Subject: RE: Why Scopes? (was: Re: [saad] About saad)

From: "Michel Py" <[email-masked]>
Date: Fri, 17 Oct 2003 14:57:19 -0700

Melinda,

> Melinda Shore wrote:
> I've talked to a very large number of people about this
> (or rather why they use NATs, which is a slightly
> different question),

Indeed.

> and the most common reasons are:
> 1) don't want to buy more addresses
> 2) simplification of network management/renumbering
> 3) security/firewalling/unreachability

Yes. I just posted a more detailed analysis along the same lines.

> The reality is that some large number of users, including
> some users who consider themselves relatively expert
> (network administrators, etc.) don't want their hosts to
> be reachable by default but they do want them to be able
> to initiate connections themselves. I'm not sure there's
> a good answer to this question, since the users' wishes
> are incompatible with the IETF's working assumptions
> about reachability.

IMHO the answer to this is a firewall, not scoping. I just raised this
question: should scoping provide firewall features or not? IMHO no
because these are two different issues.

Since we don't want NATv6, the requirement that hosts should be able to
access the outside implies that their scope must be compatible with
doing so. If these hosts must be protected from the outside when they
are not initiating the connection, this function shall be provided by a
firewall.

Yes, firewalls are a PITA because they build hard state, and hard state
is evil and distributed hard state is worse, but I don't think this is a
topic for this list.

Michel.

_______________________________________________
Saad mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/saad

---

From: "J. Noel Chiappa" <[email-masked]>
Date: Sat, 18 Oct 2003 23:30:21 -0400

> From: "James Kempf" <[email-masked]>

    > Suppose that .. I could buy a box that had some number of globally
    > routable IP addresses preconfigured into it (and I could get more by
    > downloading them from the manufacturer via their Web page, maybe paying
    > a small fee).

Hey, while you're picking that up from the store, would you mind buying me
one of those 300 mile/gallon carburettors?

Whether or not "address" as a generic term ought to include the concept of
"identity" is open to debate (in practise, in IPv[46], it does), but I've not
heard of anyone who says that "address" should not include the concept of
"location".

And clearly you don't know the location until the box is connected up to the
network. So the concept of having "addresses preconfigued into it" is
self-contradictory.

It might have some sort of identifier wihtout any topological significance
configured into it (just as your average box has a 48-bit IEEE address), but
that's a whole different thing; it would not be an "address".

	Noel

---

From: "Michel Py" <[email-masked]>
Date: Tue, 21 Oct 2003 09:07:31 -0700

> Erik Nordmark
> Having a conceptual model with 3 top-level classes defined in the
> firewall
> 1. no communication through the firewall
> 2. outbound only
> 3. open
> is simple enough to prevent unintended side-effects of other
> filters.

Even if we could force firewall vendors to do this (which we can't) it's
not flexible enough. A significant part of access control is performed
by regular routers and there we can't pre-define which interface belongs
to which class, it's all configuration that unfortunately can be
SNAFUed.

Michel.