Re: [bmwg] WGLC on New version of draft-ietf-bmwg-ngfw-performance

[Gábor LENCSE <[e-mail]>]

Dear Sarah,

Please see my comments and suggestions in-line.

2021.07.16. 20:09 keltezéssel, Sarah Banks írta:
[...]
>
> SB// I support the draft as a draft that covers benchmarks that cover 
> specifically NGFW and NGIPS, provided the scope is not open ended to 
> cover the undefined "NG*" and future devices that we haven't invented 
> yet. :)
>

First of all, let me admit, that when I read the draft, I was not so 
careful as you. I have silently accepted the implicit definition of 
"next-generation firewall", and did not check what the term was used 
for. Now, I tried to find a formal definition, but I was not really 
successful.

What I found: https://en.wikipedia.org/wiki/Next-generation_firewall

As I teach my students not to use Wikipedia as a reference (e.g. because 
it is not a stable document), but rather read its sources, I tried to do 
the same.

For example, its first source is: 
https://www.esecurityplanet.com/products/intro-to-next-generation-firewalls/

It seems to me that the definition of NGFW is rather informal, 
especially from the following paragraph:

"These application-aware firewalls are commonly cited as a 
next-generation firewall (NGFW) but they are, basically, a form of a 
unified threat management (UTM) solution. However, the term UTM is 
usually applied to products that lack the true application-awareness and 
are targeted towards the SMB market. UTM products usually offer 
additional functions over traditional firewalls, such as antivirus, 
antispam, or even intrusion prevention systems (IPS)."

As an academic, I really appreciate your earlier suggestion that the 
draft should contain a definition of the term NGFW, however, as this 
term seems to be rather loosely defined, perhaps the Authors could 
include a sentence describing the situation. E.g. something like:

Next-generation firewall (NGFW): This term is widely used for the 
modern, state-of-the-art technology firewalls (as of 2021) that can do 
application-level traffic inspection including several, sometimes 
optional features. (Perhaps a few of them could be listed here.)

I just intended it a sample, what I want to suggest is that the daft 
should say something about what the term is used for, but admitting that 
it is not a formal definition.

What do you think of it?

As for your concerns about the technologies yet to be invented, my past 
experience suggests that new technologies are likely to be invented and 
they will likely make the draft obsolete. Or at least it should be 
updated. (In the same way as with RFC 2544, RFC 5180, RFC 8219.) The 
above definition (or something similar) could make it clear that we do 
not believe to define a benchmarking methodology for the eternity. :-)

Best regards,

Gábor