[bmwg] New version of draft-ietf-bmwg-ngfw-performance

[[e-mail]]

Folks,

 

The latest draft has been posted and is ready for review. The Diff between
version 7 and version 8 can be found here:

 

https://tools.ietf.org/rfcdiff?difftype=--hwdiff
<https://tools.ietf.org/rfcdiff?difftype=--hwdiff&url2=draft-ietf-bmwg-ngfw-
performance-08.txt> &url2=draft-ietf-bmwg-ngfw-performance-08.txt 

 

and here:

 

https://tools.ietf.org/rfcdiff?url2=draft-ietf-bmwg-ngfw-performance-08.txt

 

Please review and provide comments. I believe Al Morton is going to call for
last call.

 

Brian

 

>>> 

 

The following comments were made by Petr Redkin. Each comment is followed by
our response - changes were made to the draft as indicated.

 

1.	TLS SNI

a.	in part of the document SNI is mandatory

The client endpoint SHOULD send TLS Extension Server Name Indication (SNI)
information when opening a security tunnel

b.	in part of the document SNI is optional

For TLS the client MAY use Server Name Indication (SNI).

 

[Comment] The confusion or inconsistency has occurred since we use SNI as
mandatory for a test scenario (traffic mix test) and as optional for other
test scenarios. We will revise the text and provide more clarity in the next
version.

 

2.	New connections in sustain phase

a.	From this sentence engineer may assume, that no new connections are
established in sustain phase because all clients & connections (it is
different concepts) must be established at a ramp up

Sustain phase starts when all required clients (connections) are active and
operating at their desired load condition.

b.	But it is not, otherwise we cannot measure CPS metric in sustain
phase, for example in traffic mix test

Optional KPIs: TCP Connections Per Second and TLS Handshake Rate

 

[Comment] The sentence doesn't describe that the client must keep the
connections open during the sustain phase. However, we can change the
sentence as follows:

 

"Sustain phase starts when all required clients (connections) are active and
operating at their desired load condition."

This means that the clients/client endpoints are established their required
target connection (based on configured load). It is obvious that the clients
will close the connections once they received all contents from the server.
Also, the clients will establish new connections during the sustain phase.
Otherwise, there is no traffic in the sustain phase and the test equipment
can't keep the desired load.

 

 

3.	Client source port

a.	In part of the document source port is variable in range and varies
per client connection

The source port range SHOULD be in the range of 1024 - 65535. 

The behavior of the client is to sweep through the given server IP space,
sequentially generating a recognizable service by the DUT.  Thus, a
balanced, mesh between client endpoints and server endpoints will be
generated in a client port server port combination.

b.	But it is not clear from this sentence

Each client endpoint performs the same actions as other endpoints, with the
difference being the source IP of the client endpoint and the target server
IP pool.

 

[Comment] The endpoints perform the same action. However, the IPs (SRC and
DST) and also ports (random source port from the range) are different. we
can change the text if more clarity required.

"Thus, a balanced mesh between client endpoints and server endpoints will be
generated in a client IP/port server IP/port combination.

 

Additionally, in the Introduction section we changed ".this document
supersedes [RFC3511}" to ".this document obsoletes [RFC3511].

 

 

 

 

 

---------

Brian Monkman

Executive Director, NetSecOPEN

Office: [phone] 

Fax: [phone]

Mobile: [phone]

 



 <https://www.netsecopen.org> https://www.netsecopen.org