, 2nd paragraph, 1st sentence: “Based on customer use case, users can choose the relevant application traffic mix for this test. The details about the traffic mix MUST be documented in the report. At least the following traffic mix details MUST be documented and reported together with the test results.
>  
> Accepted.
>  
>  
> ---------
> Brian Monkman
> https://www.netsecopen.org <https://www.netsecopen.org/>