Re: [pntaw] More on draft-hutton-rtcweb-nat-firewall-considerations

[Melinda Shore <[e-mail]>]

On 9/24/13 9:11 AM, Tirumaleswar Reddy (tireddy) wrote:
> Agreed. The firewall problem is solved by the technique proposed in
> draft http://tools.ietf.org/html/draft-wing-pcp-third-party-authz-01.
> This draft describes the mechanism for firewalls to only permit UDP
> media session associated with specific WebRTC servers. This addresses
> the firewall problem in Enterprise network without having to do DPI
> on WebRTC signaling protocol.

There's a lot of history here.  pcp was preceded by midcom,
which did the same thing but failed to get any uptake at all
other than briefly appearing in Asterisk.  There were two
reasons for midcom's failure: 1) it used SNMPv3 for transport,
which everybody hated, and 2) it required a forklift network
upgrade.  You wouldn't be able to buy a VoIP system that
used it without also upgrading all your firewalls.

Midcom was standardized in the transport area and it seems
unlikely to me that pcp would have been chartered if they'd
gone back to the transport area, or if the ADs who'd run
the transport area at the time midcom was in business were
still in office.  When pcp was in charter discussions I asked
Jari, who was internet AD at the time, why he thought this
would succeed where midcom had failed and he really didn't
have an answer for that other than his personal optimism.

I worked for Cisco during this and what I heard from product
managers was that they had no interest in undermining the
value in their inspection technology by allowing entities
outside the firewall (including other Cisco devices - this
is one of the prices of corporate Balkanization) to make
decisions about what traffic should be permitted.  Unless
that situation has changed you're likely to encounter the
same resistance.  That said, that said, the popularity of
unilateral hole-punching technologies, that do not consult
the firewall, might be the right argument for something like
midcom or pcp.  But if I were a betting person I would not
bet on firewalls supporting  pcp hitting the market any
time soon (and to be clear, I think that's unfortunate
because I do think that's the better solution to the hole
punching and NAT mapping installation problem, even if it
was already standardized about a decade ago).

In the future there may be a better solution still based
on something like VNF.

But there's a long history here, as I said, and there may or
may not be something to learn from it.

Melinda