Re: [OPSAWG] I-D Action: draft-gont-opsawg-firewalls-analysis-01.txt

[Melinda Shore <[e-mail]>]

On 10/19/15 3:16 PM, Mark Andrews wrote:
> When one actually wants to use the capabilities we built into the
> protocol one then has to fight the firewalls even to get the packet
> delivered.  Cleaning out old/broken firewalls takes decades.

Right, but vendors do love their firewalls.  It can take an
inordinately long time to get IETF documents out (longer than
it takes to design and implement a product feature) and vendors
are likely to release products that break DNS before a firewalls
draft is done.

I've been watching this discussion and getting a strong sense
of déjà vu, and I think this is going to be a difficult document
to get through the IETF process.  It may be preferable, anyway,
to focus on a series of protocol- or application-specific
firewall problems documents - for example, to move a firewall
considerations for DNS document to dnsop.  It may be the only
way to get consensus about content.

Melinda