Re: [OPSEC] minutes part 2

> Hi Ran,
>  
> > On  16 Dec 2008, at 12:27, Vishwas Manral wrote:
> > > Thanks for the information about insider attacks. I have
> > raised issues
> > > with using IPsec ESP for OSPFv3 protection about 3 years 
> back, as we 
> > > cannot block packets in all such cases (as the firewall 
> may not know 
> > > of the contents inside the ESP packet).
> > 
> > Your claim above is not obvious.
> > Please explain when/why you believe the claim above is true.
> 
> It is impossible for firewalls and intermediate routers to 
> differentiate between encrypted ESP and ESP NULL packets by 
> simply examining them because of the way ESP is defined. This 
> poses problems for the firewalls since such packets (OSPFv3) 
> cannot be filtered and identified. 
> 

If this discussion is specific to ISPs needing to prevent customers from
attacking their IGP, then you are (I think) mistaken in specifying the
need for PE routers who implement infrastructure access control to
examine the data inside the packets.  There is no reason (aside from
lack of filtering features/performance on the PE) that a service
provider should let customer originated ESP packets be forwarded toward
its infrastructure.

If this is a more general discussion about network filtering of
ospfv3/ESP packets and intra-enterprise firewalling, then yes, I guess
it could be problematic.

-Darrel

_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec