Subject: [NSIS] 3GPP2 and NSIS' NATFW NSLP

From: Martin Stiemerling <[email-masked]>
Date: Tue, 31 Jan 2006 09:17:16 +0100

Dear all,

You still remember the draft "Requirements for Firewall Configuration  
Protocol" (draft-bajko-nsis-FW-reqs-04.txt) on 3GPP2's requirements  
wrt the NATFW NSLP. 3GPP2 is calling this protocol NFCCP (Network  
Firewall Configuration and Control Protocol).

Based on this draft and further discussions between 3GPP2 members  
(mainly Gabor) and the NATFW NSLP authors, the NSIS WG has been  
invited by the 3GPP2 TSG-X WG 31 (PSN, packet switched networks) to  
present the NATFW NSLP protocol. This 3GPP2 WG is looking for  
firewall signaling protocol, running mainly between the mobile  
terminal and the 3GPP2 network firewalls.

The NATFW NSLP authors and John have prepared a slide set and finally  
John has presented the slides at the last 3GPP2 meeting in Vancouver  
(Jan 17th).  There has been second proposal for the NFCCP by Qualcom  
(http://www.ietf.org/internet-drafts/draft-paddon-pfcp-00.txt) which  
is client/server based. The WG had to decided whether is goes for a  
client/server or path-coupled approach.

The presentation worked out fine and almost all questions by 3GPP2  
have been answered. The WG is in favour of the path-coupled NSIS  
approach, i.e., the NSIS NATFW NSLP will be the NFCCP. Only some open  
issues remained in the end (see below for a list of them).

The slide set is available here:

http://www.stiemerling.org/ietf/nsis/ 
3gpp2/3gpp2_nsis_natfw_overview_final.ppt

The open issues to clarify are:

   1) port range parameter field
   2) ICMP support
   3) Query method for firewall capabilities
   4) Mobile IPv6 support (later, probably in draft 10)
   5) Wildcarding, i.e., one shot signaling message to teardown a  
whole set of policy rules belonging to a specific IP address
   6) Roaming

All issues are currently being discussed and will be posted issue by  
issue to the mailing list soon. Issue 6 is subject to further  
discussions with 3GPP2, since the exact technical background is not  
yet fully understood by the NATFW authors. Issue 1) has been  
discussed at the last IETF meeting and has been agreed to include  
this feature. Issue 2) will have a separated email thread

With best regards,

     Martin Stiemerling

NEC Europe Ltd. -- Network Laboratories [email-masked]
PGP Key at:        http://www.stiemerling.org/stiemerling_nec.gpg
WWW: http://www.netlab.nec.de

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis