Subject: Re: [Ecrit]EmergencyContextRoutingofInternetTechnologies-ArchitectureConsiderations

From: "Stastny Richard" <[email-masked]>
Date: Mon, 12 Sep 2005 17:13:09 +0200

Maybe I do not understand the problem with VPNs fully,
but IMHO if you use a VPN you must first attach to the local
network to get the local IP connection to set up the VPN.
Doing so you get an IP address via DHCP and you also may
get the location. Now you have the location stored somewhere 
on the device.
 
If you now set up the VPN, you get a new IP address from home
network, but you still have the location stored and can retrieve it.
 
There is only one requirement left for the home network: you need 
an access to the mapping database and you also need to be able to
set up a SIP connection to the PSAP, even if the home networks
does not allow general access to the Internet.

I do not see a security problem here.
 
Richard

________________________________

Von: [email-masked] im Auftrag von John Rosenberg
Gesendet: Mo 12.09.2005 16:28
An: John Schnizlein; Henning Schulzrinne
Cc: ECRIT
Betreff: Re:[Ecrit]EmergencyContextRoutingofInternetTechnologies-ArchitectureConsiderations

Have to agree with John here. As one data point, our own corporate VPN does
not allow split tunneling, and our IT folks are *very* clear that even
connecting a PC that's on the VPN to another network (e.g. the public
internet) is prohibited. I would think that this is the rule rather than
the exception.

John

At 09:21 AM 9/10/2005, John Schnizlein wrote:
 >
 >A valid reason for organizations that deploy Internet VPNs to prohibit
 >split tunneling, with some traffic through the VPN tunnel and some
 >straight to Internet destinations, is control of the corporate network
 >perimeter.  A host with split tunneling is exposed to worms and other
 >security threats through its access outside the VPN.  Because it is
 >also inside the VPN, this host is a disease vector between the outside
 >and inside.
 >
 >It would be a serious mistake to force a choice between this valid
 >deployment of VPN technology and location information access for
 >emergency services.
 >
 >John
 >
 >On Sep 9, 2005, at 8:44 PM, Henning Schulzrinne wrote:
 >>
 >> At least some of the VPN software can be configured not to route
 >> "random" (non-corporate) Internet addresses via the VPN at all. This
 >> makes some sense - there is little benefit of visiting the web page of
 >> some outfit by tromboning or hairpinning (to use the PSTN equivalents)
 >> via the corporate campus. Maybe such configurations will become more
 >> common, given these difficulties (or OS will support the ability to
 >> select the non-VPN interface explicitly when opening a socket.)
 >>

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: John Schnizlein <[email-masked]>
Date: Mon, 12 Sep 2005 12:27:18 -0400

Richard,

If the design for obtaining and providing location information is as 
you summarized, there is no problem with VPNs.  We should note that VPN 
clients should not disturb the location option that the client received 
from its initial DHCP request.  I  don't know if they are careful about 
that while they update options such as domain suffix and DNS-server 
addresses.

The problem with VPNs is for designs such as HELD that assume the IP 
address of the host enables determination of the location.  When it was 
pointed out that the host's IP address is assigned by the enterprise 
end of the VPN tunnel, which is potentially very far from the 
tele-worker, a proposal was made that the host use its original (not 
tunnel) address when attempting an emergency call.  It is the implied 
need for split-tunnel that exposes the original IP source address that 
leads to the security problem: host both inside and outside the 
enterprise security perimeter.

John