Subject: RE: [midcom] accept R3a1 & R3a2

From: "Christian Huitema" <[email-masked]>
Date: Wed, 26 Sep 2001 08:18:31 -0700

> From: Melinda Shore [mailto:[email-masked]] 
> Sent: Wednesday, September 26, 2001 7:12 AM
> To: Scott Brim; midcom mail-list
> Subject: Re: [midcom] accept R3a1 & R3a2
> 
> 
> At 09:40 AM 9/26/01 -0400, Scott Brim wrote:
> >Would 'must operate through a NAT' be a pathological case?
> 
> The presence of more than one NAT is not that uncommon, 
> unfortunately.  I've personally never heard of multiple 
> middleboxes sharing a single address, other than failover
> scenarios or clustering, where routing is handled at a 
> lower layer.  Are there such things?  As I said, it is not
> my impression that much thought has been given to what
> this requirement actually means for protocol design.  I
> think we're covered.

If there is a requirement, it is that the Midcom client can establish a
connection to the server securely, even if there are one or several
middlemunglers between the client and that specific server. However, we
should be clear that the client is expected to describe packets exactly
as they are seen by the controlled middlebox, and that we are certainly
not supporting, let alone requiring, that the intermediates rewrite the
MIDCOM packets. In practical deployment cases, I expect the
communication between client and server to be encrypted.

-- Christian Huitema

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: Adina Simu <[email-masked]>
Date: Wed, 26 Sep 2001 18:10:54 -0700

> communication between client and server to be encrypted.

A far-fetched scenario:

agent----NAT1---FW1--NAT2----FW2-----...

If the agent has to control all these, how does it know the correct
order in which they should be contacted?

-Adina

-- 
Adina Simu
Software Engineer
Core IP Eng - Services & Security
IOS Technologies Division
Phone: 408-525-1383