Subject: [MEXT] Firewall presentation/IETF70

From: <[email-masked]>
Date: Tue, 4 Dec 2007 19:46:45 +0200

What is the difference between Firwall for MN and Firewall CN? Shouldn't
be it more generic like Firewall for mobile host?

-Preeti

_______________________________________________
MEXT mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mext

---

From: "Ivancic, William D. (GRC-RCN0)" <[email-masked]>
Date: Tue, 4 Dec 2007 12:04:23 -0600

In Administrator document:

"3.3.  Data traffic from and to MN passing through the HA

   If a CN tries to initiate traffic to an MN, a stateful firewall would
   prevent these connection requests to pass through as there is no
   established state on the firewall.  If this is necessary to do, the
   pattern to look for is

     Destination Address: MN HoA

   Allowing this traffic might allow any kind of traffic, including
   malicious traffic, to pass through unfiltered to the MN.  This would
   expose the MN to any type of possibly malicious traffic, resulting in
   a denial of service or exploitation of known security
   vulnerabilities.  This practice is NOT RECOMMENDED.  Instead, a
   dynamically created pinhole like the one specified in [MIP6FWVENDOR]"

The last sentence implies a way to dynamically create a pinhole is
specified in the "MIP6FWVENDOR" document.

However, upon review of the MIP6FWVENDOR the solution appears to be only
for rules where the MN sends a binding update.

"5. Allowing data packets based on signaling

   Once the MIPv6 signaling completes, the data traffic can begin to
   flow.  The traffic filters for the data traffic can be inferred from
   the contents of the signaling messages that setup the session.  This
   section describes how firewalls can intelligently setup filters for
   data traffic based on signaling traffic.The following example
   describes how to setup a filter for allowing incoming route optimized
   messages from a CN to an MN after the MN sent a BU message to a CN."

If this is correct, either the last sentence in 3.3 needs to me removed
or modified or some clarification has to be made that a CN either has to
be allowed to transition the FW at all times and take the risk or if a
CN initiates a conversation with the MN when both are outside the
firewall, the communiciation will fail.

Will

---

From: "Suresh Krishnan" <[email-masked]>
Date: Tue, 4 Dec 2007 14:24:03 -0500

Hi Preeti,
  As a general concept I agree. But, let's say I own a set of servers that are not mobile. They are protected by a firewall. This firewall needs to be explicitly configured to let MIPv6 related traffic thru even though it does not protect mobile nodes. Also, the traffic patterns to be allowed on each firewall can vary. That is why there are separate sections covering each firewall.

Thanks
Suresh

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Tue 4/12/2007 12:46 PM
To: [email-masked]
Subject: [MEXT] Firewall presentation/IETF70

-Preeti

---

From: "Qiu Ying" <[email-masked]>
Date: Wed, 5 Dec 2007 03:27:30 +0800

The difference is that the inbound packets to CN is variable while the inbound packet to MN is fixed (assume that CN is not a mobility host). So the firewall configuration would be difference.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Wed 12/5/2007 1:46 AM
To: [email-masked]
Subject: [MEXT] Firewall presentation/IETF70

-Preeti

------------ Institute For Infocomm Research - Disclaimer -------------This email is confidential and may be privileged.  If you are not the intended recipient, please delete it and notify us immediately. Please do not copy or use it for any purpose, or disclose its contents to any other person. Thank you.--------------------------------------------------------