Re: [v6ops] Thoughts about wider operational input

The vendor where I am working now is telling that it is exactly 2x cheaper on OPEX and CAPEX to have 1 box in every branch instead of 2. And claim that there is not any compromise on features for the combo device.
But it does not address the situation if FWs are managed by the security department on the Enterprise side.
And the vendor that is pushing separate devices is still there. They believe that 2x revenue is better.
Ed/
-----Original Message-----
From: v6ops [mailto:v6ops-bounces@ietf.org] On Behalf Of Brian E Carpenter
Sent: Tuesday, April 5, 2022 1:47 AM
To: v6ops@ietf.org
Subject: Re: [v6ops] Thoughts about wider operational input

Indeed, for large enterprises that is true. But surely vendors should be motivated to provide single-box solutions for medium size enterprises?

Regards
    Brian

On 04-Apr-22 23:20, Vasilenko Eduard wrote:
> In reality, it is not easy to have a good firewall and Router at the same time even for a software box.
> There were times when I was working for a famous vendor that has a firewall and router as strictly separate devices.
> This vendor told Enterprises that it is good because the router and firewall are typically managed by different departments.
> And because FW for the Enterprise market should have a lot of features that are not available on combo devices.
> 
> My point here: do not assume that it would be easy in all cases to activate FW on the CPE.
> Ed/
> -----Original Message-----
> From: v6ops [mailto:v6ops-bounces@ietf.org] On Behalf Of JORDI PALET 
> MARTINEZ
> Sent: Monday, April 4, 2022 1:20 PM
> To: v6ops@ietf.org
> Subject: Re: [v6ops] Thoughts about wider operational input
> 
> Yep, that's part of the problem.
> 
> I don't think typically "non-home-oriented-CPEs" have an IPv6 
> firewall,
or at least not enabled by default.
> 
> "small" SMEs most of the time use the same connectivity as a household subscriber, so most of the time the same "home-oriented-CPE".
> 
> If we move to medium SMEs, and of course, enterprises, they should have, in addition to the CPE, a firewall. It may happen that in many cases, they have it, but not neccesarily all.
> 
> Regards,
> Jordi
> @jordipalet
>   
>   
> 
> El 30/3/22, 23:16, "v6ops en nombre de Brian E Carpenter" <v6ops-bounces@ietf.org en nombre de brian.e.carpenter@gmail.com> escribió:
> 
>      Jordi,
> 
>      As we all know, home gateways that support IPv6 are shipped with 
> a
quite adequate default firewall configuration. Is there a good specification for a default firewall configuration for an SME CE router?
> 
>      Probably this isn't realistic for large enterprises?
> 
>          Brian
>      On 31-Mar-22 07:27, JORDI PALET MARTINEZ wrote:
>      > Because if you don't have NAT, you are forced to properly configure a firewall.
>      >
>      > With a NAT, many don't even have a firewall or is not sufficiently well
>      configured.
>      >
>      > Regards,
>      > Jordi
>      > @jordipalet
>      >
>      >
>      >
>      > El 30/3/22, 17:58, "v6ops en nombre de Joe Maimon" <v6ops-bounces@ietf.org en nombre de jmaimon@jmaimon.com> escribió:
>      >
>      >
>      >
>      >      JORDI PALET MARTINEZ wrote:
>      >      >
>      >      > To demonstrate how NAT is not security, you just need to enable Teredo
>      >      > or any other UDP tunneling traversing the NAT, so the security guys
>      >      > can see that without any special config in the NAT, you can dig a
>      >      > whole on it (Teredo Navalis = Shipworm).
>      >      >
>      >      > Regards,
>      >      >
>      >      > Jordi
>      >      >
>      >      > @jordipalet
>      >      >
>      >
>      >      And then you need to demonstrate how the equivalent would not happen on
>      >      IPv6.
>      >
>      >      Joe
>      >
>      >      _______________________________________________
>      >      v6ops mailing list
>      >      v6ops@ietf.org
>      >      https://www.ietf.org/mailman/listinfo/v6ops
>      >
>      >
>      >
>      > **********************************************
>      > IPv4 is over
>      > Are you ready for the new Internet ?
>      > http://www.theipv6company.com
>      > The IPv6 Company
>      >
>      > This electronic message contains information which may be privileged or
>      confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is
>      strictly prohibited, will be considered a criminal offense, so 
> you
must reply to the original sender to inform about this communication and delete
>      it.
>      >
>      >
>      >
>      > _______________________________________________
>      > v6ops mailing list
>      > v6ops@ietf.org
>      > https://www.ietf.org/mailman/listinfo/v6ops
>      >
> 
>      _______________________________________________
>      v6ops mailing list
>      v6ops@ietf.org
>      https://www.ietf.org/mailman/listinfo/v6ops
> 
> 
> 
> **********************************************
> IPv4 is over
> Are you ready for the new Internet ?
> http://www.theipv6company.com
> The IPv6 Company
> 
> This electronic message contains information which may be privileged 
> or
confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.
> 
> 
> 
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
> 

_______________________________________________
v6ops mailing list
v6ops@ietf.org
https://www.ietf.org/mailman/listinfo/v6ops