Subject: RE: [Nea] Commentsregardingdraft-khosravi-nea-requirements-01.txt Part 1

From: "Blumenthal, Uri" <[email-masked]>
Date: Mon, 10 Jul 2006 17:10:50 -0400

>>> [#1] In the abstract it says: "NEA provides owners of networks
>>> (e.g. an enterprise offering remote access) a mechanism to learn
>>> the operational state or posture of a system requesting network
>>> access and then apply this knowledge to the network admission
>>> decision.  Why call out "an enterprise offering remote access"?
>>> Couldn't this capability be used by enterprise and service
>>> (and all) providers alike over wired and wireless networks?
>>
>> It could and should be used by all of the above.
>
>Specific to the above comment, I don't see how everything is the same
>for "providers" - as opposed to enterprises, providers don't own and
>control the end devices.

Correct - providers don't "own" the end devices. And I don't think that
"normal" ISP "should" look into postures or attempt to enforce any
policy on "normal" customers. (What ISP does wrt. Intranet access - is
rather different.)

>Providers have the desire to protect their network, but it
>can't be done by assessing or remediating end devices
>that attach to it, since they don't own those end devices. 

Correct. "Normal" providers would just connect the end devices, without
checking posture or enforcing policy (which they don't have). In that
case posture verification and remediation is likely to take place when
the end device attempts to connect (via VPN?) to the Intranet (after
being successfully connected to Internet via ISP who did not run NEA).

Some providers could act as "hired extensions of enterprise" - providing
(no pun intended) direct Intranet access, plus authentication and
enforcement that come with it. Next step in enterprises outsourcing
their network management. In this case provider itself will run NEA on
behalf of the contracting enterprise.

>The end devices are owned by the customer of that service (either
>an end user or an enterprise). 

In some cases the enterprise is also the provider, in other cases
enterprise hires a provider, and in some cases provider has nothing to
do with enterprises.

_______________________________________________
Nea mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nea