Subject: RE: IPP> review of IPP documents

From: Paul Moore <[email-masked]>
Date: Fri, 29 May 1998 17:25:07 -0700

Typically (take MS for example). The firewall and the proxy are quite
differnt things. The proxy is an enabler and the firewall is a protector.

None of our internal network has 'real' IP addresses -I can, however use our
proxies to browse anywhere on the net. Our firewall has the task of
prtecting only a limited number of servers that are connected to the
Internet (mail gateways fore xample and the proxies).

today I can use IPP from my desktop machine to print to an IPP printer on
the INternet  using our proxy. If I were to move to a different port then I
would not be able to do this - most proxies only work with a defined set of
protocols on well-known ports (HTTP, FTP mainly)

> -----Original Message-----
> From:	Keith Moore [SMTP:[email-masked]]
> Sent:	Friday, May 29, 1998 4:32 PM
> To:	Paul Moore
> Cc:	'Keith Moore'; [email-masked]; [email-masked]
> Subject:	Re: IPP> review of IPP documents 
> 
> Please explain why it's useful to be able to send IPP through
> proxies that don't act as firewalls.  If you don't have a firewall
> in the way, why not just talk directly to the IPP server?
> 
> Keith

---

From: Keith Moore <[email-masked]>
Date: Fri, 29 May 1998 20:30:50 -0400

> differnt things. The proxy is an enabler and the firewall is a protector.

okay...slightly different use of terminology.

insisting on IPP using port 80 just to be able to tunnel through 
firewalls/proxies simply will not fly ...it leads to an arms race.
(not to mention that everybody will want to use port 80, which 
is clearly unworkable)

if your employer wants you to be able to use external printers,
they can punch a hole in their firewall, or add a proxy, to 
allow you to talk to the default IPP port. 

we can't let the existence of NAT boxes dictate the whole architecture.

Keith