Subject: [Mip6] question on the draft [firewalls]

From: "杨申" <[email-masked]>
Date: Fri, 4 Mar 2005 16:04:56 +0800

Hi:
   I read your new version of draft, and have some questions on it, I hope
you can make me clear.

Issue 2 in section 5.3:  
"If the firewall(s) protecting the Home Agent block
 unsolicited incoming traffic (e.g.  as stateful inspection packet
 filters do), the firewall(s) may drop connection set up requests
 from CN, and packets from MN."

=>I think it is just the firewalls' function to block insecure connection from external node.If CN could pass connection set up requests, which the firewall is configured to refuse, through the firewall, a successful attack occurs.

Issue 3 in section 5.2: (as well as issue 3 in section 5.3, which has the same problem)
"Let's assume that the Binding Update to the CN is
 successful.  The CN may be protected by different firewalls and as
 a result of the MN's change of IP address, incoming and outgoing
 traffic may pass through a different firewall.  The new firewall
 may not have any state associated with the CN and incoming
 (potentially outgoing traffic) may be dropped at the firewall."

=>Assume a fixed network protected by more than one firewalls, A is an internal node and B is an external node. Maybe, the connection requests sent from A to B pass through firewall#1 and the replies sent from B to A pass through firewall#2, so the replies will be blocked, but it is not the fact. I just want to say, if an administrator protects his network with many firewalls, there should be mechanism for firewalls to update each others,otherwise the network could not work smoothly even without MIPv6.

My opinion is the issues related are not introduced by MIPv6, considerring them will complicate the protocol.

Regards
yang shen

　　　　　　　　[email-masked]
　　　　　　　　　　2005-03-04
_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6