Re: [v6ops] Dual ISP deployment operational issues and uncertainties

[Simon <[e-mail]>]

Nick Buraglio <[e-mail]> wrote:

> E2E is a non-starter for 99% of organizations. And, if history is an indication, the thought of operation without a firewall is borderline heresy. I've done talks on HPC networking about operating in an "open perimeter" manner for scientific data movement (i.e. using other mechanisms to achieve the same functions like black hole routing, host based firewalls, passive IDS), and even in the academic community operating without a middlebox is a totally foreign concept in all but the largest facilities, which in comparison to the rest of the internetworked world, is an absolutely miniscule number. 
> 
> (a) Where does e2e demand there is no network firewall?
> It doesn't. Perhaps I am being too strict in my definition - to me end to end means no middle boxes mangling packets i.e. an in-line network firewall that tracks state, very likely has some other inspection pieces and introduces latency and performance limits. I understand the host based firewalls are an important part of a defense in depth strategy. What I am specifically referencing are middle boxes.

How the goalposts are getting relocated again. We’ve been discussing mangling of packets - and specifically not network performance. Lots of things add latency to a network - not least sending packets over long distances.
Once you start using latency as a metric to be improved, then that’s an argument against firewalls, and especially against devices that mangle packets. So perhaps we should keep the thread to the merits, or otherwise, of having middle boxes that mangle packets in-transit.


>>  (b) How many of these enterprises you talk to have a policy that when staff take their laptops to conferences, hotels, other public wifi or the staffs' home network (a) ask the network provider if there is a network firewall, (b) get a copy of the network firewall ruleset and audit it to ensure it complies with their company's corporate firewall rules and (c) make sure this policy is followed?
>  
> Most - but not all - that provide the hardware will impose policy lockdown and host based firewalls for that reason, although I don't really see the relevance.

The relevance is that you’ve stated that there must NEVER be anything but a filtered pipe between any device and the internet because devices are unprotected - but at the same time accept that unfiltered connections are an accepted thing and host based firewalls are “a thing”.

It comes across as an inconsistent stance.


Simon