Subject: RE: [NSIS] Security threats - NTLP awareness of upstream path

From: Tschofenig Hannes <[email-masked]>
Date: Mon, 3 Mar 2003 17:58:45 +0100

hi ruediger

please see my comment below:

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Geib,
> Ruediger
> Sent: Thursday, February 27, 2003 4:06 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: [NSIS] Security threats - NTLP awareness of upstream path
> 
> 
> Hi Hannes
>  
> | if you want to have end-to-end signaling then you also need to provide
> | end-to-end security. 
> 
> Allright. That coincides with the conclusions the last signaling 
> design team drew I was working with.
> 
> I've illustrated my end to end signaling scenario with an example
> in an earlier reply, but I'm happy to repeat it:
> 
> Lets assume a customer network with two
> sites, making a QoS reservation to be used for VoIP calls 
> accross a carrier network. To limit his backbone signaling 
> processing requirements the carrier may prefer to stay out 
> of per VoIP call signaling. So signaling aggregation is
> applied between his edge nodes. Let's ignore how that 
> is done with regard to QoS. With regard to signaling it
> means that the carrier routers only maintain state for a 
> single reservation between the two customer sites. Per 
> VoIP call NSIS state maintenance is restricted to the 
> customer domain. Still, all related NSIS signaling messages
> traverse the carrier network. Path coupled, meaning NSIS 
> path coupled (i.e. downstream and especially upstream).
> 
> The best solution to this would be one where neither the 
> carrier routers NSLP nor the NTLP must process the per VoIP 
> call NSIS signaling. 
i am also in favor of this approach. this requires a more functionality at
the discovery layer. 

i do not like a varient where nodes (ntlp or nslps) participate in the
signaling message exchange although they have nothing todo with the
particular signaling exchange. 

this would confirm more to the following approach:

NSLP                       NSLP
NTLP         carrier       NTLP
customer     network       customer
network			   network

the following approach which was also suggested in the past does not allow
your desired functionality: 

NSLP(y)           NSLP(x)           NSLP(y)
NTLP          NTLP      NTLP      NTLP
customer         carrier          customer
network          network          network

in this case the ntlp and possible the nslp nodes intercept the end-to-end
signaling messages. 
 
ciao
hannes

> 
> Regards, Rüdiger
> _______________________________________________
> nsis mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/nsis
> 
_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis