Re: [pntaw] New version of draft-hutton-rtcweb-nat-firewall-considerations

[Oleg Moskalenko <[e-mail]>]

On Sun, Sep 22, 2013 at 10:47 PM, Melinda Shore <[e-mail]>wrote:

> but you all seem to want to extend it to allow
> operation across firewalls *which by policy do not permit
> the traffic in question*.  It's probably too late to do much
> about it but I hope that you're having lots of conversations
> with lots of enterprises whose firewalls you're planning on
> forcing your way through, to make sure that they're on board
> with this.
>
>
Melinda, you are assuming that the policies are a precise accurate
instrument that can be used to set the exact network access rules.

They are not. The reality is that the modern state of network policies is
rather behind the real-world requirements.

I suppose that a real solution would be an "enterprise TURN server" that is
located in the DMZ, and that routes all the TURN-related traffic and the IT
department will handle the policies on the TURN server: user database,
quotas, black and white IP lists, etc. The enterprise IT department is
always free to set such a TURN server. That would merge the two worlds,
perfectly. If they do not want to get into TURN server setup, but there is
a requirement for TURN operations, then there are these new draft specs for
"external" TURN servers.

I've been thinking and working on an "enterprise TURN server" for a while
and I think that eventually the companies will start setting them.