Subject: RE: [midcom] New requirement bullets for decision

From: "Christian Huitema" <[email-masked]>
Date: Tue, 2 Oct 2001 16:46:32 -0700

> Which is a better "key" for the ruleset? One that is 
> allocated when the
> ruleset is created and remains constant or one the changes 
> over the life of
> the ruleset?

We debated that in London, and in fact I am supposed to head a panel and
write a draft on the issue. (Volunteers are welcome.) There are two
options. If you want to keep "id=filter-spec", then the H.323 scenario
is solved by creating two rulesets: create first a wildcard ruleset,
then delete the wild card ruleset and create a specific ruleset.

There are all kinds of pros and cons in this debate, but as an
architecture rule, it is preferable to avoid creating extra identifiers
whenever possible.

-- Christian Huitema

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: "Bob Penfield" <[email-masked]>
Date: Wed, 3 Oct 2001 08:30:04 -0400

----- Original Message -----
>From: "Christian Huitema" <[email-masked]>
>To: "Bob Penfield" <[email-masked]>; "Scott Brim"
<[email-masked]>; "midcom" <[email-masked]>
>Sent: Tuesday, October 02, 2001 7:46 PM
>Subject: RE: [midcom] New requirement bullets for decision
>

>then delete the wild card ruleset and create a specific ruleset.

This is only possible if the midcom agent becomes aware that the NAT has
collapsed. Since this would be a middlebox function (to look for the first
packet and change the source address in the filter), it makes no sense for
the midcom agent to make a new rule. The middlebox has already changed the
existing rule.