Subject: [NSIS] Some questions about the NAT/FW NSLP

From: Jukka MJ Manner <[email-masked]>
Date: Fri, 28 Apr 2006 21:17:08 +0300 (EEST)

Hi,

while reviewing the NAT NSLP, several questions emerged:

A. Does proxy mode for DS (3.8.7.1) work if you have more than one inbound
  route? A multihomed NF.

B. Should the TOS byte be also available as a field for matching traffic?

C. Should there be a rule for modifying a packet? Now we "allow" or
   "deny", but about also "modify"?

D. Should there be a "log" action to store information about certain 
   packet flows?

Cheers,
Jukka

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 30 Apr 2006 14:40:17 -0400

Hi Jukka,

a short feedback:

> A. Does proxy mode for DS (3.8.7.1) work if you have more than one inbound

Yes, It works if the edge device is a NAT. With a firewall there might 
be a problem if the DS does not send an NSIS message. The edge-firewalls 
would have to use a firewall synchronization protocol. We noted this 
issue in the appendix of the draft.

> B. Should the TOS byte be also available as a field for matching traffic?

I still remember your old issue 
https://kobe.netlab.nec.de/roundup/nsis-natfw-nslp/issue46.

I personally would like to see it as an extension because I want to 
finish the document and it is, in some sense, an extension to the base 
protocol from a functionality point of view.

>    "deny", but about also "modify"?

What is the scenario? I guess you are talking about a "rewrite" DSCP 
value or something along these lines.

> D. Should there be a "log" action to store information about certain 
Not in the base protocol. There are several problems with it and it some 
sense that's what the Meeting NSLP does. If you read the M-NSLP draft 
then you will notice the types of problems you suddenly have to deal with.

Ciao
Hannes