[Netrqmts] netrqmts - on the issue of firewalls

[Toerless Eckert <[e-mail]>]

Hi folks

Wrt IETF network and firewalls:

Let me start:

There is nothing wrong with a draft saying 
  There MUST be network options that do not prohibit end-to-end and external connectivity for
  any traffic (no limiting firewalls or NATs).

Its a different thing to say what the current draft says:
  The network MUST NOT prohibit end-to-end and external connectivity for
  any traffic (no limiting firewalls or NATs).

which implies i think "for all VLANS/SSID" (e.g. IETF and IETF-hotel).

The notion of unrestricted Internet access is cool for all those people
who managed to figure out this mailing list exists, but i am sure the
mayority of IETF attendes does not know it exists, does not really know
what the policies are, and would even start wondering if they match
what does keep their notebooks safe. Yes. 10 years ago the number of IETF
participants bothering about this was larger, but we are moving more into
"application" space, where some form of "normal" == "protected" Internet
access is a i think more likely than with traditional IETF folks coming
from routing and wanting to smell the unlimited freedom at least for a
week.

So, the best solution would be to hand out a welcome sheet during
registration:

  Welcome to the IETF network. Let your notebook for the first time
  in its life experience what otherwise is a privilege of your
  home/hotel/hotspot gateway/access-point: The pure evil of the Internet
  and its attacks. Experience how a flat broadcast domain of hundreds of
  users with link-layer multicast and broadcast allows to fully explore
  this evilness much faster. Especially with likely 20% or more infected
  computers with some form of virus and 10% users thinking 
  attacks can be a great hobby. Enjoy!

The second best option of course would be to have some form of SSID
with a firewall (just simple no outside to inside initiated flows)
and no inside<->inside traffic. Which i know is heresy against tradition,
but somehow part of how today >99.999% of users equipment of this
network technolgy we all live off are connected.

Or: Why is it a good tradition to ONLY establish a form of 
access that represent <0.000% of how end systems are attached ?

OF course we MUST have the unrestricted option for experimentation,
but when folks experiment with RTCweb/ICE/STUN/etc they probably 
would have been happy to have firewall options too given how they
must work with them in the real world, so don't tell me there is
no value of firewall for experiments. It just depends on what 
experiment you want.

As a simple way i woud suggest to make ietf-hotel protected, and leave
the other SSIDs as they are. Of course its clear this might be diffult
depending on how IETF integrates with existing hotel network, but
given how seemingly hotel APs can be reconfigured with ietf-hotel
SSID, i am sure L2 properties can also be reconfigured.

Cheers
    Toerless

Disclaimer: All number in this research papers have been pulled out of thin air
within a matter of seconds, but it should be hard enough to prove them wrong
that no funding for longer research could be allocated.