Subject: [Rtg-dt-encap-considerations] ACL text

From: Erik Nordmark <[email-masked]>
Date: Thu, 05 Mar 2015 14:00:18 -0800

The current text in section 18.1.1 is
    Seems useful to be able to have ACL entries that can filter out the
    encapsulated packets on some ports, e.g., to now allow the UDP
    destination port number used by a new encapsulation from Internet-
    facing ports.

I suggest we replace that with this text at the end of section 11.1 
(Security Considerations: Anti-spoofing):
    Separately and in addition to such filtering, there might be a 
desire to completely block an encapsulation protocol at certain places 
in the network, e.g., at the edge of a datacenter. Using a fixed 
standard UDP destination port number for each encapsulation protocol 
would facilitate such blocking.

    Erik