RE: [NSIS] NATFW NSLP; ingress filtering

Hi,

I also don't see that this section adds much to the 
understanding of how to implement or deploy the protocol.

However, its presence did remind me that there is a related
use of ingress filtering to prevent traffic injection in 
the signalling plane - i.e. sending a packet with a header
that is legitimate at the IP level but which refers to 
traffic (via the included MRI) which the signalling source
cannot have any proper interest in. The filter check is
carried out by GIST (see section 5.8.1.2 of the spec), but
it's left up to the NSLP to decide whether to drop the message
as a result. I wonder whether the corresponding NSLP/GIST
interaction should be mentioned somewhere here - it's 
probably more relevant to the other threats (e.g. 5.5.5).

r.

PS two typos at the top of p83, 'IPy' and 'match ,'

> -----Original Message-----
> From: Hannes Tschofenig [mailto:Hannes.Tschofenig@gmx.net] 
> Sent: 21 April 2006 13:03
> To: Ali Fessi
> Cc: nsis
> Subject: Re: [NSIS] NATFW NSLP; ingress filtering
> 
> 
> I agree with you.
> This helps to shorten the document.
> 
> Ali Fessi wrote:
> > Hi,
> > 
> > in Section 5.12, there is an extensive explanation of the 
> term "ingress 
> > filtering" with a figure 46.
> > 
> > I think "ingress filtering" is so common. There is actually 
> no need to 
> > have such an explanation in the draft.
> > 
> > a reference, for example to RFC 2827, could be more appropriate.
> > 
> > Cheers,
> > ali
> 
> 
> _______________________________________________
> nsis mailing list
> nsis@ietf.org
> https://www1.ietf.org/mailman/listinfo/nsis
> 

_______________________________________________
nsis mailing list
nsis@ietf.org
https://www1.ietf.org/mailman/listinfo/nsis