Subject: RE: [midcom] draft-brim-midcom-inandout-00.txt

From: Mark Duffy <[email-masked]>
Date: Fri, 14 Sep 2001 17:27:30 -0400

At 01:17 PM 9/14/01 -0700, Christian Huitema wrote:
>> 	http://www.aravox.com and, apparently, http://www.netscreen.com.
>> Sun used to and possibly still does build a firewall that worked like
>> this. I am quite certain this is an extremely partial list.
>
>The netscreen box can be configured to act transparently, but it
>definitely has the concept of inside and outside -- that is quite
>important for firewalls... And a Sun computer running Solaris certainly
>knows how to identify interfaces. 

Please recall that this discussion was not about middleboxes distinguishing
inside from outside or identifying interfaces.  It was about whether one
can assume that middleboxes understand network topology to the extent that
they can determine whether a given IP address is inside or outside.  I
understood the statements from Andrew and John to mean that these
middleboxes, in at least some mode, do not understand network topology to
that extent.

>
>> 	See also "bridge", a.k.a. "layer 2 switch."
>
>These are not part of the MIDCOM charter, AFAIK.

I understood that to be a reference not to a plain L2 switch, but to a
middlebox embedded in one.  E.g. a firewall that makes its forwarding
decision based on MAC address.  I do not see anything in the charter that
excludes that, nor do I see any reason why it should be excluded.  Midcom
shouldn't care.

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: Adina Simu <[email-masked]>
Date: Fri, 14 Sep 2001 17:14:50 -0700

> decision based on MAC address.  I do not see anything in the charter that

If this device doesn't use IP for addressing, why would it care about
embedded IP addresses? 

> excludes that, nor do I see any reason why it should be excluded.  Midcom

This will lead us to have multiple types of addresses (IP, MAC, etc)
carried by midcom... poking holes based on MAC addresses... this is a
completely different issue. I thought midcom is about IP... I completely
agree with Christian on this.

Andrew, could you please give a config example for such a layer 2 box?
I'm trying to understand how you do/configure ALGs on it.

Thanks
-Adina

-- 
Adina Simu
Software Engineer
Core IP Eng - Services & Security
IOS Technologies Division
Phone: 408-525-1383

---

From: Mark Duffy <[email-masked]>
Date: Sat, 15 Sep 2001 11:25:12 -0400

Adina,

It is important to distinguish how the box makes its forwarding decision
(where to send the packet next) from what layer(s) the middlebox function
is working at.  What we are talking about here is what kind of topology
knowledge a middlebox might have and how it makes its forwarding decisions.
 At least, that is what I believe we are talking about.

That a box might work at the physical or MAC layer for forwarding in no way
implies that a middlebox function (e.g. firewall) within that box works off
MAC addresses.

-Mark

(some comments embedded below too)

At 05:14 PM 9/14/01 -0700, Adina Simu wrote:
[snip]
>If this device doesn't use IP for addressing, why would it care about

The same reason it would otherwise: for instance because it is designed to
be a  NAT device translating IP addresses and transport layer port numbers.
 It's purpose in life involves caring about IP addresses.

>carried by midcom... poking holes based on MAC addresses... this is a

I believe you are making an unwarranted assumption.