RE: [EME] Traversing HIP-aware NATs and Firewalls: Problem Statement andRequirements

Something along the lines of >
http://www.ambient-networks.org/docs/Advanced_HIP_based_Firewall_Traversal.pd
f would be interesting in the context of NUTSS...allows middleboxes to do
per-packet authentication without requiring recursive/nested IPsec tunnels...

PF

> -----Original Message-----
> From: Hannes Tschofenig [mailto:Hannes.Tschofenig@gmx.net] 
> Sent: Tuesday, June 19, 2007 3:11 AM
> To: Paul Francis
> Cc: eme@irtf.org
> Subject: Re: [EME] Traversing HIP-aware NATs and Firewalls: 
> Problem Statement andRequirements
> 
> Hi Paul,
> 
> Paul Francis wrote:
> > Hi Hannes,
> >
> > I'm responding to your emails out of order...
> >
> > This draft certainly is relevant.  I would not claim to have been 
> > intimately familiar with it when we wrote the EME drafts, 
> but speaking 
> > for myself I was vaguely aware of it.  (As you can see, we 
> were quite 
> > lazy about citing much of anything.  Especially the design draft is 
> > meant to trigger getting feedback...it is certainly our 
> intent to do a 
> > better job with citations once we think we are on the right track.)
> >   
> Hmmm.
> 
> > As far as the HIP nat traversal stuff relates to NUTSS, Am 
> I right in 
> > saying that it suffers from the problem of assymetric paths 
> (i.e. with 
> > multihomed sites)?  If this is the case, then NUTSS seems very 
> > complimentary to HIP (as Tom and others are suggesting).
> >   
> It depends what you call "suffer". There are various ways to 
> solve these problems. It is just not beautiful when 
> NAT/Firewall traversal is dumped into HIP. It works nicely 
> when you use other protocols that are designed for this purpose.
> 
> On the other hand, stateful packet filtering firewalls just 
> don't work nicely with asymmetric paths. It's just the way 
> how they work; it's their purpose.
> 
> > Sorry if this is a stupid question, but am I right in assuming that 
> > with hip nat/fw traversal, the middleboxes can authenticate the HIP 
> > setup, but not data packets themselves (which after all are vanilla 
> > IPSec packets)
> >   
> That's true unless you use
> * digitally sign each packet
> * Establish IPsec tunnels recursively, or
> * use something similar to the stuff suggested in 
> http://www.ambient-networks.org/docs/Advanced_HIP_based_Firewa
> ll_Traversal.pdf 
> 
> 
> But again, there is the question why you actually need this 
> functionality.
> 
> 
> Ciao
> Hannes
> 
> > PF
> >
> >  
> >
> >   
> >> -----Original Message-----
> >> From: Hannes Tschofenig [mailto:Hannes.Tschofenig@gmx.net] 
> >> Sent: Monday, June 18, 2007 4:09 PM
> >> To: eme@irtf.org
> >> Subject: [EME] Traversing HIP-aware NATs and Firewalls: 
> >> Problem Statement andRequirements
> >>
> >> This document might be related and relevant:
> >> http://www.tschofenig.com/drafts/draft-tschofenig-hiprg-hip-na
> >> tfw-traversal-04.txt
> >>
> >> I wonder whether someone ever looked at it.
> >>
> >>
> >>
> >> _______________________________________________
> >> EME mailing list
> >> EME@irtf.org
> >> https://www1.ietf.org/mailman/listinfo/eme
> >>
> >>     
> 
> 

_______________________________________________
EME mailing list
EME@irtf.org
https://www1.ietf.org/mailman/listinfo/eme