Re: I-D.ietf-v6ops-cpe-simple-security-09

[Mark Smith <[e-mail]>]

On Mon, 22 Mar 2010 06:29:01 +1300
Brian E Carpenter <[e-mail]> wrote:

> On 2010-03-22 02:38, Gert Doering wrote:
> > Hi,
> > 
> > On Sun, Mar 21, 2010 at 01:19:50PM +1300, Brian E Carpenter wrote:
> >> Indeed. But ISPs that supply CPE to their customers are going to
> >> assume that their customers are running unpatched insecure operating
> >> systems at high risk of catching malware. So I think they are just as
> >> likely as enterprise IT departments to favour default deny approaches.
> > 
> > We're not.
> > 
> > We provide *Internet* services.  Not "walled garden" services.
> > 
> > If the customer wants firewall protection, we're happy to sell it to them,
> > but the default package they get is "Internet".  Packets transported from
> > A to B and vice versa, and we're not maing their packets unhappy unless they
> > tell us so.
> 
> I applaud that and it's what I want from my ISP. My comment is that
> I don't see this as a universal approach.
> 
> So, I'm wondering what's really wrong with:
> 
>   REC-41  Gateways MUST provide an easily selected configuration option
>       that permits operation in a mode that forwards all unsolicited
>       flows regardless of forwarding direction.
> 

I don't see anything wrong with it. That the "Vanilla Router"
checkbox. In some respects is equivalent to bridge mode on ADSL
routers today, which allow end-hosts to terminate the PPPoE/PPP
sessions, rather than have the upstream ADSL router do it.

Regards,
Mark.