[bmwg] NGFW Security Features Text

[Timothy Carlin <[e-mail]>]

Hi all,

I wanted to mention that I have read draft-ietf-bmwg-ngfw-performance-03
and I support it.

I have additional text I would like to suggest be included to help to
clarify an ambiguity with regards to security feature processing.
Specifically, in the case that a DUT discontinues processing a security
feature (for example, SSL Inspection), traffic should still be processed by
the remainder of the applicable security features.  Said another way, the
traffic should NOT "fail open".

Here is some proposed text to add to Section 4.2, in the itemized list as
the 2nd item (below "All security inspection enabled"):

==
* All applicable traffic MUST be processed by the configured security
feature(s) in table 1.  In the case that applicable traffic can no longer
be processed for a given security feature (e.g. due to processing or
throughput limits, etc.), the portion of traffic which exceeds the limit
SHOULD be blocked and this MAY be configurable.
==

Please let us know if you have any questions or comments.

Best Regards,
Tim C.
UNH-IOL