Subject: RE: [midcom] requirements-01 status

From: "Christian Huitema" <[email-masked]>
Date: Thu, 28 Jun 2001 14:22:24 -0700

I agree with Melinda here. The internal IP packets that are authorized
to sneak through a "pin-hole" will carry an internal source address and
an "external" destination address; the internal routing mechanisms will
direct these packet towards the firewall. If the firewall is to forward
these packets, it will have to do that based solely on the value of the
destination address -- there is no "scope of address" field in the IPv4
packet.  To operate properly, the firewall must have an internal routing
table that maps an IP address to an exit interface. Thus, the
"interface" to which an address is bound on a given midcom box has to be
deductible from the IP address itself. Ergo, direction and scope fields
are redundant.

-- Christian Huitema

> -----Original Message-----
> From: Melinda Shore [mailto:[email-masked]]
> Sent: Thursday, June 28, 2001 12:39 PM
> To: Sanjoy Sen; 'Bob Penfield'; midcom
> Subject: Re: [midcom] requirements-01 status
> 
> > From: Sanjoy Sen <[email-masked]>
> > To: 'Bob Penfield' <[email-masked]>; Melinda Shore
> <[email-masked]>; midcom <[email-masked]>
> > Sent: Thursday, June 28, 2001 3:11 PM
> > Subject: RE: [midcom] requirements-01 status
> 
> 
> > I agree with Bob. How would the MB know about the direction the
packets
> will
> > be flowing from the flow tuple (src., dest. addr,ports, protocol> if
the
> > endpoints are multi-hop away from the MB?
> 
> A middlebox with more that's got to forward to more than one
> interface is often referred to as a "router," and there are
> already mechanisms to do interface selection.  I am *extremely*
> wary of 1) trying to replicate network-layer functions in the
> application layer, and 2) trying to export network topology
> information to applications.  I believe that the correct
> approach here is to rely on routers to do their job, including
> route determination/selection.
> 
> Melinda
> 
> 
> 
> _______________________________________________
> midcom mailing list
> [email-masked]
> http://www.ietf.org/mailman/listinfo/midcom

_______________________________________________
midcom mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/midcom

---

From: "Bob Penfield" <[email-masked]>
Date: Fri, 29 Jun 2001 08:19:47 -0400

>deductible from the IP address itself. Ergo, direction and scope fields

The middleboxes that I am talking about have no routing tables or routing
capability. They sit on a pipe between two routers. Whatever comes in on one
end of the pipe is sent out the other end. The routers take care of sending
the packets down the right pipe.

The "internal IP packets" will only have an internal source address if they
originate in my network. If they originate in a neighboring network and came
in through a peering point on the other side of my network, the middlebox
cannot tell which end of the pipe the pin-hole belongs to.

(-:bob

Robert F. Penfield
Chief Software Architect
Acme Packet, Inc.
130 New Boston Street
Woburn, MA 01801
[email-masked]