Re: [bmwg] NGFW Security Features Text

["MORTON, ALFRED C (AL)" <[e-mail]>]

Hi Tim,

Thanks for doing your volunteer work with this review, much appreciated!

May I make a small suggestion on your proposed text?
I think we achieve some clarity if we add “limit” near the end:

s/ this MAY be configurable../ this limit MAY be configurable./

assuming that’s what you meant!

thanks again and regards,
Al


From: bmwg [mailto:[e-mail]] On Behalf Of Timothy Carlin
Sent: Tuesday, June 2, 2020 12:45 PM
To: [e-mail]
Subject: [bmwg] NGFW Security Features Text

Hi all,

I wanted to mention that I have read draft-ietf-bmwg-ngfw-performance-03 and I support it.

I have additional text I would like to suggest be included to help to clarify an ambiguity with regards to security feature processing.  Specifically, in the case that a DUT discontinues processing a security feature (for example, SSL Inspection), traffic should still be processed by the remainder of the applicable security features.  Said another way, the traffic should NOT "fail open".

Here is some proposed text to add to Section 4.2, in the itemized list as the 2nd item (below "All security inspection enabled"):

==
* All applicable traffic MUST be processed by the configured security feature(s) in table 1.  In the case that applicable traffic can no longer be processed for a given security feature (e.g. due to processing or throughput limits, etc.), the portion of traffic which exceeds the limit SHOULD be blocked and this MAY be configurable..
==

Please let us know if you have any questions or comments.

Best Regards,
Tim C.
UNH-IOL