RE: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03

["Dan Wing" <dwing@cisco.com>]

> -----Original Message-----
> From: Gert Doering [mailto:gert@space.net] 
> Sent: Wednesday, August 27, 2008 2:12 AM
> To: Rémi Després
> Cc: Gert Doering; Dan Wing; 'Truman Boyes'; 'Brian E 
> Carpenter'; 'Mark Smith'; jhw@apple.com; 'IPv6 Operations'
> Subject: Re: Some suggestions for 
> draft-ietf-v6ops-cpe-simple-security-03
> 
> Hi,
> 
> On Wed, Aug 27, 2008 at 10:51:04AM +0200, Rémi Després wrote:
> > >What is "internal to external" is inevitably "external to 
> internal" to
> > >someone else.
> > >
> > >How do you solve "tunneling is permitted if solicited from 
> the inside" for 
> > >the
> > >
> > >  Host A --- CPE A ----[Internet]---- CBE B --- Host B
> > >
> > >case?
> > 
> > In my understanding, there is no ambiguity.
> [..]
> >
> > Filtering control, if not dministrative, should always come 
> from the 
> > internal side (from A to CPE A, from B to CPE B).
> 
> Staying in the context of the original discussion: if you 
> want to permit
> tunneled packets for IPv6 (or other) purposes, but at the 
> same time insist
> that "packets must be solicited from the internal side", how 
> do you make
> the scenario above work?
>
> That was my whole point.  The argument "the CPE will know 
> what the host
> wants to receive" doesn't work for enduser-to-enduser traffic, unless
> you have a signalling mechanism.  

Right - we need a signaling mechanism (something like Apple's
ALD, which is described in the draft).

> Or you just permit tunnels.

I don't understand why a tunnel should get an excemption from 
Simple Security.  A tunnel can be used as an attack vector as
easily as native protocols (Netbios, FTP, HTTP, or NFS server).

-d

> Gert Doering
>         -- NetMaster
> -- 
> Total number of prefixes smaller than registry allocations:  128645
> 
> SpaceNet AG                        Vorstand: Sebastian v. Bomhard
> Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. 
> Grundner-Culemann
> D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
> Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279
>