Subject: RE: [Speermint] NATs and Firewalls/Topology Hiding

From: "Roy, Radhika R." <[email-masked]>
Date: Wed, 5 Apr 2006 12:10:24 -0400

Folks:

I see some interesting discussions related to security.

In the last p2p-SIP BoF, it turns out as follows: a. Absolute Security and
b. Relative Security.

It was opined that it is almost impractical, if not impossible, to devise
any schemes that can be termed as Absolute Security.

So, out works are falling to a "kind" of Relative Security. I guess, in this
context, that NATs/Firewalls that provide topology hiding, as Sohel pointed
out, also fall into this category.

We can also think that the tremendous popularity of the VPNs is also
primarily for the topology hiding. Since this topology hiding feature has
come to stay, we have no choice but have to deal with this.

The point is this: Let us not debate whether NATs/Firewalls/VPNs provide
good security or not. Rather, let us assume that the topology hiding
features are there, and how do we deal with this reality?

Best regards,

Radhika

-----Original Message-----
From: [email-masked] [mailto:[email-masked]
<mailto:[email-masked]> ] On Behalf Of Khan, Sohel Q [CTO]
Sent: Wednesday, April 05, 2006 10:34 AM
To: Jonathan Rosenberg; Hadriel Kaplan
Cc: Stastny Richard; [email-masked]
Subject: RE: [Speermint] RE: NATs and Firewalls

Jonathan Rosenberg wrote: 

...

>Folks also claim that NAT provides security by obfuscating the network

behind the NAT. An attacker cannot 

>determine how many hosts are behind the nat, and it never sees any of

their addresses. I'm skeptical that this is a real > security benefit,

but hiding of internal topology and internal addresses is often cited as

a security feature; YMMV.

I agree that topology hiding is a kind of security feature.

Sohel Khan, Ph.D.

Technology Strategist

Sprint-Nextel

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint