Subject: RE: [midcom] Status

From: "Cedric Aoun" <[email-masked]>
Date: Wed, 17 Oct 2001 18:01:44 +0100

Melinda
Please see my comments below
Thanks
Cedric

-----Original Message-----
From: Melinda Shore [mailto:[email-masked]]
Sent: Tuesday, October 16, 2001 7:01 PM
To: midcom
Subject: [midcom] Status

R86 Accepted with revisions:
  R86: It should possible to define rulesets that contain a more specific
  filter spec than an overlapping ruleset. This should allow agents to
  request actions for the subset that contradict those of the overlapping
  set. This should allow Midcom agent to request to a Midcom server
  controlling a firewall function that a subset of the traffic that would
  be allowed by the overlapping ruleset be specifically disallowed.

<CA>
OK
</CA>

R35 Delete
<CA>
OK
</CA>
R38 Delete
<CA>
OK
</CA>
R43 Delete
<CA>
I agree that this one is not obvious to find in an existing protocol but we
should remember the real time nature of certain applications.
Some of us could think that on a wireless device (or on a dial-up link)
bandwidth could be scarce and we would like to optimize the message length.
R43 was originally intended for both of the above reasons.
I think we should keep it.
Is there any other advocates for it?
</CA> 
R47 Delete
<CA>
This one is also related to bandwidth savings (message length) as well as to
the aggregation (which again is linked to bandwidth saving and real time).
I think that R43 and R47 will come back at the design phase
</CA>
R75 Needs more discussion
<CA>
What I understood from the requirement was that in case one Middle Box was
traversed at a certain time x, when the network topology has changed (due to
a failure) or when the traffic load increased another Middle Box could be
traversed at time y.
Therefore we should be able to put the same ruleset on all the Middle Boxes
at the edge of the realm, this will allow the application flows to traverse
in all cases.
This requirement overlaps with the ability to request certain actions to be
performed on certain flows with all details (i.e. requested address/port for
the bind) as well as forbidding another agent to use the same bind for
another flow (i.e. some inter agent coordination on what could be requested
while avoiding conflicts. There is also the issue where a bind is already
allocated on a Middle Box and another Middle Box is not aware that the
previous bind was used (i.e. Middle Box ruleset coordination which could be
considered as a result of Midcom agent coordination).
And all of this is not totally linked to Midcom, especially the coordination
part
</CA>

R?? Accepted:
  "The midcom protocol must provide protection against replay
  attacks"
<CA>
Isn't this already handled by R73 (probably mitigate is a soft word
depending how we look at it) or we could modify R73 to be the above:
"The Midcom Protocol MUST define mechanisms to mitigate replay
        attacks on the control messages."

Melinda

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom