RE: Purpose of ALD (was Re: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03)

["Dan Wing" <dwing@cisco.com>]

> I'm actually making a somewhat stronger statement.
> 
> I'm saying that the Purpose of ALD is *NOT* for interior nodes to  
> control their corresponding states in filtering middleboxes, but  
> rather for middleboxes to learn about state at interior nodes 
> relevant  
> for network filtering.  The design of ALD is a reflection of this  
> statement of purpose, which is why it defines no mechanism for  
> informing endpoint nodes whether and/or why not filtering rules have  
> changed as a result of the notifications they send.
> 
> I don't mean to sound like I'm picking nits, but I really do think  
> it's a big mistake to formulate the problem statement around a  
> perceived need for endpoint nodes to "control" the state of  
> middleboxes.  I contend there is no such need.  There is only a need  
> for filtering middleboxes to be better aware of endpoint 
> state so that  
> they do not intrude on network transparency unnecessarily, i.e. when  
> security policy does not require it.

Understood.  Thanks for clarifying!

-d