Re: Is Fragmentation at IP layer even needed ?

[Joe Touch <[e-mail]>]

On 2/11/2016 6:05 AM, Masataka Ohta wrote:
> Joe Touch wrote:
> 
>> I repeat: nodes that encap or decap are acting as sources or sinks, not
>> relays.
> 
> I'm afraid firewalls are relays.

A firewall that filters on L3 is a router regardless of which side you
look at.

A firewall that encaps/decapsulates is a host on the public side and a
router on the private side. A firewall that inspects beyond L3 is a host
as well, for similar reasons.

So the term "firewall" isn't the issue; it's the behavior that is.

>> Nodes such as NATs and firewalls act as end hosts on the public side and
>> routers on the private side. Which is why they need to obey RFC1122
>> semantics on the public side.
> 
> So, you think firewalls should reassemble fragments. Wow!

And yet that is exactly the correct conclusion regarding most behaviors
that firewalls perform that act like end hosts. Once you realize that
inspecting L4 or encaps/decaps is acting like a host, the requirements
become very clear - even if you don't like them.

So yes, a firewall that inspects L4 or encap/decaps either needs to
reassemble fragments or act like that's what's happening (e.g., to
retain a copy of the first fragment of a set to direct later fragments
within that set).

The model takes you to exactly the right conclusion.

Joe