Subject: RE: [midcom] Re: Need to close too (was: Topology considerations documents)

From: "Christian Huitema" <[email-masked]>
Date: Thu, 13 Sep 2001 12:15:29 -0700

Proposed requirement R86 (or whatever is the number):

R86: It should possible to define specific filters that are more
restrictive than an overlapping generic filter, including filters that
would prevent traffic for a specific set of IP addresses and transport
parameters even if that traffic was authorized by an overlapping
"wildcard" filter.

Reasoning: this is required for rapid response to intrusion detection. 

-- Christian Huitema

> -----Original Message-----
> From: Scott Brim [mailto:[email-masked]]
> Sent: Thursday, September 13, 2001 10:54 AM
> To: [email-masked]
> Subject: [midcom] Re: Need to close too (was: Topology considerations
> documents)
> 
> On Thu, Sep 13, 2001 10:43:30AM -0700, Christian Huitema allegedly
> wrote:
> > > > Indeed, each of these values can be wildcarded, or maybe
> replaced by
> > > a
> > > > "prefix" in the case of addresses. The pinhole will then have
> > > > attributes, such as:
> > > > 	Direction: send, recv, sendrecv, closed
> > >
> > > I think this is a much less significant point, but for now I would
> > > like
> > > to keep this simple.  First, take out "closed" -- if a rule
> doesn't
> > > exist it's closed...
> >
> > I actually insist on "closed." There are services such as intrusion
> > detection + repair that require closing traffic from a very specific
> > filter, even if there is a generic filter in place that would allow
> the
> > traffic to flow. Actually, we could make that a requirement, i.e.
> that
> > we can set up specific filters that are more restrictive than an
> > overlapping generic filter.
> 
> I think the requirements bullets are open until the chair says
> otherwise.  Could you give me specific text for R86 or whatever it is?
> 
> ..Scott
> 
> _______________________________________________
> midcom mailing list
> [email-masked]
> http://www1.ietf.org/mailman/listinfo/midcom

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: Scott Brim <[email-masked]>
Date: Thu, 13 Sep 2001 16:45:41 -0400

> Reasoning: this is required for rapid response to intrusion detection. 

In the bullets, under "not yet discussed", for a 09/17 release.