Subject: RE: [midcom] pre-midcom candidates

From: Jonathan Rosenberg <[email-masked]>
Date: Sat, 17 Nov 2001 03:56:14 -0500

> -----Original Message-----
> From: Meyer, Greg W [mailto:[email-masked]]
> Sent: Tuesday, November 13, 2001 8:57 PM
> To: 'Pete Cordell'; Steve Davies; 'Bob Penfield'; 'midcom'; Melinda
> Shore
> Subject: RE: [midcom] pre-midcom candidates
> 
> 
> I agree with Pete; I would favor a solution that addresses 
> both firewall and
> NAT. The trade-offs Jonathan raise about the Davies approach are very
> acceptable given pre-midcom is temporary (until midcom is 
> deployed). Any
> short-term solution that doesn't account for today's most 
> deployed networks
> simply defeats the purpose.

I just posted a note with far more details, but there is a really, really,
really important point that needs to be made here.

"addressing the firewall" CANNOT MEAN VIOLATING ENTERPRISE FIREWALL POLICY.
PERIOD. Even if this group chose to do that, I sincerely doubt that the IESG
would approve a protocol that would allow a client to bypass the firewall's
policy, unless this draft was an April Fools rfc (and there is one).

So, if the firewall disallows outbound UDP, sorry, no VoIP. I wish it wasn't
so, but thats the policy. I am sure people will deploy hacks to get around
this, and those hacks will be countered by smarter firewalls, and the game
will continue. At IETF, we develop protocols that are good for the Internet,
not protocols that are convenient for getting around annoying policies that
prevent us from making money. I fully realize that this is a tough pill to
swallow, especially these days, but I think thats the truth here.

Thanks,
Jonathan R.

---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: "Pete Cordell" <[email-masked]>
Date: Sat, 17 Nov 2001 17:26:51 -0000

----- Original Message -----
From: Jonathan Rosenberg <[email-masked]>
To: 'Meyer, Greg W' <[email-masked]>; 'Pete Cordell'
<[email-masked]>; Steve Davies <[email-masked]>; 'Bob
Penfield' <[email-masked]>; 'midcom' <[email-masked]>; Melinda
Shore <[email-masked]>
Sent: 17 November 2001 08:56
Subject: RE: [midcom] pre-midcom candidates

> http://www.dynamicsoft.com

Agreed, and that's what the draft says.

Pete.

=============================================
Pete Cordell
Tech-Know-Ware
[email-masked]
+44 1473 635863
=============================================

---

From: "Saqib Jang" <[email-masked]>
Date: Sat, 17 Nov 2001 16:41:26 -0800

> swallow, especially these days, but I think thats the truth here.

This seems a rather broad generalization. A firewall is one component
of an enterprises' security policy. For example, an enterprise may choose to
use a VPN set-up in conjunction with a firewall to allow secure firewall
traversal of specific protocols to specific external endpoints. even though
the firewall may disallow generalized use of such protocols.
I the goal has to be to allow enterprises the flexibility in building
thier security policy through the use of firewalls and VPNs versus
trying to restrict their ability for security policy management to
only firewalls.

----- Original Message -----
From: Jonathan Rosenberg <[email-masked]>
To: 'Meyer, Greg W' <[email-masked]>; 'Pete Cordell'
<[email-masked]>; Steve Davies <[email-masked]>; 'Bob
Penfield' <[email-masked]>; 'midcom' <[email-masked]>; Melinda
Shore <[email-masked]>
Sent: Saturday, November 17, 2001 12:56 AM
Subject: RE: [midcom] pre-midcom candidates