Re: [pntaw] New version of draft-hutton-rtcweb-nat-firewall-considerations

["Chenxin (Xin)" <[e-mail]>]

Hi, 

>Hi,
>
>Melinda Shore wrote:
>>
>> On 9/22/13 10:41 PM, Oleg Moskalenko wrote:
>> > Melinda, you are assuming that the policies are a precise accurate
>> > instrument that can be used to set the exact network access rules.
>> >
>
>I agree it is hard to determine what the policy is based on the actual firewall etc.
>rules. For instance if all UDP is blocked may not necessarily mean that the high
>level policy is that VoIP is not allowed. Or, on the other hand, if outbound HTTPS
>to port 443 is open, it does not necessarily mean that the policy is to allow
>whatever apps to tunnel whatever traffic that way.
[xin] yes, we should not focus on the firewall administrator policy, which is hard and should not be judged by us. If the IT admin wants, they always have methods to block webrtc data no matter by http connect or https or turn over websocket.
	Considering webrtc is a web application. A normal or fall-back media or data channel based on web should be considered, it is one benefit of *web*rtc. I think this is the key point we should discuss more. Websocket is a bidirection channel for web, which is wildly used as webrtc signaling channel. It is also really more convenient to carry webrtc data in it as a bidirection channel. I believe it will be better to consider more far for future. 
    About the change to turn server. It is better to add the function to turn server but add a websocket to tcp proxy(websockify) before turn server also work for existed deployment. We are working on this, and will give a simple prototype to validate it.
>
>> > They are not. The reality is that the modern state of network policies
>> > is rather behind the real-world requirements.
>>
>> My comfort level with telling people who run networks that their network
>> access management policies and technologies are behind the times and
>> because we know better then they do about these things it's fine if we
>> punch holes in their firewalls without asking is not very high, to be honest.
>>
>
>While I'm in general supportive to the proposals in draft-hutton-, I also agree we
>need to consider the network admin's perspective as well.
>
>There will be networks and administrators that explicitly want to restrict
>WebRTC. I think one part of the WebRTC firewall traversal "solution" needs to
>be an explanation HOW they can do it.
[xin] I think Markus pointed out an important things. We should discuss about it more to decide if these works is necessary. If media or data of VOIP through http or websocket channel is new thing for firewall, It is better to clarify it , because our target is give a web-fallback channel for a web application.

Regards,
  Xin
>
>Markus
>
>_______________________________________________
>pntaw mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/pntaw