Subject: [NSIS] NATFW NSLP: Signaling for ICMP policy rules

From: Martin Stiemerling <[email-masked]>
Date: Tue, 31 Jan 2006 13:10:22 +0100

Dear all,

The NSIS working group has received some request from a 3GPP2 working  
group to add features to the NATFW NSLP, as said in my email sent  
before.

One of the features is the ability to signaling for ICMP policy  
rules. Up to now, the NATFW NSLP can signal for IP only, TCP, and UDP  
flows by using the NTLP path-coupled MRM and the LE-MRM. It's  
possible to signal for ICMP flows by using the PC-MRM and setting the  
'protocol' field to 'ICMP'. However, it is currently not possible to  
specify anything beyond that, for instance, the ICMP code to be used.

Here is the proposed extension to the NATFW NSLP:
- Add a new object 'icmp' that carries solely the ICMP code
- This object can be included in CREATE messages where the NTLP is  
carrying a MRM with IP addresses only, protocol set to ICMP.
- For REA and REA-F, the "Data Terminal Information Object" must be  
modified to carry the ICMP code.

This proposed change does *NOT* require any change to the NTLP but  
*ONLY* to the NATFW NSLP.

Any view on this?

Thanks,

   Martin

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: "Henning Peters" <[email-masked]>
Date: Tue, 31 Jan 2006 19:00:39 +0100 (CET)

Hi Martin,

can you specify an application for the signaling of ICMP policy rules?
Don't ICMP messages already refer to a certain data flow? I don't see a
reason why a firewall or NAT should deny or drop them. And if they are
configured to behave like this, a different configuration might not be
wanted in the first place?! But probably the 3GPP2 guys already have sth.
particular in mind that I am currently not seeing.

How does the change affect NAT? As this might have impacts on the
(de)multiplexing behavior of NATs.

If adding a new code object to NAT/FW NSLP, allowing multiple codes in a
single message might be valuable to save unnecessary signaling traffic.

> modified to carry the ICMP code.

Why do you want to have a new code object _and_ an additional code field
in the DTInfo object? Wouldn't it make sense to set the protocol to ICMP
in DTInfo protocol field and add the new ICMP code object regularly?

Henning

Martin Stiemerling sagte Di, 31.01.2006, 13:10:
>    Martin_______________________________________________
> nsis mailing list
> [email-masked]