IETF Logo Mail Archive

Re: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03

Rémi Denis-Courmont <rdenis@simphalempin.com> Wed, 27 August 2008 09:45 UTC

Return-Path: <owner-v6ops@ops.ietf.org>
X-Original-To: ietfarch-v6ops-archive@core3.amsl.com
Delivered-To: ietfarch-v6ops-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3C84F3A6977 for <ietfarch-v6ops-archive@core3.amsl.com>; Wed, 27 Aug 2008 02:45:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -100.441
X-Spam-Level:
X-Spam-Status: No, score=-100.441 tagged_above=-999 required=5 tests=[BAYES_20=-0.74, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KOKuxmz+OR9L for <ietfarch-v6ops-archive@core3.amsl.com>; Wed, 27 Aug 2008 02:45:07 -0700 (PDT)
Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by core3.amsl.com (Postfix) with ESMTP id E14A93A684F for <v6ops-archive@lists.ietf.org>; Wed, 27 Aug 2008 02:45:05 -0700 (PDT)
Received: from majordom by psg.com with local (Exim 4.69 (FreeBSD)) (envelope-from <owner-v6ops@ops.ietf.org>) id 1KYHZ9-0002gR-RY for v6ops-data@psg.com; Wed, 27 Aug 2008 09:43:51 +0000
Received: from [2001:41d0:1:a0d6::401:1983] (helo=yop.chewa.net) by psg.com with esmtp (Exim 4.69 (FreeBSD)) (envelope-from <rdenis@simphalempin.com>) id 1KYHZ6-0002fp-43 for v6ops@ops.ietf.org; Wed, 27 Aug 2008 09:43:50 +0000
Received: by yop.chewa.net (Postfix, from userid 33) id A36E8CC9; Wed, 27 Aug 2008 11:43:46 +0200 (CEST)
To: IPv6 Operations <v6ops@ops.ietf.org>
Subject: Re: Some suggestions for draft-ietf-v6ops-cpe-simple-security-03
MIME-Version: 1.0
Date: Wed, 27 Aug 2008 11:43:46 +0200
From: Rémi Denis-Courmont <rdenis@simphalempin.com>
Organization: Remlab.net
In-Reply-To: <48B50B10.9090005@free.fr>
References: <20080824204553.08131c65.ipng@69706e6720323030352d30312d31340a.nosense.org> <48B1CCE8.1070305@gmail.com> <01af01c9065b$b4602440$c2f0200a@cisco.com> <48B23391.1090503@gmail.com> <01cd01c90672$a57c8790$c2f0200a@cisco.com> <48B31DA3.6080001@gmail.com> <07d201c906f7$50a85e30$c2f0200a@cisco.com> <48B32B43.5010103@gmail.com> <084c01c906fe$f9bf1840$c2f0200a@cisco.com> <48B33430.40704@gmail.com> <08b901c90710$4064aa60$c2f0200a@cisco.com> <48B354FA.7040601@gmail.com> <48B50B10.9090005@free.fr>
Message-ID: <f0913a34d402b6a4d25787bab3eea17b@chewa.net>
X-Sender: rdenis@simphalempin.com
User-Agent: RoundCube Webmail/0.1
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Sender: owner-v6ops@ops.ietf.org
Precedence: bulk
List-ID: <v6ops.ops.ietf.org>

On Wed, 27 Aug 2008 10:06:40 +0200, Rémi Després <remi.despres@free.fr>

wrote:

> Brian E Carpenter   (m/j/a) 8/26/08 2:57 AM:

>> On 2008-08-26 12:11, Dan Wing wrote:

>>> Brian E Carpenter wrote:

>>>> But blocking tunnels by default, although it's simple, also

>>>> blocks innovation. That worries me.

>>> Would your worry go away if the IETF initiated a standards effort

>> around something like Apple's ALD (draft-woodyatt-ald-03.txt)?

>>

>> I believe that something like that is needed.



Me too.



> I also support that remote control of packet filtering should be

> standardized.

> 

> IMO, its scope should cover both:

> - CPE control by hosts

> - control of ISP provided filtering devices by customer sites.



I have to disagree. An ISP is not supposed to do filtering in the first

place.



Also, in real life, filtering by ISP is typically one of:

- NAT contingency, in which case it cannot be controlled directly,

- not meant to be controlled by the user

  (e.g. blocking SMTP, NetBIOS, or other protocols, spoof protection...)



I dare stress that NAT control is _not_ the same thing as filtering

control.



-- 

Rémi Denis-Courmont

v2.23.0 | Report a Bug | By Email