Subject: Re: (NAT) Host NAT issues and Security Policy Servers

From: "Michael C. Richardson" <[email-masked]>
Date: Thu, 07 Jan 1999 11:42:20 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Pyda" == Pyda Srisuresh <[email-masked]> writes:
    Pyda> At the same time as policy based networking is becoming pervasive,
    Pyda> there is growing desire to make end-nodes smarter and
    Pyda> network/policy aware. To that end, the SPS draft identifies a
    Pyda> mechanism to offer policy service to end nodes and intermediate
    Pyda> nodes alike.
   
    Pyda> However, SPS is only a policy server, not an enforcement point.

  That is not an accurate statement. SPS is a system for discoverying
policy servers, and for discovering where the PEPs that need to be satisfied
are. 

    Pyda> You do need protocols and enforcement points that execute specific
    Pyda> policies. In particular, a Host-NAT protocol that can be used by
    Pyda> private hosts to attain temporary external address to connect to
    Pyda> external nodes is required.

    Pyda> 2. There are parallels between Host-NAT and Mobile-IP. I agree.

  I didn't bring up mobile-ip specifically, and mobile-ip tries hard not
to require any new behaviour from existing hosts.

  The common thread between various QoS systems (RSVP in particular), IPsec,
Host-NAT, etc. is that it is no longer sufficient to simply send out a TCP
Syn packet to the destination IP that you want to talk to. In the presence
of all three of these systems, you may need to do something that is
functionally equivalent to call setup first. 
  At one point I was an advocate of simply sending the packet out and letting
any PEP in the way announce themselves to the end host by sending back ICMPs
to inform the end node of what kind of negotiation it needs to do first. I
presented slides at IETF #36 (Montreal) at the IPsec WG about this
idea. However, that is too late for many systems:

  1. In Host-NAT you need to pick the right originating address and port
	numbers first. Once you have sent out the packet, it is usually
	too late to change these.

  2. In IPsec you may have disclosed something you shouldn't
	have. (Particularly true in the t/tcp and rpc/udp cases)

  3. In QoS systems, you could do the reservation setup simultaneous to the
	TCP 3-way handshake (for the control connection), but it seems silly
	to then sever the connection if you can't get the bandwidth you
	wanted. If the RSVP fails, you want to return something like a "fast
	busy" to the IPvoice person. 
	
  Of course, people want to be able to make IPsec secured IPphone calls
from behind their NAT boxes, so you really want to combine all three. 

  What I am saying is that any attempt to introduce any of these three
(probably there is a fourth that I can't think of right now) items into end
systems should provide for a common policy discovery protocol. SPS is one such
protocol. RSVP is another, although I'm not certain that it can be modified
to discover IPsec gateways and D/H-NATs.

  i.e. don't try and figure out a way to make IPsec or QoS or DiffServ NAT
friendly. Instead, recognize that the upgrade to support any of these
protocols provides an opportunity to get something like Host-NAT installed.

   :!mcr!:            |  Network and security consulting/contract programming
   Michael Richardson |         Firewalls, TCP/IP and Unix administration
 Personal: http://www.sandelman.ottawa.on.ca/People/Michael_Richardson/Bio.html
 Corporate: http://www.sandelman.ottawa.on.ca/SSW/
	ON HUMILITY: To err is human, to moo bovine.

  

-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.

---

From: "Luis A. Sanchez" <[email-masked]>
Date: Thu, 7 Jan 1999 21:33:43 -0500 (EST)

Michael,

	Your characterization of SPS is correct. SPS is a system that
provides hosts, PEPs and other entities with several policy services
including: discovering of policy servers, discovering of PEPs,
discovering of policies applicable to a communication, inter-domain
negotiation of all discovered policies applicable to a communication,
resolution of policy conflicts along the path of the communication and
last but not least caching of policies for performance
improvement. Pyda's observation is an important one, SPS is not an
enforcement mechanism and should not be thought of as one. One would
still need other protocols as required by the PEPs, hosts, etc.

Luis

-