Re: [secdir] secdir review of draft-ietf-opsec-protect-control-plane-04

[Sean Turner <[e-mail]>]

Note that the example filters in the Appendicies will also need to be fixed.

spt

On 12/14/10 11:04 AM, Ronald Bonica wrote:
> Authors,
>
> I think that we can correct this problem with an RFC editors note before the telechat on Thursday. Could one of you please provide the updated text?
>
>                                      Ron
>
>
>> -----Original Message-----
>> From: [e-mail] [mailto:[e-mail]] On Behalf Of
>> Sean Turner
>> Sent: Tuesday, December 14, 2010 10:51 AM
>> To: Glen Zorn; [e-mail]
>> Cc: [e-mail]; [e-mail]; [e-mail]
>> Subject: Re: secdir review of draft-ietf-opsec-protect-control-plane-04
>>
>> I hoping that this was a typo.  I pulled out all the registered RADIUS
>> ports from http://www.iana.org/assignments/port-numbers and 1645/1646:
>>
>> sightline       1645/tcp  SightLine
>> sightline       1645/udp  SightLine
>> #                         admin<iana&sightlinesystems.com>
>> sa-msg-port     1646/tcp  sa-msg-port
>> sa-msg-port     1646/udp  sa-msg-port
>> #                         Eric Whitehill<Eric.Whitehill&itt.com>
>>
>>
>> radius          1812/tcp    RADIUS
>> radius          1812/udp    RADIUS
>> #                           [RFC2865]
>> radius-acct     1813/tcp    RADIUS Accounting
>> radius-acct     1813/udp    RADIUS Accounting
>> #                           [RFC2866]
>> radsec          2083/tcp   Secure Radius Service
>> radsec          2083/udp   Secure Radius Service
>> #                          Mike McCauley<mikem&open.com.au>  May 2005
>> radius-dynauth  3799/tcp   RADIUS Dynamic Authorization
>> radius-dynauth  3799/udp   RADIUS Dynamic Authorization
>> #                          RFC 3576 - July 2003
>>
>> Should 1812&  1813 be listed or also 2083&  3799?
>>
>> spt
>>
>> On 12/14/10 1:39 AM, Glen Zorn wrote:
>>> I have reviewed this document as part of the security directorate's
>> ongoing
>>> effort to review all IETF documents being processed by the IESG.
>> These
>>> comments were written primarily for the benefit of the security area
>>> directors.  Document editors and WG chairs should treat these
>> comments just
>>> like any other last call comments.
>>>
>>> Section 3.1 says:
>>>
>>>      o  Permit RADIUS authentication and accounting replies from
>> RADIUS
>>>         servers 198.51.100.9, 198.51.100.10, 2001:DB8:100::9, and
>> 2001:
>>>         DB8:100::10 that are listening on UDP ports 1645 and 1646.
>> Note
>>>         that this doesn't account for a server using Internet Assigned
>>>         Numbers Authority (IANA) ports 1812 and 1813 for RADIUS.
>>>
>>> So, in other words, RADIUS traffic on the ports (officially assigned
>> for
>>> more than ten years now) will be blocked.  This seems like a very
>> poor
>>> example.
>>>
>>>
>>>
>>>
>