Subject: RE: [midcom] Firewall interaction with BEEP

From: "Christian Huitema" <[email-masked]>
Date: Mon, 9 Jul 2001 11:14:04 -0700

Ted,

I don't think that it is a good idea to add additional requirements at
this point in the game. We understand protocols and ports very well, and
we should specify that. When firewalls get developed that perform
specific treatment for BEEP, then we will study the extensions. By the
way, BEEP is not unique there -- at some point we will also need
extensions for SCTP, SOAP, and maybe even HTTP or SMTP... 

-- Christian Huitema

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Monday, July 09, 2001 10:31 AM
> To: Scott Brim
> Cc: [email-masked]; [email-masked]
> Subject: Re: [midcom] Firewall interaction with BEEP
> 
> Scott,
> 	Adding beep-based communications to the list of possible
> future needs would help, but I think we need more than a statement
> that the protocol syntax needs to be flexible.  I think we need to
> explicitly say that the MIDCOM protocol must be able to handle control
> channels that fall into three categories: port based, mux-based, and
> external channel.  For the midcom protocol to handle a port-based
> protocol (like WHOIS, for example) is pretty easy: the agent can
> request a pinhole for the specific port on a specific destination.
> For the external channel, the agent uses data from one channel to
> request a pinhole for a distinct src/dest pair.  For a mux-based
> protocol, the agent must be able to do more, because the src/dest pair
> doesn't make for a full tuple; it must name the profiles as well.
> Without that, all beep profiles would have to be considered
> equivalent; the result would look much like a firewall control
> protocol
> that could only specific IP address (and could not specify port
> number):
> all tcp and udp-based protocols would look the same.  Though I
> can't point to an existing firewall implementation to prove it, I
> have a strong suspicion that that won't suffice.
> 				regards,
> 					Ted Hardie
> 
> 
> 
> 
> 
> 
> >
> > On  6 Jul 2001 at 15:33 -0700, [email-masked] apparently wrote:
> > > Despite there being no current firewall applications that are
> > > beep capable, I believe we may need language in the requirements
> > > document to cover the use of profiles within beep sessions.
> >
> > I think this comes down to a statement that the midcom protocol
> syntax
> > needs to be flexible enough to do not just what we are focused on
> right
> > now, but what others might need to do in the future -- we already
> have
> > this covered -- and that we should add beep-based communications to
> the
> > list of possible future needs.  I don't see a problem here.
> >
> > ...Scott
> >
> 
> 
> _______________________________________________
> midcom mailing list
> [email-masked]
> http://www.ietf.org/mailman/listinfo/midcom

_______________________________________________
midcom mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/midcom