Re: [v6ops] draft-ietf-v6ops-enterprise-incremental-ipv6 WGLC

[Mark Andrews <[e-mail]>]

In message <[e-mail]>, Brian E Carpenter writes:
> On 12/08/2013 17:27, Arie Vayner (avayner) wrote:
> > Owen,
> > 
> > While the arguments about moving the firewalls closer to the users are valid they are often are not practical (or at least the cus
> tomers I worked with would not implement this option).
> > Imagine an enterprise network with 300 spoke sites, but only 2 or 3 Internet gateway locations (with some private WAN in between).
> > Moving the firewalls to the spoke sites would increase the number of firewalls from ~3 to ~300 (I am ignoring redundancy and scale
>  for a second)... This is a major CAPEX and OPEX impact...
> 
> Clearly DOS and scanning protection has to be done as close to the Internet
> border routers as possible, and there your logic applies.
> 
> However, as Steve Bellovin pointed out many years ago, the best number of
> firewalls for upper layer protection is one per host, which scales nicely
> and has less CAPEX and OPEX than middlebox firewalls will ever have.
> 
> Not that I see any of this argument as relevant to the IP version number.
> 
>    Brian

IP version number brings with it a different set of minimums that
nodes / hosts have or should have if the manufacturers were paying
attention as we learnt how not to do thing in IPv4.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]