Subject: [midcom] Re: Need to close too (was: Topology considerations documents)

From: Scott Brim <[email-masked]>
Date: Thu, 13 Sep 2001 13:53:40 -0400

On Thu, Sep 13, 2001 10:43:30AM -0700, Christian Huitema allegedly wrote:
> > > Indeed, each of these values can be wildcarded, or maybe replaced by
> > a
> > > "prefix" in the case of addresses. The pinhole will then have
> > > attributes, such as:
> > > 	Direction: send, recv, sendrecv, closed
> > 
> > I think this is a much less significant point, but for now I would
> > like
> > to keep this simple.  First, take out "closed" -- if a rule doesn't
> > exist it's closed...
> 
> I actually insist on "closed." There are services such as intrusion
> detection + repair that require closing traffic from a very specific
> filter, even if there is a generic filter in place that would allow the
> traffic to flow. Actually, we could make that a requirement, i.e. that
> we can set up specific filters that are more restrictive than an
> overlapping generic filter.

I think the requirements bullets are open until the chair says
otherwise.  Could you give me specific text for R86 or whatever it is?

..Scott

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: "Christian Huitema" <[email-masked]>
Date: Thu, 13 Sep 2001 10:43:30 -0700

-- Christian Huitema