Subject: [IPsec] [ipsecme] #219: Star topology as an admin choice

From: Stephen Hanna <[email-masked]>
Date: Tue, 20 Mar 2012 21:37:30 -0400

Please comment.

Steve

-----Original Message-----
From: ipsecme issue tracker [mailto:[email-masked]] 
Sent: Tuesday, March 20, 2012 7:04 PM
To: [email-masked]; [email-masked]
Subject: [ipsecme] #219: Star topology as an admin choice

#219: Star topology as an admin choice

 Some admins prefer a star topology so they can inspect traffic. They may
 not want to use this technology.

 Suggested Resolution: Mention this in the Security Considerations section.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-ipsecme-p2p-vpn-
  yaronf.ietf@…          |  problem@…
     Type:  defect       |     Status:  new
 Priority:  normal       |  Milestone:
Component:  p2p-vpn-     |   Severity:  -
  problem                |
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/ipsecme/trac/ticket/219>
ipsecme <http://tools.ietf.org/ipsecme/>

---

From: yogendra pal <[email-masked]>
Date: Thu, 22 Mar 2012 12:15:16 +0530

Why they may not use this technology ? Even today irrespective of the
topology, traffic is intercepted by lawful agencies by using different
mechanism (port mirroring, etc...)

Thanks,
Yogendra Pal
Ericsson, India

On Wed, Mar 21, 2012 at 7:07 AM, Stephen Hanna <[email-masked]> wrote:

> To: [email-masked];
> [email-masked]
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

--

---

From: Yoav Nir <[email-masked]>
Date: Thu, 22 Mar 2012 09:33:43 +0200

I don't think this is an all-or-nothing choice. You might want a mesh for VoIP, but a star for HTTP, FTP and mail protocols. Or you may want a mesh within your organization, but to trunk and inspect all traffic going somewhere else.

On Mar 21, 2012, at 3:37 AM, Stephen Hanna wrote:

> �jy�u����$>���:-jT�r��!���

---

From: "Ulliott, Chris" <[email-masked]>
Date: Thu, 22 Mar 2012 09:26:40 +0000

Protective Marking: UNCLASSIFIED

I think the important point here is that you should be able to set a policy to determine which gateways, a given gateway is (or isn't) permitted to communicate with.  The interesting question is how granular that policy should be (all or nothing -v- by protocol, port etc)... This then leads onto an additional requirement (I believe) for a process for distributing policy to gateways....

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Yoav Nir
Sent: Thursday, March 22, 2012 7:34 AM
To: Stephen Hanna
Cc: IPsecme WG
Subject: Re: [IPsec] [ipsecme] #219: Star topology as an admin choice

This email was received from the INTERNET and scanned by the Government Secure Intranet anti-virus service supplied by Cable&Wireless Worldwide in partnership with MessageLabs. (CCTM Certificate Number 2009/09/0052.) In case of problems, please call your organisation’s IT Helpdesk.
Communications via the GSi may be automatically logged, monitored and/or recorded for legal purposes.

****************************************************************************
Communications with GCHQ may be monitored and/or recorded 
for system efficiency and other lawful purposes. Any views or 
opinions expressed in this e-mail do not necessarily reflect GCHQ 
policy.  This email, and any attachments, is intended for the 
attention of the addressee(s) only. Its unauthorised use, 
disclosure, storage or copying is not permitted.  If you are not the
intended recipient, please notify [email-masked].  

This information is exempt from disclosure under the Freedom of 
Information Act 2000 and may be subject to exemption under
other UK information legislation. Refer disclosure requests to 
GCHQ on 01242 221491 ext 30306 (non-secure) or email
[email-masked]

****************************************************************************

The original of this email was scanned for viruses by the Government Secure Intranet virus scanning service supplied by Cable&Wireless Worldwide in partnership with MessageLabs. (CCTM Certificate Number 2009/09/0052.) On leaving the GSi this email was certified virus free.
Communications via the GSi may be automatically logged, monitored and/or recorded for legal purposes.

---

From: Vishwas Manral <[email-masked]>
Date: Thu, 22 Mar 2012 10:24:11 -0700

Hi Yogendra,

I guess the question being raised here is slightly different.

The question is should all traffic be first sent to a central point
(Campus/ DC etc) inspected (IDS/ IPS/ Firewall) and then allowed to pass to
others peers or should there be a direct connection between the peers too -
in which case we would need to have distributed security appliances?

In my view it is up to the security administrator to prefer a particular
topology for particular communication. We could have some traffic always
being sent through the hub (say over the MPLs backbone) while another is
just sent directly over the Internet.

Thanks,
Vishwas