Subject: RE: [Sipping] Session Border Control Deployment Scenario

From: "Khan, Sohel Q [NTK]" <[email-masked]>
Date: Fri, 22 Jul 2005 22:15:23 -0500

> Others might suggest that a SIP-aware firewall is in and of itself a 
DOS.

They need to fix their firewalls !!!

> If you're trying to peer at many-times OC-192 rates, doing per-flow 
> stateful ANYTHING at a boundary just isn't going to work. Sure, we can

> make that sort of thing work on a T1/E1 or two, but I thought we were 
> talking about carrier networks?

There are different types of peering in the network e.g. access-network,
network-network, carrier-carrier, enterprise-carrier, wireless
edge-access, wireless access-core.  Border protection requirements are
different for different types of peering.  

-----Original Message-----
From: Dean Willis [mailto:[email-masked]] 
Sent: Friday, July 22, 2005 5:26 PM
To: Khan, Sohel Q [NTK]
Cc: [email-masked]; [email-masked]
Subject: Re: [Sipping] Session Border Control Deployment Scenario

On Jul 22, 2005, at 10:19 AM, Khan, Sohel Q [NTK] wrote:
>
>> - Distributed S/BC - I wouldn't expect any carriers to front-end
their
>> routers with FWs, especially not for a peering connection.
>
> Some suggests that a SIP aware firewall at the front should perform
> special security functions such as avoidance of DoS.
>

Others might suggest that a SIP-aware firewall is in and of itself a 
DOS.

If you're trying to peer at many-times OC-192 rates, doing per-flow 
stateful ANYTHING at a boundary just isn't going to work. Sure, we can 
make that sort of thing work on a T1/E1 or two, but I thought we were 
talking about carrier networks?

--
Dean

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: [email-masked]
Date: Sat, 23 Jul 2005 09:30:12 -0500

>There are different types of peering in the network e.g. 
>access-network, network-network, carrier-carrier, 
>enterprise-carrier, wireless edge-access, wireless access-core.  
>Border protection requirements are different for different types 
>of peering. 

This seems to be a pretty good definition of the differences between an 
ITU-T style network and the Internet. 

If so, why should the IETF make the mistake and spend resources and even
worse, legitimate all the above peering stuff (nonsense IMHO)?

Thanks, Henry

 -----Original Message-----
From: Khan, Sohel Q [NTK] [mailto:[email-masked]] 
Sent: Friday, July 22, 2005 10:15 PM
To: Dean Willis
Cc: [email-masked]
Subject: RE: [Sipping] Session Border Control Deployment Scenario

DOS.

-----Original Message-----
From: Dean Willis [mailto:[email-masked]] 
Sent: Friday, July 22, 2005 5:26 PM
To: Khan, Sohel Q [NTK]
Cc: [email-masked]; [email-masked]
Subject: Re: [Sipping] Session Border Control Deployment Scenario

their

--
Dean