Subject: RE: [midcom] Fw: I-D ACTION:draft-shore-midcom-apps-00.txt

From: "Christian Huitema" <[email-masked]>
Date: Tue, 15 May 2001 14:26:33 -0700

Keith is basically right. The purpose of the group is to provide the
requirements for a quick fix, i.e. how to make a certain set of
application work through firewall and NAT. On the other hand, the
existence of a short term solution has a high potential to encourage
"internetting while intoxicated."

The main problem with any solution that throws a third party in a
communication between two hosts is known as "fate sharing", i.e. the
fact that suddenly the behavior of the end-to-end is dependent on the
continuous operation and proper behavior of an intermediate. A fairly
fundamental tenet of the Internet architecture is that this kind of
strong dependency should be avoided.

There are different techniques that can be used for interoperation
between the intermediate and the end point. Some of the techniques, such
as address translation, mandate a hard state in the intermediate; other
examples are various forms of tunneling. Other techniques such as for
example port filtering are more amenable to a "soft state"
implementation, in which the necessary "crossing state" is placed on
demand in whichever firewall happens to be on the path. In short, packet
inspection can be accommodated with a soft state solution, while packet
rewriting is a much harder problem.

The discussion on IPv6 shows that a significant fraction of this group
is not terribly interested in engineering a clean solution that would
preclude rewriting. Since shouting at each other is not particularly
helpful, I suggest that we concentrate on what we agree is needed in the
short term, i.e. the crossing of NAT and firewalls, and drop any attempt
at a grandiose architecture of unspecified middleboxes...

-- Christian Huitema

_______________________________________________
midcom mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/midcom