Subject: RE: [midcom] pre-midcom candidates

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 2 Nov 2001 02:35:21 -0500

> -----Original Message-----
> From: Christopher A. Martin [mailto:[email-masked]]
> Sent: Thursday, November 01, 2001 1:46 PM
> To: 'James Ho'; [email-masked]; [email-masked];
> [email-masked]
> Subject: RE: [midcom] pre-midcom candidates
> 
> 
> This would work well for an isolated network (intranet or 
> extranet) but when
> it is desired to allow anyone (Internet) access it would be 
> infeasible to
> provide security associations to the world

Well, one need not do it to the world. Presumably, the VoIP provider would
offer this service to its customers. Then, it only need worry about offering
ip addresses to the customers it has actively online. 

> Also, IPSec doesnt provide security policy enforcement, as a firewall
> typically would on non-IPSec encapsulated packets, merely 
> privacy. When you
> tunnel IPSec through a firewall from endpoints, unless the security
> associations are setup to be granular, the firewall cannot act on the
> packets inside the tunnel.

No, they can't. Thats why it works. But thats also the problem shared by all
the vpn and tunneling solutions; they ultimately work since they help bypass
enterprise firewall policies that might exist.

Stun doesn't do tunneling; if the firewall disallows outbound UDP then you
can't send outbound UDP. It therefore insures that enterprise firewall
policy continues to be obeyed. 

> Also not all firewalls allow IPSec (IP 50 and 51) the ability to pass
> through them.

Pick your favorite vpn. Others get through and work. My favorite remains
RFC3093, which will traverse almost all firewalls and nats.

-Jonathan R.

---
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: "Pete Cordell" <[email-masked]>
Date: Fri, 2 Nov 2001 10:18:50 -0000

Jonathan,

By quoting RFC 3093 as your favourite VPN solution you are really saying
that a standard VPN solution is not appropriate for the job!

Pete.

=============================================
Pete Cordell
Tech-Know-Ware
[email-masked]
+44 1473 635863
=============================================

----- Original Message -----
From: Jonathan Rosenberg <[email-masked]>
To: <[email-masked]>; 'James Ho' <[email-masked]>;
<[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: 02 November 2001 07:35
Subject: RE: [midcom] pre-midcom candidates