Subject: Re: (NAT) RSIP : Flexibility of tunneling method...

From: "Mike Borella" <[email-masked]>
Date: Wed, 26 May 1999 17:02:33 -0500

Hi Carmelo,

We never claim that tunneling prevents external attacks (or any other
kind of an attack).  Tunneling will, however, make it easier for RSIP to
operate with legacy firewall code and policy such that packets that are sent
by RSIP clients do not have external (public) addresses in their outer headers.

We'll work on the wording of this for the next version.  Thanks for the input.

-Mike

Carmelo Zaccone <[email-masked]> on 05/26/99 11:24:11 AM

Please respond to Carmelo Zaccone <[email-masked]>

Sent by:  Carmelo Zaccone <[email-masked]>

To:   [email-masked]
cc:    (Mike Borella/MW/US/3Com)
Subject:  (NAT) RSIP : Flexibility of tunneling method...

     Hello all,

     I need some clarifications on the following sentences of the RSIP
framework document:

     On the tunnel use and establishement section on page 6 it is written:

           "While it is possible to imagine an RSIP
           implementation that does not require tunneling, it seems that
           tunneling is a flexible method for solving address ambiguity
           problems."

     I don't really see what is the address ambiguity problem and why
tunneling
     is a flexible method for it.

           "There is a disadvantage to not using a tunnel between the RSIP
           client and the RSIP server.  It is likely that an RSIP server
will
           also act as a firewall or packet filter for the private network.
           In this case, it publically addressed packets are transmitted on
           the private network, the RSIP server may consider these packets
           tobe part of an attack."

     I don't see why avoiding tunneling is not a good idea.
     I don't understand why publically addressed packet may be considered as
an attack.

          I assume the authors talk about attacks coming from the Internet:

          In the case of traffic coming from the Internet and destined to a
public IP
          address which is in (because the ISP will not route to us other IPs)
the RSIP
          pool (the set of available public IP), using tunneling to forward the
traffic
          to the host is not a way to avoid attack.

          Indeed, if the traffic arrive at the border router, in RSIP if the
traffic is
          destined to an IP address currently assigned to a host, the RSIP
server will determine
          the tunnel to use and then tunnel the traffic. If that traffic was a
junk traffic, it
          will also be forwarded anyway I think.

          If no tunneling was used and assuming that a route towards the host
was available the
          traffic will be also forwarded.

          So here there is no difference

          On the other hand, if that traffic was destined to an IP address not
currently
          assigned to a host, the RSIP server will not forward it (because there
is no tunnel).

          If no tunneling was used and no route (because the IP is still not
assigned) towards
          the host was available the traffic will also be not be forwarded.

          So here again, there is no difference

          Even if the RSIP server is configured to run a firewall, this firewall
will have to
          be configured to not discard packet with as destination IP address one
of the pool
          because otherwise RSIP server will not have anything to forward.
          So here again, tunneling is not of any help to avoid attacks.

     Could someone help me on this ?

          Thanks in advance

               Regards,

               Zaccone Carmelo
-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.

-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.

---

From: Carmelo Zaccone <[email-masked]>
Date: Fri, 28 May 1999 10:33:56 +0200

Carmelo Zaccone wrote:
 
         Hello Mike,
 
 Mike Borella wrote:
 > kind of an attack).
 
Ok.
 
 >Tunneling will, however, make it easier for RSIP to
 
However, could you extend some more on the reasons which make RSIP
server 's
live more easier using tunneling with the RSIP client ?
 
Because I don't really see any inconvenience of enabling the host to
send
packets with a globally adresses IP header, assuming that our network
may
correclty route them towards the good destination (the Internet for
outboundtraffic and a particular host for inbound traffic).
 
I thinks that using globally addressed IP header in the network do not
insert
potential disadvantages concerning security issues. Because if a host
would like to
send junk packets onto the network there is not difference if this one
create its
headers using private or global IP addresses.
Internal traffics with public or private IP addresses may be
consideredat the
same level concerning their 'legacy' or 'junk' aspect at internal
router.
 
Assuming now that this junk traffic is exchanged with the Internet, ifwe
have
firewalling on the exit points of the network, if those firewalls are
configured like :
      For outbound traffic, only accept to forward packets with
                - source IP addresses : IP addresses from the global
pool
                                       (potentially with the filter set
to only accept
                                       the currently assigned IP
addresses)
                         and
                - destination IP addresses : whatever public IP
addresses but
                                            not from the global pool
 
     For inbound traffic, only accept to receive packets with
                - source IP addresses : whatever public IP addresses but
                                       not from the global pool
                - destination IP addresses : IP addresses from the
global pool.
                                            (potentially with a filter
to only accept the
                                            currently assigned IP
addresses but however here
                                            this is not really required
as anyway if an IP
                                            address is not currently
assigned, there will
                                            be no routes towards it)
 
there will be no objection to authorise the use of globally addressed
packet inside the
private network.
 
                         Carmelo
-