Subject: RE: [midcom] pre-midcom candidates

From: Barry Scott <[email-masked]>
Date: Thu, 1 Nov 2001 14:58:42 -0000

The policy we need turns out to be the default for many
enterprises already.

Typical behavour is to prevent UDP from the outside
to get inside. But once a UDP packet from the inside
is sent to the outside the firewall will pinhole itself
to allow return traffic. After a period of inactivity
the firewall will close the pinhole, for example after
45 seconds.

		BArry

-----Original Message-----
From: James Ho [mailto:[email-masked]]
Sent: 31 October 2001 22:20
To: [email-masked]
Subject: RE: [midcom] pre-midcom candidates

As I understand it, the Davies proposal requires an open
UDP port on the firewall for media traversal. I can't think
of many/any enterprises being willing to implement such a
firewall policy. Or maybe my understanding is faulty??

james

_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: "Bob Penfield" <[email-masked]>
Date: Thu, 1 Nov 2001 11:29:46 -0500

What percentage of NAT/FW are symmetric as opposed to full-cone as described
in the STUN proposal? There is some debate whether or not the interim
solution needs to address the symmetric NAT problem. If the great majority
of existing FW/NAT are symmetric, we probably need to include it now.

(-:bob

Robert F. Penfield
Chief Software Architect
Acme Packet, Inc.
130 New Boston Street
Woburn, MA 01801
[email-masked]