Subject: Re: [midcom] Questions on middleboxes with more than 2 interfaces

From: [email-masked]
Date: Wed, 31 Jul 2002 12:47:04 -0500

Melinda,

I agree completely. Specifying the behavior of middleboxes, whether
they have only two interfaces or more than two interfaces, is beyond
the scope of this WG. Middlebox behavior discussion should be limited
to making sure we support middlebox behaviors that are already known
or can be reasonably anticipated.

I raised these questions strictly for the purpose of, as you suggest,
making sure that we have the necessary stuff in the semantics and
protocol(s).

And to find out whether or not we should even be thinking about
middleboxes with more than two interfaces! I personally think we
should, but I could be wrong. :-)

Jim

Melinda Shore <[email-masked]> on 07/30/2002 02:59:56 PM

Sent by:  Melinda Shore <[email-masked]>

To:   James Renkel/MW/US/3Com
cc:   midcom <[email-masked]>
Subject:  Re: [midcom] Questions on middleboxes with more than 2 interfaces

We talked about this quite a bit last year.  The number of
interfaces on a firewall or NAT is clearly outside the scope
of the working group.  The implications of doing much more
than simply providing a blob to pass interface identifiers
around with addresses are mind-bogglingly awful, and the
decision was, basically, to punt.  Let's avoid revisiting
that mess - discussion of what data need to be carried by
the protocol is fine, but discussion about the behavior of
middleboxes in the face of more than two interfaces should
serve only to elucidate the data question and should not be
concerned with specifying behaviors.

Melinda

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

---

From: John LaCour <[email-masked]>
Date: Wed, 31 Jul 2002 11:06:30 -0700

In my view, we should be thinking about middleboxes with
two address-space/security realms and providing a protocol
with appropriate semantics to request NAT and pinhole
services between those realms.  How those realms map to
a physical middlebox is outside the scope of the wg and
protocol and will be left to implementors to work out on
their own.

-John

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Wednesday, July 31, 2002 10:47 AM
> To: Melinda Shore

---

From: [email-masked]
Date: Wed, 31 Jul 2002 14:43:44 -0500

John,

My initial reaction is that I agree that if there's only two realms,
the number of interfaces onto which they map and how they map is an
implementation issue. But I want to think about it just a bit more
to be sure.

But what if the middlebox supports more than two realms? That's the
real issue that I was trying to get to.

Jim

John LaCour <[email-masked]> on 07/31/2002 01:06:30 PM

Sent by:  John LaCour <[email-masked]>

To:   James Renkel/MW/US/3Com, Melinda Shore   <[email-masked]>
cc:   midcom <[email-masked]>
Subject:  RE: [midcom] Questions on middleboxes with more than 2 interfaces

-John