Re: [rtcweb] Usefulness of ICE-TCP (Was: Comments on draft-ietf-rtcweb-transports-01)

[Paul Giralt <[e-mail]>]

On Nov 13, 2013, at 2:57 PM, <[e-mail]> <[e-mail]> wrote:

> Hi Paul,
> 
>>> 
>>> So unless people have data that shows that "UDP blocked but direct TCP
>> allowed" is in itself a very rare setup (this is a question, I don't know that
>> either), I think ICE-TCP is definitely worthwhile for a WebRTC endpoint to
>> support.
>> 
>> This is actually a very common firewall configuration for enterprise
>> customers. Outbound TCP is allowed but UDP is blocked (even if UDP is
>> initiated from the inside).
>> 
> 
> Yes. UDP is blocked for sure and so is inbound TCP, so only outbound TCP is usable. However in many enterprises direct outbound TCP is not allowed but connection need to be made via an HTTP proxy. Do you (or someone else) have an estimate how often *direct* outbound TCP connections actually work?

If I had to guess it's a significant number of both cases. There is probably a majority (> 50%) overall that allow both TCP and UDP, but at least a good 30% are more restrictive to some degree. The very security-concious customers (think banks and other financial institutions as well as large retailers and even universities) usually leverage proxies, but there are also plenty of large enterprises that allow TCP but block UDP. In these cases, a direct outbound TCP connection would be allowed, at least on a well-known port number (e.g. 80, 443). I think for the case of ICE-TCP, however, we'd have to also think about how many would allow an outbound TCP connection to any ephemeral TCP port number. 

In the past, customers had been more concerned about stopping the bad guys from getting in, but not as worried about people on the inside getting out. Now customers are becoming increasingly worried about compromised hosts leaking information out of the network and are taking steps to restrict what kinds of things hosts can do going out, hence I think you will see these kinds of restrictions increase, not decrease. 

As a data point, Cisco's internal network allows outbound TCP only to pretty much any port number but does not allow outbound UDP (and uses WCCP to pass HTTP traffic through Ironport transparent web proxies for security filtering). 

-Paul