Re: [OPSAWG] I-D Action: draft-gont-opsawg-firewalls-analysis-01.txt

[Fernando Gont <[e-mail]>]

Hi, Melinda,

Thanks so much for your feedback! Please find my comments in-line....

On 10/19/2015 08:55 PM, Melinda Shore wrote:
> On 10/19/15 3:16 PM, Mark Andrews wrote:
>> When one actually wants to use the capabilities we built into the
>> protocol one then has to fight the firewalls even to get the packet
>> delivered.  Cleaning out old/broken firewalls takes decades.
> 
> Right, but vendors do love their firewalls.  It can take an
> inordinately long time to get IETF documents out (longer than
> it takes to design and implement a product feature) and vendors
> are likely to release products that break DNS before a firewalls
> draft is done.

I think that even with some of the content that we have, plus more
specific stuff (possibly in separate document(s)), at least we have
something to point vendors at.



> I've been watching this discussion and getting a strong sense
> of déjà vu, and I think this is going to be a difficult document
> to get through the IETF process.  It may be preferable, anyway,
> to focus on a series of protocol- or application-specific
> firewall problems documents - for example, to move a firewall
> considerations for DNS document to dnsop.  It may be the only
> way to get consensus about content.

The goal of this document is, to some extent, mostly a high-level
discussion. More detailed stuff should probably be done in separate
documents, and just referenced from this one to keep the problem
"tractable".

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492