Re: [OFF-PATH-BOF] How does an endpoint discover a local policy by DHCP?

[Saikat Guha <[e-mail]>]

On Mon, 2006-09-18 at 08:27 -0400, Scott W Brim wrote:
> On 09/18/2006 07:18 AM, Paul Francis allegedly wrote:
> > I don't think any of us envisioned that an endpoint would learn policy via
> > DHCP.
> 
> Rather, a policy server?

If the question is how someone learns of which policy server to use ...

Signaling packets go 1) up, 2) across, and 3) down; and the next-hop
policy server on each segment is determined differently.

1) UP: Drilling out towards the Internet through multiple layers of
firewalls ... a packet (any packet) is sent outwards, a firewall/M-Box
intercepts it and responds with an ICMP-like error message that informs
the source what policy server to contact for auth.

2) ACROSS: Packet goes from internet-facing firewall of the stack of
firewalls for the source to the internet-facing firewall of the
recipient. The signaling server for the recipient's domain is resolved
over DNS through SRV-type records.

3) DOWN: Drilling down to the destination through multiple firewalls.
When the destination registers its presence it creates a chain of
registrations to the internet-facing signaling proxy for his domain
(chain discovered through the drill-out in #1 above). The signaling
packets bound for the destination follow the reverse route of the
registration-chain.

-- 
Saikat

_______________________________________________
OFF-PATH-BOF mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/off-path-bof