Subject: (NAT) RSIP : Flexibility of tunneling method...

From: Carmelo Zaccone <[email-masked]>
Date: Wed, 26 May 1999 18:24:11 +0200

Hello all,

	I need some clarifications on the following sentences of the RSIP
framework document:

	On the tunnel use and establishement section on page 6 it is written:

	      "While it is possible to imagine an RSIP
	      implementation that does not require tunneling, it seems that
	      tunneling is a flexible method for solving address ambiguity
	      problems."
		
	I don't really see what is the address ambiguity problem and why
tunneling 
	is a flexible method for it.

	      "There is a disadvantage to not using a tunnel between the RSIP
	      client and the RSIP server.  It is likely that an RSIP server
will
	      also act as a firewall or packet filter for the private network.
	      In this case, it publically addressed packets are transmitted on
	      the private network, the RSIP server may consider these packets
	      tobe part of an attack."

	I don't see why avoiding tunneling is not a good idea.
	I don't understand why publically addressed packet may be considered as
an attack.

		I assume the authors talk about attacks coming from the Internet:

		In the case of traffic coming from the Internet and destined to a
public IP 
		address which is in (because the ISP will not route to us other IPs)
the RSIP 
		pool (the set of available public IP), using tunneling to forward the
traffic 
		to the host is not a way to avoid attack.

		Indeed, if the traffic arrive at the border router, in RSIP if the
traffic is
		destined to an IP address currently assigned to a host, the RSIP
server will determine
		the tunnel to use and then tunnel the traffic. If that traffic was a
junk traffic, it 
		will also be forwarded anyway I think.

		If no tunneling was used and assuming that a route towards the host
was available the 
		traffic will be also forwarded.

		So here there is no difference

		On the other hand, if that traffic was destined to an IP address not
currently 
		assigned to a host, the RSIP server will not forward it (because there
is no tunnel).
	
		If no tunneling was used and no route (because the IP is still not
assigned) towards 
		the host was available the traffic will also be not be forwarded.

		So here again, there is no difference

		Even if the RSIP server is configured to run a firewall, this firewall
will have to 
		be configured to not discard packet with as destination IP address one
of the pool
		because otherwise RSIP server will not have anything to forward.
		So here again, tunneling is not of any help to avoid attacks.

	Could someone help me on this ?

		Thanks in advance

			Regards,
	
			Zaccone Carmelo
-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.