[bmwg] Review and action items from NGFW draft discussion

bmonkman@netsecopen.org Mon, 02 August 2021 17:55 UTC

From: bmonkman@netsecopen.org
To: 'Sarah Banks' <sbanks@encrypted.net>
Cc: bmwg@ietf.org, "'MORTON JR., AL'" <acmorton@att.com>, 'Carsten Rossenhoevel' <cross@eantc.de>, 'Bala Balarajah' <bala@netsecopen.org>
Date: Mon, 02 Aug 2021 13:54:54 -0400
Message-ID: <099b01d787c7$807f7f80$817e7e80$@netsecopen.org>
MIME-Version: 1.0
Content-Type: multipart/related; boundary="----=_NextPart_000_099C_01D787A5.F9702970"
Thread-Index: AdeHx0G5aHgUbCxcRpiYf952OMNovA==
Content-Language: en-us
Archived-At: <https://mailarchive.ietf.org/arch/msg/bmwg/UIzxRLCq0B_rUAa6hq5TwOILWes>
Subject: [bmwg] Review and action items from NGFW draft discussion
Precedence: list

Sarah et al.

 

Below is a summary of the results of our discussions at the IETF 111 BMWG
meeting. You will need to access the slides for the proper context. The
slides can be found at:

 

https://datatracker.ietf.org/meeting/111/materials/slides-111-bmwg-benchmark
ing-methodology-for-network-security-device-performance-00

 

After the meeting, It now appears Sarah has three items to provide text for
- items 5, 6 and 9. Once we receive the proposed text for those items,
assuming we are all in agreement, we will be able to produce another draft.
Sarah, if possible, we would like to start working on the next version of
the draft on August 9th with a goal of posting it around August 15th.  Let
me know if that timeframe works for you. We have several other changes we
have to make as well.

 

Thanks in advance.

 

Brian

 

1.	Authors' Proposal: Define Next-generation firewall (NGFW) as: "This
term is widely used for the modern, state-of-the-art technology firewalls
(as of 2021) that can do application-level traffic inspection including
several, sometimes optional features."

 

Accepted.

 

2.	Authors' Proposal: Update list of security features that security
devices can have; describe that security devices must be configured in
in-line mode.

 

Accepted.

 

3.	Authors' Poposal: Clarify that passive security devices are out of
scope; explain more clearly that devices must be configured in "fail close"
mode.

 

Accepted.

 

4.	Authors' Proposal: No change to draft.

 

Authors' accepted suggestion that notes be added to the draft to clarify
testbed setup.

 

5.	Authors' Proposal: No change to draft.

 

Sarah to come back with proposed text.

 

6.	Authors' Proposal: No change to draft.

 

This is related to the above item and will be addressed by Sarah at the same
time.

 

7.	Comment withdrawn.

 

8.	Authors' Proposal: Explicitly remove IDS from scope..

 

Accepted.

 

9.	Authors' Proposal: No change to draft..

 

Sarah to come back with feedback and proposed text..

 

10.	Comment withdrawn.

 

11.	Authors' Proposal: Modify 7.1.1, 2nd paragraph, 1st sentence: "Based
on customer use case, users can choose the relevant application traffic mix
for this test. The details about the traffic mix MUST be documented in the
report. At least the following traffic mix details MUST be documented and
reported together with the test results.

 

Accepted.

 

 

---------

Brian Monkman

Executive Director, NetSecOPEN

Office: +1-717-610-0808 

Fax: +1-717-506-0460

Mobile: +1-717-462-5422

 



 <https://www.netsecopen.org> https://www.netsecopen.org

Attachment: image001.png

[bmwg] Review and action items from NGFW draft di… bmonkman
Re: [bmwg] Review and action items from NGFW draf… Sarah Banks

[bmwg] Review and action items from NGFW draft discussion

Attachment: image001.png