Re: [MEXT] WGLC for firewall drafts

[Yuri Ismailov <[e-mail]>]

Hi,
I reviewed the draft draft-ietf-mext-firewall-admin-02.
The document looks quite solid and addresses all important issues.

However, there is one issue, in my opinion, which was left aside in the
draft.
I think that the section 6.2 should be completed with the recommendations
about letting specific ICMPv4 error messages to pass through firewalls.
This has
to do with the path MTU discovery. Because this draft is concerned the
firewall traversal, there is no need to talk about MTU tuning, however,
I believe that firewall traversal is worth while mentioning.
There is a reference to RFC 4890 at the end, which is concerned with
ICMPv6 only.
When using DSMIPv6 with NAT traversal, ICMPv4 error messages regarding
MTU size
could be sent as well. Thus the suggestion is to additionally refer the
specifications
RFC1191 and RFC1981, specifying path MTU discovery for IPv4 and IPv6
correspondingly.

I suggest to add some text (see proposal below) at the end of the
section 6.2, which specifically addresses data packets for DSMIPv6.
Signaling packets probably not that important as MTU sizes will not be
exceeded,
or in case it will happen, the result will be anyway ICMPv4 error
messages as
signaling will be UDP encapsulated as well.

Proposed text at the end of the section 6.2

When using DSMIPv6 with NAT traversal, the MTU sizes and correspondingly
Maximum
Segment Size (MSS) for TCP will have to be reduced due to the number
of encapsulation headers in the data and signaling packets. This creates
a need
for path MTU discovery (RFC1191, RFC1981) to be supported in the
infrastructure
for visited networks and HA as well. As DSMIPv6 NAT traversal mechanism
suggests
using IPv4/UDP encapsulation of packets, the above mentioned path MTU
discovery
procedure may involve ICMPv4 "Destination Unreachable, fragmentation
needed and DF set"
(RFC792) message to be returned to the sender. This message may be sent
by any node
along the path including mobile node itself. In the case mobile node
resides behind
firewall, the firewall should let this type of packet (ICMP type 3, code
4) through,
in order the messages could reach the sender. The same recommendation
applies to the
firewalls in mobile's node Home Network.


Regards
Yuri


marcelo bagnulo braun wrote:
> This is the WGLC for the two drafts related to firewall and MIPv6 i.e.
> draft-ietf-mext-firewall-admin-02.txt and
> draft-ietf-mext-firewall-vendor-02.txt.
>
> Please review the documents and send comments until Feb 15.
>
> For you convenience, the drafts can be found at:
>
> http://www.ietf.org/id/draft-ietf-mext-firewall-admin-02.txt
> http://www.ietf.org/id/draft-ietf-mext-firewall-vendor-02.txt
>
> Regards, marcelo
>
>
> _______________________________________________
> MEXT mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/mext
>