Re: [v6ops] I-D Action: draft-ietf-v6ops-ipv6-ehs-packet-drops-00 - Middleboxes

[Brian E Carpenter <[e-mail]>]

On 03-Aug-20 00:05, Ole Troan wrote:
> 
> 
>> On 1 Aug 2020, at 18:47, Vasilenko Eduard <[e-mail]> wrote:
>>
>> I am still not happy that middleboxes (Firewall, Load Balancer) are discarded as the reasons for EH drops.
>>
>> Tom (Herbert) is right that “FWs and middleboxes that insist on meddling in protocol layers beyond the networking layer where both the standard and the Internet architecture say they are not supposed to look at”
>>
>> But they are! We should not ignore the reality.
>>
>> It is especially evident that they are among reasons for EHs drops after response:
>>
>> > I would love to see the firewall device that is capable of processing ALL protocol headers in the IETF protocol suite! *Reality is that firewalls can only process what they are programmed to process which is typically a very small subset of the possible protocols a host might want to use.*
>>
>>  
>>
>> It is not good to ignore/hide some type of drops that we do not like.
>>
> I think you have a good point. 
> 
> If I was implementing a function to wash traffic in front of a set of eg DNS servers, why would I ever let any EH through? Known or unknown.
> 
> There’s a chicken and egg situation. Awaiting  an across the Internet useful EH option. 

Indeed. This was actually the main reason that SHIM6 failed to take off. It was by definition useful across the Internet if it was useful at all, and in fact it could and did successfully cross transit networks, but the only way to get it out of and into end sites was to bypass the site firewalls.

> Apart from measuring the transparency level of the core Internet, it’s unclear to me what useful conclusions we can draw from this work. 

Measuring the transparency of the core seems like a very good thing to do, since the traditional Internet archictecture assumes a transparent core.

Regards
     Brian