[shara] draft-thaler-port-restricted-ip-issues: Host Implementation Issues

[<[e-mail]>]

Dear Dave,

In your draft, you wrote: "To actually apply a port restriction, host stack implementations
   would need to change.  Without such a change, a host may naturally
   attempt to use the IP address with arbitrary protocols and ports,
   which would be akin to address spoofing in a port-restricted IP
   address model."

For fixed networks, several scenarios for the deployment of port restriction may be considered. Host-based model is one flavour among others.
 
For the CPE-based model, port-restriction features are not required to be supported by the hosts behind the CPE since port-restriction are to be enforced in the CPE: No changes are required for the hosts in such scenario.

For the host-based model (e.g., mobile networks), I agree that port-restriction feature is required to be supported by the host. Some modifications are needed (FYI, port-restriction feature may be activated by entering two IPTABLES lines in Linux-based Oses.). These modifications are to be positioned against expected gains such as:

- Battery consumption for mobile devices because keepalive messages to maintain NAT entries are avoided (in NAT-based solutions, "Always-on" services would impact severely the battery consumption. Not to mention several layers of keepalive messages: e.g., IPsec, SIP )
- No need to embed ALG in intermediary nodes. 
- No need to embed NAT traversal technique in the host
- No latency due to retrieving the perceived IPv4 public address (to be assigned by the NAT)
- Session tracking issues: It is not required to maintain per-session tracking information (legal requirement)
- Etc.  

Cheers,
Med

*********************************
This message and any attachments (the "message") are confidential and intended solely for the addressees. 
Any unauthorised use or dissemination is prohibited.
Messages are susceptible to alteration. 
France Telecom Group shall not be liable for the message if altered, changed or falsified.
If you are not the intended addressee of this message, please cancel it immediately and inform the sender.
********************************