Subject: Re: [midcom] pre-midcom candidates

From: "James Ho" <[email-masked]>
Date: Thu, 01 Nov 2001 09:24:55 -0800

Why could'nt tunnel-mode IPsec be used beween an IPsec end-point in
the enterprise and another in the SP network to tunnel H.323/SIP
traffic across firewalls? The auth/integrity checking within ESP
with null encryption should allow for a secure tunnel improving
enterprise IT confidence. Plus its a standard approach vs. the
"proprietary' approaches proposed. To address NAT issues, the
internal IPsec end-point could have a public IP address.

I don;t performance/latency will be an issue as IP storage folks
are considering tunnel-mode IPsec to be a mandatory  requirement
for all IP storage protocols (i.e. iSCSI, FCIP, etc).

Saqib

>From: "Bob Penfield" <[email-masked]>
>To: "Barry Scott" <[email-masked]>, "'James Ho'" 
><[email-masked]>, <[email-masked]>
>Subject: Re: [midcom] pre-midcom candidates
>Date: Thu, 1 Nov 2001 11:29:46 -0500
>
>What percentage of NAT/FW are symmetric as opposed to full-cone as 
>described
>in the STUN proposal? There is some debate whether or not the interim
>solution needs to address the symmetric NAT problem. If the great majority
>of existing FW/NAT are symmetric, we probably need to include it now.
>
>(-:bob
>
>Robert F. Penfield
>Chief Software Architect
>Acme Packet, Inc.
>130 New Boston Street
>Woburn, MA 01801
>[email-masked]
>
>----- Original Message -----
>From: "Barry Scott" <[email-masked]>
>To: "'James Ho'" <[email-masked]>; <[email-masked]>
>Sent: Thursday, November 01, 2001 9:58 AM
>Subject: RE: [midcom] pre-midcom candidates
>
>
> > The policy we need turns out to be the default for many
> > enterprises already.
> >
> > Typical behavour is to prevent UDP from the outside
> > to get inside. But once a UDP packet from the inside
> > is sent to the outside the firewall will pinhole itself
> > to allow return traffic. After a period of inactivity
> > the firewall will close the pinhole, for example after
> > 45 seconds.
> >
> > BArry
> >
> > -----Original Message-----
> > From: James Ho [mailto:[email-masked]]
> > Sent: 31 October 2001 22:20
> > To: [email-masked]
> > Subject: RE: [midcom] pre-midcom candidates
> >
> >
> > As I understand it, the Davies proposal requires an open
> > UDP port on the firewall for media traversal. I can't think
> > of many/any enterprises being willing to implement such a
> > firewall policy. Or maybe my understanding is faulty??
> >
> > james
> >
> > _________________________________________________________________
> > Get your FREE download of MSN Explorer at 
>http://explorer.msn.com/intl.asp
> >
> >
> > _______________________________________________
> > midcom mailing list
> > [email-masked]
> > http://www1.ietf.org/mailman/listinfo/midcom
> >
>

_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: "Christopher A. Martin" <[email-masked]>
Date: Thu, 01 Nov 2001 12:45:39 -0600

This would work well for an isolated network (intranet or extranet) but when
it is desired to allow anyone (Internet) access it would be infeasible to
provide security associations to the world and probably impossible for many
endpoints (From an interoperability standpoint between vendors)...It really
depends on the scale of the solution (I like IPSec solutions myself).

Also, IPSec doesnt provide security policy enforcement, as a firewall
typically would on non-IPSec encapsulated packets, merely privacy. When you
tunnel IPSec through a firewall from endpoints, unless the security
associations are setup to be granular, the firewall cannot act on the
packets inside the tunnel.

Also not all firewalls allow IPSec (IP 50 and 51) the ability to pass
through them.

> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> James Ho
> Sent: Thursday, November 01, 2001 11:25 AM
> To: [email-masked]; [email-masked];
> [email-masked]

---

From: Adina Simu <[email-masked]>
Date: Thu, 01 Nov 2001 12:54:04 -0800

IPsec itself has big problems with NATs - NAPTs in particular (as
probably all of you know already :)).

-Adina