Subject: Re: [midcom] middle-boxes and a historical precedence

From: [email-masked] (Sean Doran)
Date: Fri, 26 Jan 2001 16:22:52 +0100 (CET)

| This is the ideal, I think, but we should remember
| that it's at the cost of additional complexity in
| the security mechanisms.

Well, Chiappa has been accused of "arbitrary complexity for
the sake of maximum flexibility", and we tend to agree on
a bunch of things, so, yes... :-)

I agree that the closer to a host a middle-box is, the easier
it's going to be to implement, by and large.  I am also quite
happy to be told that putting a middle-box between size-large
NSPs is ludicrous, and today it probably is.

| > At the same time, the host should be
| > as close to unaware as possible that this whole process is
| > occurring.
|
| I'm not sure exactly what you mean, here,

Many things tend to work in the presence of a NAT, or a NAT+ALG,
without needing either host to adapt to or even be aware of the
translation/gatewaying.  This is a nice feature.   It would be
nice to maintain this feature when translating between IPv4 and
some arbitrary protocol (like v6).

Obviously, trust issues will complicate things, where identities
are implicit or tightly-coupled with network layer addresses.

Having some set of guidelines which describe how to be middle-box-friendly
seems like a useful tool for future developer/networker types, but at least as
useful is minimizing the amount of work needed to be middle-box-friendly
in the first place..

	Sean.

_______________________________________________
midcom mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/midcom

---

From: "J. Noel Chiappa" <[email-masked]>
Date: Fri, 26 Jan 2001 15:45:10 -0500

> From: [email-masked] (Sean Doran)

    >> we should remember that it's at the cost of additional complexity

    > Well, Chiappa has been accused of "arbitrary complexity for the sake of
    > maximum flexibility"

Since my name is being bandied about here, let me just throw in a
parenthetical aside that a certain level of complexity (q.v. Nimrod) doesn't
bother me, as long as i) it's kept *as simple as possible*, and ii) you're
getting *some really good capability* out of it.

However, lots of the stuff I see being deployed today is i) incredibly
complicated, and ii) doesn't seem to be gaining a whole lot of ground in
terms of *new* functionality.

	Noel