Subject: RE: [midcom] Topology considerations documents

From: "Christian Huitema" <[email-masked]>
Date: Thu, 13 Sep 2001 10:52:23 -0700

> Except you assume that the agent knows a particular address [range] is
> inside or outside.  How can it know that?  It looks like you're
> assuming this "realm" infrastructure and administration is in place.

In practical deployment, this is not a real problem. The requests will
be issued either by the first party, which definitely knows that it is
"inside" the firewalled area, or by a third party such as a SIP proxy,
which also must have a reasonable knowledge of the topology -- otherwise
it would not know which firewall to contact in the first place.

> In the case of wildcards an agent does need to let the middlebox know
> if it's talking about a rule for inside or outside addresses, but it
> can't know if a specific address is inside or outside.

I would assume that the firewall definitely must know whether a specific
address is inside or outside. AFAIK, the firewall must have a rule for
resolving addresses to interfaces; you went on to assume rules that are
strictly based on addresses, which implicitly make the assumption that
addresses can be related to sides. Note that we could conceive a double
NAT scenario in which a rule strictly based on addresses would be
ambiguous.

-- Christian Huitema

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: Adina Simu <[email-masked]>
Date: Thu, 13 Sep 2001 12:50:06 -0700

> it would not know which firewall to contact in the first place.

This is a problem for NATs. Plus, with NATs the notions of Inside and
Outside don't have the same significance as with FWs. There are a lot of
examples where people are using NATs to solve other problems than
connecting a 192.x.x.x network to the Internet. In those scenarios, I
don't see any agent being able to make assumptions on where he sits and
where the other endpoints sit.

> NAT scenario in which a rule strictly based on addresses would be

Could you please give an example for this NAT scenario?

Thanks
-Adina

-- 
Adina Simu
Software Engineer
Core IP Eng - Services & Security
IOS Technologies Division
Phone: 408-525-1383

---

From: Scott Brim <[email-masked]>
Date: Fri, 14 Sep 2001 11:12:44 -0400

> it would not know which firewall to contact in the first place.

There is no problem when you are creating a ruleset for yourself, so
that others can reach you.  However, suppose an invitation comes to you
with some previously unseen address.  How do you know if that address is
inside or outside?  When you send an invitation in return, do you use an
inside address or an outside address for yourself?

Either 

  - the agent knows the network topology and whether any particular
    address prefix is inside or outside (don't do this!)

  - the agent receives a "realm ID" with the invitation and knows if
    that realm is inside or outside (you've seen my concerns with this)

  - the agent goes ahead and requests a ruleset to reach that address,
    and depends on the middlebox to know if one is really necessary.

Let's assume the agent asks the middlebox.  In that case, how can it
phrase its ruleset query?  It doesn't know if the target address is
inside or outside.  I suppose we could change your inside/outside syntax
to be inside and "maybe in or out", but I don't know if that leads to
deterministic behavior.  

Also, suppose an agent is in an ISP and is trying to arrange
communication between two clients which are both "outside" from the
point of view of the agent.  You don't have inside and outside.  

I think you need syntax which doesn't make assumptions about topology.