Subject: RE: [midcom] More bullets

From: Mark Duffy <[email-masked]>
Date: Thu, 27 Sep 2001 23:42:33 -0400

At 05:44 PM 9/27/01 -0700, Christian Huitema wrote:
>> Ok how about:
>> 
>> The protocol MUST support the ability of an agent to use one
>> MIDCOM session to install different types of rulesets in the
>> same middlebox.
>
>I would be even more specific. "When a middlebox performs both a NAT and
>a firewall function, it should be possible to specify firewall traversal
>rules and document mappings in a single ruleset."
>
>-- Christian Huitema

"different types of rulesets" conveyed over one Midcom session is not the
same thing as different types of action specs conveyed in the same ruleset.
 Lets be clear about which or both of those we want.  Personally, I think
the first should be a requirement; I'm not so sure about the second.

Also, let's not specifically limit this to NAT, FW type middlebox functions.

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: Scott Brim <[email-masked]>
Date: Fri, 28 Sep 2001 08:25:12 -0400

> Also, let's not specifically limit this to NAT, FW type middlebox functions.

Right.

---

From: "Bob Penfield" <[email-masked]>
Date: Fri, 28 Sep 2001 11:37:28 -0400

----- Original Message -----
From: "Mark Duffy" <[email-masked]>
To: "Christian Huitema" <[email-masked]>; "John LaCour"
<[email-masked]>; "Scott Brim" <[email-masked]>; "midcom"
<[email-masked]>
Sent: Thursday, September 27, 2001 11:42 PM
Subject: RE: [midcom] More bullets

> Also, let's not specifically limit this to NAT, FW type middlebox
functions.
I like Christian's requirement. It is highly desirable to have a single
ruleset permit the flow and establish the NAT bindings. Isn't that why we
called it a ruleset since it can have multiple rules (filters & actions)?
However, I agree we might want more general language. If we make a
requirement for the ability to define a ruleset that includes multiple
functions/actions, that would cover the "one session to install different
types..".

How about this?

The protocol MUST support the ability of an agent to install a ruleset that
includes multiple types of middlebox functions (e.g. firewall and NAT).

(-:bob

---

From: Mark Duffy <[email-masked]>
Date: Fri, 28 Sep 2001 12:07:02 -0400

>includes multiple types of middlebox functions (e.g. firewall and NAT).

Fine.

---

From: Scott Brim <[email-masked]>
Date: Fri, 28 Sep 2001 12:13:32 -0400

On Fri, Sep 28, 2001 11:37:28AM -0400, Bob Penfield allegedly wrote:
> > >I would be even more specific. "When a middlebox performs both a
> > >NAT and a firewall function, it should be possible to specify
> > >firewall traversal rules and document mappings in a single
> > >ruleset."
> > >
> > >-- Christian Huitema

> I like Christian's requirement. It is highly desirable to have a
> single ruleset permit the flow and establish the NAT bindings. 

Yes.

> Isn't
> that why we called it a ruleset since it can have multiple rules
> (filters & actions)?  

Filters and actions are a different matter.  This is multiple actions.

> However, I agree we might want more general
> language. If we make a requirement for the ability to define a ruleset
> that includes multiple functions/actions, that would cover the "one
> session to install different types..".
> 
> How about this?
> 
> The protocol MUST support the ability of an agent to install a ruleset
> that includes multiple types of middlebox functions (e.g. firewall and
> NAT).

Rulesets include specifications of actions.  A ruleset does not include
a "function" in the sense you seem to be using the term -- for example a
firewall function.  A ruleset may include a rule which would be used as
input to a firewall function.  

I don't think the exact words matter much, as long as they don't
thoroughly confuse the WG that comes after us.  That's all I'm trying to
avoid.